Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.4] - 2026-09-10

Component Versions

Note: copilot-shell, os-skills, skillfs, and ws-ckpt are unchanged since v1.3; they are listed to show the complete stack composition.

Highlights

• cosh-ng: Updated to v0.24.1, routes natural-language and path-like input to the Agent in Enhanced Assisted Zsh while preserving ordinary Shell behavior and the user's terminal customizations, users get a more natural Zsh experience without rebuilding their existing setup (#3004, #3156)
• agent-sec-core: Updated to v0.12.0, applies configured policy checks consistently to legacy cosh and cosh-ng Skill calls while reducing false positives, users get consistent Skill enforcement and fewer incorrect security findings across both shells (#2871, #2928)
• agentsight: Updated to v0.12.1, adds collection without eBPF, native DashScope support, Kubernetes packaging, and more resilient long-running capture, operators can retain accurate observability in restricted and production environments (#2954, #2976, #3135, #3147)
• tokenless: Updated to v0.8.1, adds QwenPaw support and reversible compression for large JSON payloads, build logs, and CSV/TSV data, agents can reduce more kinds of context and retrieve omitted content precisely when needed (#3047, #3052, #3067, #3075, #3089)
• anolisa: Updated to v0.3.11, adds QwenPaw adapter management and ktuner discovery when the configured repository provides it while improving install, recovery, and audit behavior, administrators get more trustworthy lifecycle status and component-index previews without requiring root (#2084, #3075, #3127, #3141, #3142, #3158)
• agent-memory: Updated to v0.2.7, improves OpenClaw installation, corpus retrieval, configuration validation, and source-build setup, agents can share persistent memory with more reliable setup and recall (#2560, #3149, #3155, #3177, #3187)

Updated

• cosh-ng: Updated to v0.24.1, improves prompt routing, terminal redraws, history recall, custom Tab behavior, login-profile PATH loading, credential redaction, and Hook trust visibility while removing the system OpenSSL requirement, users can keep their existing shell configuration and receive reliable Agent assistance without losing commands, output, or sensitive-history protection (#2967, #2983, #2996, #2999, #3004, #3030, #3050, #3058, #3156)
• agent-sec-core: Updated to v0.12.0, applies the same Skill policies across legacy cosh and cosh-ng, reduces scanner false positives, reports every integrity outcome through skill-ledger and check, and speeds up container health checks, users get consistent enforcement, clearer verification results, and faster readiness checks (#2707, #2871, #2879, #2928)
• agentsight: Updated to v0.12.1, adds collection without eBPF, native DashScope and Kubernetes deployment support, Agent resource monitoring, and cosh-ng traffic capture while improving attribution accuracy, tool-result retention, enforcement synchronization, Token accounting, stream completion, duplicate suppression, startup recovery, and automatic capture recovery, operators can trust timelines and usage totals while keeping monitoring and protection running through long-lived workloads and transient failures (#2916, #2954, #2976, #2979, #3005, #3011, #3016, #3081, #3087, #3135, #3147, #3191)
• tokenless: Updated to v0.8.1, adds QwenPaw integration, reversible reduction for large JSON collections, build logs, and CSV/TSV output, omitted-content retrieval through existing Shell tools, and trace correlation while fixing installation and compatibility issues across supported hosts, agents can use less context across more tool results and recover the exact omitted data when needed (#2249, #3009, #3047, #3052, #3067, #3068, #3075, #3085, #3089, #3094)
• anolisa: Updated to v0.3.11, adds QwenPaw adapter lifecycle management and ktuner discovery from configured repositories, permits declared config edits without false corruption reports, records hook-modified files correctly, avoids false pending operations after package conflicts, enables component-index previews without root, and improves cleanup, logs, dry-run, and audit guidance, administrators can inspect and recover installations with state that better reflects the actual system (#2084, #2618, #2922, #2926, #2994, #3075, #3118, #3127, #3141, #3142, #3158)
• agent-memory: Updated to v0.2.7, negotiates OpenClaw installation capabilities, distinguishes permission and configuration failures, returns readable and accurately windowed corpus results, validates configuration before binary discovery, and prepares Node.js and npm dependencies for source builds, agents and operators get more reliable installation, diagnosis, and memory recall (#2560, #3149, #3155, #3177, #3187)

Compatibility

• Tokenless Protocol v2: tokenless compress now accepts only before_model, pre_tool, post_tool, and retrieve lifecycle requests; Protocol v1 and tokenless mcp serve have been removed. Upgrade Tokenless Core, CLI, SDKs, and adapters together and declare recovery capability explicitly to avoid protocol or retrieval mismatches (#2978, #3068).
• Tokenless Rust APIs: Replace TokenlessRuntime::compress with the Runtime lifecycle methods. Direct response-compression callers must migrate from the removed tokenless-pipeline crate and tokenless_schema::ResponseCompressor to the Runtime or tokenless-compressors APIs (#2974, #2978).
• Tokenless Python and AgentScope APIs: Replace the removed ModelRequest, ToolCall, ToolResult, and ToolResponseCompressor types with typed before_model, pre_tool, post_tool, and retrieve lifecycle requests. AgentScope integrations must add ToolContract metadata for custom tools and expose one static retrieval tool (#2986, #3029).
• Tokenless retrieval configuration: Custom retrieve_tool_name values must satisfy the tool-name rules. Lifecycle schema compression now requires an authorized static retrieval tool and an available Stash; without both, hooks preserve the original schemas. Recovering omitted content also requires a reachable CLI or static tool and a host that can replace the current tool result, including Claude Code 2.1.121 or newer. Existing <<tokenless:HASH>> markers remain readable (#2978, #2995, #3029, #3052, #3068).
• Tokenless adapter configuration: OpenClaw now uses post_tool_enabled for PostTool optimization; its former response, TOON, skip-tool, and shell-tool policy settings have been removed and no longer control compression. Remove those obsolete settings and configure post_tool_enabled when upgrading. DeepSeek Harness users must also remove adapter-specific thresholds and tool lists and use the shared compression policy. OpenClaw remains limited to lossless transcript updates without same-turn replacement or retrieval (#3009, #3036).
• Tokenless statistics fields: Dashboards and integrations must replace seam and compressor_chain with content_origin, applied_operations, and recoverability. The legacy SQLite columns remain for compatibility, but new records no longer populate them, so queries that keep using the old fields can return empty or incorrect reports after upgrading (#2978).
• AgentSight timestamps: Kernel event timestamps are now calibrated to host wall-clock time instead of container uptime. If NTP or an administrator steps the host wall clock while kernel events are queued, affected historical wall-clock timestamps cannot be reconstructed; persisted records are unaffected. Mark each wall-clock adjustment when analyzing timelines across it (#3128).
• agent-sec-core Python dependency: Python deployments and source builds now require cryptography 50.0.1 or newer. Refresh the environment from the exported requirements before upgrading custom installations (#3015).
• agent-memory source builds: Building the OpenClaw adapter from source now requires Node.js 20 or newer and npm. The unified user-mode build provisions them automatically; system-mode builds report missing tools during preflight (#3187).
• anolisa RPM previews: On DNF 4 systems, RPM install --dry-run requires sudo and may refresh repository metadata while checking solver conflicts. The check now runs before recovery journals are created (#3158).
• anolisa editable configs and state format: Allowing content edits to raw-installed type = "config" files does not change update or uninstall semantics, so back up customized configs before either operation. The new kind = "config" state records are unreadable by older CLI versions; before downgrading, also back up state and convert affected owned-file entries to kind = "file" to restore content-digest validation (#3142).

[1.3] - 2026-08-31

Component Versions

Note: copilot-shell and agent-memory are unchanged since v1.1; they are listed to show the complete stack composition.

Note: agent-sec-core follows a release-branch flow, so main still shows 0.11.0; the shipped 1.3 stack uses the sec-core/v0.11.1 tag, and the entries below describe behavior on that tag rather than on main.

Highlights

• cosh-ng: Updated to v0.22.2, added native shell integration with Shift+Tab Shell-only switching and card prefixes that mark output ownership, users can run a hook-free shell while still seeing which subsystem produced each line (#2759, #2832)
• agent-sec-core: Updated to v0.11.1, rebuilt the prompt scanner in Rust with updatable rule packs and an optional deep-analysis backend, and narrowed the invisible-character rule, users get faster prompt scanning with far fewer legitimate emoji and multilingual prompts flagged as critical injections (#2409, #2531, #2699, #2900)
• agentsight: Updated to v0.11.2, restores model-traffic capture on its own when it goes stale and now recognizes Bun-built Claude Code, users keep continuous observability without restarting the collector (#2782, #2792)
• tokenless: Updated to v0.7.14, added the unified tokenless compress entry point plus net-savings and Retrieve attribution in stats summary, adapters make at most one subprocess call and users can read estimated net token savings (#2844, #2885)
• ws-ckpt: Updated to v0.4.5, added k8s sidecar deployment (#2034, #2965) and a guarded checkpoint protocol with identity-fenced snapshots, users can checkpoint containerized workspaces and verify checkpoint state after a crash
• skillfs: Updated to v0.4.2, added Kubernetes sidecar deployment and optional mutual HMAC-SHA256 authentication for control and notify sockets, non-privileged workloads can consume a FUSE skill view across container namespaces (#2057, #2449)

Updated

• cosh-ng: Updated to v0.22.2, added a local gateway control plane exposed through cosh agent task|doctor|run, bounded transcript memory and a 32 MB run_command output cap, sub-millisecond interactive echo, automatic discovery of system extensions outside the package-managed root, and /hooks enable|disable layer disambiguation, and fixed terminal display and input routing (stray marker lines appearing after approved commands and slash commands, batch-pasted slash input, Han prompts containing paths, slash history recall, terminal left in raw mode after interrupts), security and audit gaps (hook-blocked commands running anyway in trust mode, approval batch races, malformed hook output silently passing tool calls through, fabricated exit codes for interrupted precmd markers), and packaging issues (RPM uninstall leaving a dangling login shell, gateway startup on systemd 255, dnf --dry-run false failures, missed awk system() calls in code scanning), users get a native shell with visible output ownership, bounded memory, and an auditable approval path (#2125, #2400, #2402, #2405, #2529, #2599, #2603, #2605, #2622, #2655, #2667, #2682, #2709, #2843, #2880, #2909, #2914, #2917, #2918, #2938, #2943, #2949, #2955, #2968)
• agent-sec-core: Updated to v0.11.1, added SkillFS HMAC peer authentication, an agent-sec-cli capabilities subcommand, and explicit CHECKED/PASSED/FAILED counters for verify, and stopped read-only system Skills from failing batch scans, placeholder set-policy/rotate-keys from reporting success, the daemon health check from over-reporting readiness, and non-loopback model service URLs from being accepted, users can audit Skills in cross-container deployments and trust CLI verification results (#2356, #2493, #2875, #2876, #2892, #2893, #2906)
• agentsight: Updated to v0.11.2, added historical agent activity views, semantic session search, a bilingual dashboard, LLM latency metrics, and store size limits, and fixed model-traffic capture that did not recover on its own, missing restart after the collector was killed for memory use, unbounded memory during event bursts, and interruption breakdowns that did not sum to the total, users keep long-running observability with bounded storage and self-healing capture (#2578, #2612, #2644, #2733, #2792, #2796, #2817, #2925)
• tokenless: Updated to v0.7.14, added the anolisa-tokenless Python wheel with framework-neutral lifecycles, AgentScope and DeepSeek Harness integrations, Gemini functionDeclarations schema compression, and a configurable array tail window, and fixed Codex double compression and inconsistent small-payload TOON handling, agents on more frameworks save tokens and can restore truncated payloads through the runnable command embedded in the marker (#2433, #2507, #2581, #2627, #2663, #2866, #2869, #2885)
• anolisa: Updated to v0.3.8, added verified prebuilt CLI archives for Linux x64/arm64 and macOS arm64, a native DSH adapter driver, container-runtime telemetry, and schema v2 target-based availability, and fixed raw installs expanding ${VAR} in rendered content, --quiet adapter output, --dry-run forget and restart previews, and systemd template instances left running after uninstall, users can install a standalone CLI per platform and preview operations without side effects (#2533, #2580, #2603, #2642, #2752, #2762, #2774, #2883, #2903)
• os-skills: Updated to v0.6.3, added the anolisa-component(os-skills) RPM capability, users can run anolisa upgrade for OS Skills even when the repository component index is unavailable (#2576)
• ws-ckpt: Updated to v0.4.5, added k8s sidecar deployment with a bilingual guide (#2034, #2965) and a guarded checkpoint protocol, and fixed a memory leak that eventually exhausted the daemon (#2554), loop-device checkpoint latency under concurrent IO (up to 5x lower) (#2523), orphaned images and loop devices after a failed bootstrap plus silent startup exits (#1956), config --global writes the daemon never loaded (#2813), and intermittent bootstrap failure when all loop devices are in use (#2965), users can checkpoint in containers with lower latency and actionable startup diagnostics
• skillfs: Updated to v0.4.2, added Kubernetes sidecar deployment, mutual HMAC-SHA256 socket authentication, an optional Alibaba Cloud Linux 4 sidecar image, and bounded backoff for startup reconciliation against a late notify daemon, and fixed categorized Skills not being found on flat normal-mode mounts, non-privileged workloads can consume an authenticated Skill view that converges automatically after a daemon restart (#2057, #2449, #2777, #2787, #2790, #2901)

[1.2] - 2026-08-14

Component Versions

Note: copilot-shell, agent-memory, skillfs, and ws-ckpt are unchanged since v1.1; they are listed to show the complete stack composition.

Highlights

• cosh-ng: Updated to v0.16.1, consolidated one-shot agent requests into /agent and converged the cosh-core and cosh-shell runtime paths with explicit protocol negotiation, users get one command for single agent requests and identical behavior from either runtime entry point (#2403, #2441)
• agent-sec-core: Updated to v0.10.1, unified hook policy controls so code scanning, prompt scanning, and observability are independently environment-gated across agent integrations, users can enable each protection per deployment without editing hook scripts (#2141, #2199, #2239)
• agentsight: Updated to v0.10.1, corrected turn boundaries and session continuity across cosh restarts, reclassified pause events as normal completions rather than interruptions (#2320), and added Codex trajectory conversion plus a dashboard that follows the browser locale, users get accurate cross-runtime trajectories in their own language
• tokenless: Updated to v0.7.6, added the OpenCode adapter and moved the Qoder adapter to native plugin and hook conventions, agents on both runtimes get command rewriting plus schema and response compression applied in place of the original tool output
• anolisa: Updated to v0.2.19, added package-family backend mapping for raw installs, adapter change notices after updates, and 2 GiB integrity degradation, administrators can install on minimal RPM/DEB hosts without large components being reported as damaged (#2018, #2271, #2314)

Updated

• cosh-ng: Updated to v0.16.1, added a raw packaging interface with cross-target build validation and portable macOS launchers, and fixed clock-skew input stalls, lenient streaming response decoding, sensitive file writes, raw-mode leaks on exit, predictable temporary paths, first-match-only slash hints, and CJK line wrapping, users get reproducible archives and a shell that wraps East Asian text correctly and leaves no terminal state behind (#2176, #2209, #2211, #2357, #2361, #2410, #2411, #2446)
• agent-sec-core: Updated to v0.10.1, added OpenClaw code-scanner block mode, wider prompt-scan inbound field coverage, read-only Skill analysis, raw Skill directories in ledger checks, manifest authentication before Skill package loading, and session/run filters for events queries, users can block risky code, inspect unpackaged Skills, and query security events by session (#2044, #2132, #2185, #2201, #2242, #2277)
• agentsight: Updated to v0.10.1, added Codex trajectory conversion to ATIF, process attribution on captured model traffic with ids resolved in the observer namespace (#2360), and dashboard localization, and fixed turns closing early when a tool call ended, pause events misclassified as interruptions (#2320), truncated streaming responses, QwenCode trace accuracy, sessions lost across cosh restarts, and unmapped cosh session temporary file writes (#2080), users get accurate cross-runtime trajectories in their browser locale
• tokenless: Updated to v0.7.6, allowed TOKENLESS_DATA_DIR to point outside the user home, hard-disabled Tool Ready pre-call checks and blocking, and fixed duplicate JSON Schema stashing, dry-run settings overridden by environment variables, and retrieve appending a trailing newline, agents recover stashed content in one retrieval and are no longer blocked by incorrect readiness results (#2380, #2386, #2396, #2399, #2425, #2434, #2487)
• anolisa: Updated to v0.2.19, added adapter change notices after anolisa update, Qoder native plugin lifecycle support, Codex hook trust persistence, OPENCLAW_STATE_DIR handling, and the standard JSON envelope for legacy commands, and migrated telemetry to SLS_PROJECT_PREFIX, users can manage adapters across frameworks and parse every JSON surface the same way (#2018, #2221, #2260, #2281, #2319, #2337)
• os-skills: Updated to v0.6.2, added the ktuner skill for deterministic kernel diagnosis, tuning, and rollback, removed legacy OpenClaw and Hermes adapter scripts, and documented authenticated Skill Ledger recovery, users get rule-based tuning advice they can apply and roll back in one step (#1172, #1278, #2185)

[1.1] - 2026-08-08

Component Versions

Note: os-skills remains at v0.6.1; it did not change in this release and is listed to show the complete stack composition.

Highlights

• cosh-ng: Updated to v0.14.0, added resumable workspace sessions, MCP management, runtime introspection, and DashScope prompt caching, agents can recover long-running work and extend capabilities while reducing repeated prompt cost (#1546, #1592, #1778, #1949, #2046)
• agentsight: Updated to v0.9.1, added optimization and trajectory analysis together with case containment, system audit, and ActPlane risk enforcement, users can diagnose agent quality and cost while investigating and containing risky behavior (#1728, #1789, #2051)
• agent-sec-core: Updated to v0.9.0, expanded prompt, PII, code, and observability hooks across Qoder CLI, Qwen Code, and Codex, users can apply consistent security policies across supported agent runtimes (#1473, #1480, #1495, #1501, #1529, #1535)
• tokenless: Updated to v0.7.3, added reversible compression with MCP retrieval plus Cosh-NG response and command compression, agents can reduce model context while recovering truncated payloads on demand (#1285, #1376, #1669)
• anolisa: Updated to v0.2.15, added exact-version RPM and raw installs, file-metadata repair, and interactive progress, administrators can select published versions and recover installation drift with visible operation phases (#1700, #1740, #1987, #2036)

Updated

• copilot-shell: Updated to v2.8.0, added the consent-gated /ktuner command, exported COSH_SESSION_ID, and reused compatible cosh-ng authentication during switching, users can tune hosts, correlate subprocess activity, and move between shells with less setup (#1279, #1491, #1951)
• agent-sec-core: Updated to v0.9.0, added Qoder CLI and Qwen Code hook coverage, Codex PII and observability hooks, custom PII rules, and Chinese prompt-injection detection, users receive broader protection across prompts, tool calls, skills, and agent output (#1473, #1495, #1501, #1522, #1554)
• agentsight: Updated to v0.9.1, added ATIF v1.7 trajectory analysis, accuracy/performance/cost workspaces, case containment, system audit, and risk dashboards, users can trace multi-agent behavior and act on optimization or security findings (#1728, #1789, #1828, #2051)
• tokenless: Updated to v0.7.3, added stash-backed reversible compression, an MCP retrieval server, Cosh-NG compression, and macOS/Qwencode adapter support, agents can save tokens across more runtimes without permanently losing compressed content (#1285, #1376, #1669, #1894, #1964)
• agent-memory: Updated to v0.2.6, added synchronous indexing plus focused-query and OR-ranked recall fallbacks, agents can retrieve newly captured memories from verbose or stopword-heavy prompts (#1520, #1574, #2047)
• anolisa: Updated to v0.2.15, added exact-version RPM and raw installs, telemetry controls, macOS arm64 npm delivery, file-metadata repair, and phase-based progress, users can select published versions across Linux and macOS, control reporting, and repair Linux installation drift (#1619, #1700, #1740, #1962, #1987, #2036)
• skillfs: Updated to v0.4.0, added Hermes nested-skill compatibility, configurable read-time transforms, authenticated live-source resolution, and hardened permission boundaries, agents can consume adapted skill views while source mutations remain safely controlled (#1146, #1484, #1517)
• ws-ckpt: Updated to v0.4.2, added telemetry gating and automatic recovery of orphaned pre-init backups, users can recover workspaces after interrupted initialization without stale backup state (#1509, #1601)
• cosh-ng: Updated to v0.14.0, added session recovery, MCP tools, slash-command introspection, and prompt-cache observability, agents can resume complex work, extend capabilities, and diagnose cache savings (#1530, #1546, #1592, #1778, #1949, #2046, #2075)

[1.0] - 2026-07-06

Component Versions

Highlights

• anolisa: Updated to v0.1.20, delivered unified CLI gateway with full component lifecycle and adapter orchestration, users can install/update/diagnose all components with a single command
• cosh-ng: Updated to v0.11.0, completed Core/Shell separation and AI-augmented terminal, Agent can execute structured OS operations deterministically across distros
• agent-memory: Updated to v0.2.1, added user data sovereignty and 4-type memory classification, users can query/forget/control auto-captured memories
• tokenless: Updated to v0.6.1, added compression toggle with A/B testing and QwenCode adapter, users can quantify Token savings per strategy without affecting task execution

New Components

• anolisa: First release v0.1.16, built unified CLI gateway managing component install/update/uninstall with dual-backend (RPM + Raw), users can deploy the entire ANOLISA stack with anolisa install --all
• cosh-ng: First release v0.11.0, implemented deterministic Agent-OS interface with 5-crate workspace, Agent can execute cross-distro structured system operations via stable API
• skillfs: First release v0.3.2, built FUSE virtual filesystem for agent skills with view-based SKILL.md exposure, Agent can discover and load skills from a mounted directory

Updated

• agent-memory: Updated to v0.2.1, added sovereignty tools (about/forget/consent), AMA export/import, 4-type classification, and incremental consolidation resilient to SIGKILL, users can control memory retention and migrate memories across agents
• tokenless: Updated to v0.6.1, added compression on/off toggle with dry-run mode, SLS JSONL telemetry default-on, and QwenCode adapter, developers can A/B test compression strategies and monitor Token savings in SLS dashboard
• agentsight: Updated to v0.7.1, added Token saving visualization (strategy pie chart + line-level diff), security dashboard, and container/K8s full support, users can visually assess which optimization saves the most Tokens
• copilot-shell: Updated to v2.6.1, added /model dialog for multi-provider switching and SLS session telemetry (32-field JSONL), users can freely switch LLM providers without losing configuration
• agent-sec-core: Updated to v0.7.0, added Skill Ledger integrity chain with GPG signing workflow and Prompt Scanner, users can audit skill security status and get confirmation prompts before risky operations
• os-skills: Updated to v0.6.1, added ANOLISA Guide knowledge skill (13 official docs) and OpenClaw pre-check with bootstrap, Agent can reference accurate product documentation in responses
• ws-ckpt: Updated to v0.4.1, added auto-cleanup scheduling and TOML config hot-reload, users can set retention policies that take effect without restarting the daemon

Changed

• Documentation governance established via specs/documentation-standard.md
• Bilingual naming convention unified to _zh.md (migrated from legacy _CN.md)

[0.6] - 2026-06-12

Component Versions

Highlights

• agent-memory: First release v0.1.0, delivered sandboxed filesystem MCP memory server, Agent can persistently store and retrieve context across sessions via BM25 search
• tokenless: Updated to v0.4.1, added Hermes Agent plugin and Tool Ready 4-stage pre-check, Agent environments are automatically validated before tool execution to avoid wasted retries
• agentsight: Updated to v0.5.0, added Skill-level Token metrics and Hermes support, users can pinpoint which Skills consume the most Tokens

New Components

• agent-memory: First release v0.1.0, built 19-tool MCP server with namespace isolation and BM25 background index, Agent can read/write/search persistent memory in a sandboxed filesystem
• cosh-ng: First release (MVP), completed production-ready functionality for deterministic OS operations, Agent can execute structured commands with predictable output format

Updated

• tokenless: Updated to v0.4.1, added Hermes adapter runner and Tool Ready mechanism (4-stage env pre-check as cosh extension), Agent tool calls are pre-validated reducing Token waste from environment failures
• agentsight: Updated to v0.5.0, added Skill-dimension Token/call metrics and Hermes matcher with SSL support, users can see per-Skill Token breakdown in the dashboard
• agent-sec-core: Updated to v0.5.0, added PIIChecker (output PII detection + desensitization) and Skill Scanner (text/code scan + lifecycle trigger), Agent output containing sensitive information is automatically intercepted
• copilot-shell: Updated to v2.4.1, added cross-session auto memory extraction and hook reason visibility in UI, users can see exactly why a security hook blocked an operation

[0.5] - 2026-05-28

Component Versions

Highlights

• tokenless: Updated to v0.4.0, added Hermes plugin and Tool Ready environment mechanism, Agent tool execution failures due to missing dependencies are prevented before Token consumption
• agent-sec-core: Updated to v0.4.0, delivered PIIChecker and Skill Scanner first version, Agent output is scanned for sensitive information leakage

Updated

• tokenless: Updated to v0.4.0, developed Hermes Agent plugin with Tool Ready 4-stage env pre-check and history compression, Agent runtime dependencies are auto-verified before execution
• agent-sec-core: Updated to v0.4.0, added PIIChecker for output PII detection and Skill Scanner baseline capabilities, users are protected from unintentional sensitive data exposure
• agentsight: Updated to v0.4.0, added Skill-level metrics display, users can view Token consumption grouped by Skill
• os-skills: Updated to v0.4.0, added Nightly automated test coverage, skill quality is continuously validated

[0.4] - 2026-05-13

Component Versions

Highlights

• agent-sec-core: Updated to v0.4.1, established Skill security full lifecycle with Prompt Scanner ask policy, users receive confirmation prompts before Agent executes risky instructions
• tokenless: Updated to v0.3.0, built 4-suite Benchmark comparison baselines, developers can quantify Token savings across different Skill/OS environments
• ws-ckpt: Updated to v0.2.0, expanded snapshot management commands, users can auto-clean historical snapshots by count or age policy

Updated

• agent-sec-core: Updated to v0.4.1, integrated Prompt Scanner into cosh hook and OpenClaw plugin with ask strategy, users get interactive confirmation before dangerous operations
• tokenless: Updated to v0.3.0, built batch-concurrent Benchmark platform with comparison reports, developers can one-click benchmark and compare Token savings across configurations
• agentsight: Updated to v0.4.0, optimized resident process memory footprint, 2C2G small-spec instances can run observability stably
• copilot-shell: Updated to v2.3.0, adapted SWEBench evaluation framework, developers can execute code-fix tasks and verify pass rates via cosh
• ws-ckpt: Updated to v0.2.0, enriched snapshot CRUD capabilities, users can manage workspace checkpoints with flexible retention policies

[0.3] - 2026-04-30

Component Versions

Highlights

• tokenless: Updated to v0.2.0, delivered command rewriting and TOON context compression, CLI output Token consumption reduced by 60–90%
• agentsight: Updated to v0.3.1, added Token saving Dashboard and Agent anomaly diagnostics, users can visualize savings and detect Agent interruptions
• agent-sec-core: Updated to v0.3.0, added Skill Ledger integrity tracking and Prompt Scanner, every Skill's signature chain is auditable end-to-end

New Components

• ws-ckpt: First release v0.1.0, built btrfs-based workspace checkpoint daemon, Agent can create sub-millisecond snapshots and instantly rollback filesystem state

Updated

• tokenless: Updated to v0.2.0, added command rewriting via RTK and TOON context compression, Agent CLI interactions consume 60–90% fewer Tokens
• agentsight: Updated to v0.3.1, added Token saving Dashboard (session/time-range stats) and Agent interrupt detection with drain mechanism, users can monitor savings trends and get alerted on Agent failures
• agent-sec-core: Updated to v0.3.0, added Skill Ledger full lifecycle (check/certify/bypass/status/audit) and Prompt Scanner with jailbreak detection, users can track and enforce Skill integrity policies
• copilot-shell: Updated to v2.2.1, added extension architecture (command extension + system Hook + instant activation), Skill marketplace integration, and session export (Markdown/HTML/JSON), users can extend cosh capabilities via plugins and export conversation history
• os-skills: Updated to v0.3.0, added Skill marketplace listing, Hermes install skill, and utility skills (xlsx/pdf-reader/image-gen/humanizer), users can discover and install skills from a marketplace

[0.2] - 2026-04-15

Component Versions

Updated

• agentsight: Updated to v0.2.2, added Token consumption observability with precise Tokenizer counting, users can view per-message Token breakdown in real time
• copilot-shell: Updated to v2.0.4, added independent auth (STS/ECS RAM Role) and Skill marketplace browsing, users can authenticate without AK/SK and discover available skills
• os-skills: Updated to v0.2.2, added SysAdmin skills (Linux IO/network/load diagnostics), Agent can independently diagnose common OS performance issues
• tokenless: First release v0.1.0, built Skills-level benchmark test cases, developers can compare Token consumption across different Skills quantitatively

[0.1] - 2026-03-30

Component Versions

New Components

• copilot-shell: First release v2.0.1, built AI-powered terminal assistant with Tab completion, /bash mode, sudo support, and hook security, users get an AI-native CLI experience on first login
• agent-sec-core: First release v0.1, delivered Skill signature verification, security sandbox, and system hardening, Agent operations run in a controlled least-privilege environment
• agentsight: First release v0.1, built eBPF-based zero-intrusion observability probe, users can monitor LLM API calls and Token consumption without modifying Agent code
• os-skills: First release v0.1, curated system administration, SysOM, DevOps, and cloud skills, Agent can autonomously perform common OS operations

Security

• Skill full-link encryption with digital signatures
• Hardware-level security sandbox for risk isolation
• Identity authentication and integrity verification for Skill calls

For detailed changelogs of individual components, see:

User Entrypoint

• copilot-shell
• cosh-ng
• anolisa
• os-skills

Token Saving

• tokenless

Runtime

• agent-memory
• skillfs
• ws-ckpt

Agent Observability

• agentsight

Agent Security

• agent-sec-core

Changelog

2.8.0

• Added COSH_SESSION_ID export for subprocess and MCP correlation. (#1491)
• Fixed hook process tree termination on timeout and cancellation. (#1585)
• Updated docs to centralize user guides and add docs lint CI. (#1586)
• Fixed cosh-switch to reuse compatible cosh-ng authentication. (#1951)

2.7.0

• Added /ktuner command with consent-gated, opt-in first-run check and trusted-path resolver. (#1279)
• Added loading indicator when selecting an auth provider. (#1389)
• Added COSH_SESSION_ID export for agentsight per-run correlation. (#1383)
• Fixed security intents to map to hook commands. (#1438)
• Fixed cosh-switch post-switch guidance for clarity. (#1424)
• Fixed shell mode to add actionable error guidance for exit code 127. (#1319)
• Updated docs to rename __CN.md to __zh.md, fix cross-refs, and add missing READMEs. (#1335)

2.6.1

• Added npm packaging support for CLI and cosh. (#1307)
• Added multi-hook toggles support. (#1206)
• Fixed tips banner to stay visible after initial login. (#1308)
• Fixed Ctrl+O to prioritize error details over compact mode. (#1202)
• Fixed system-profile BINDIR to follow PREFIX. (#1193)
• Fixed AfterModel hook non-blocking notifications not surfacing. (#1182)
• Updated component docs to migrate into user-guide and developer-guide. (#1295)
• Added copilot-shell zh/en user and developer docs. (#1236)
• Fixed CONTRIBUTING.md file mode from symlink to regular file. (65601f06)

2.6.0

• Added multi-hook enable and disable support to /hooks. (#1200)
• Added cosh-ng compatibility with cosh-switch. (#1169)
• Added instance_id to SysOM API request params. (#1160)
• Added anolisa component contract. (#1128)
• Added SLS JSONL session telemetry with expanded metrics. (#1057)
• Added authenticated models display in /model dialog. (#1030)
• Added kitty csi-u keys support with sequence timeout management. (#552)
• Added large paste placeholder and fixed placeholder id reset on esc cancel. (#312)
• Fixed SLS log write to skip when file does not exist or is not writable. (#1101)
• Fixed useless sandbox guard and failure handler hooks by removing them. (#979)
• Fixed missing keyboard shortcut hints in footer status bar. (#921)
• Fixed response language and model identity rules. (#920)
• Fixed sub-model refusal detection and byteLength display. (#895)
• Fixed webfetch sub-model output validation to avoid silent refusals. (#895)
• Fixed thinking output to be distinguished from user input with prefix and color. (#894)
• Fixed custom model configuration to be preserved. (#887)
• Fixed partial message finalization on API error. (#801)
• Fixed API error reporting in all output formats, not only text. (#801)
• Improved escape key handling by unifying it in appcontainer. (#437)

2.5.0

• Fixed missing esc hint in tool confirmation footer status bar (#732)
• Fixed invisible cursor in provider/auth config inputs (#683)

2.4.1

• Fixed HookSystemMessage rendering as info and resolved Content/Thought duplication (#636)
• Fixed prompt ids to remain monotonic after shell remount (#628)

2.4.0

• Added DashScope Token Plan provider entry to the OpenAI-compatible auth dialog. (#598)
• Added UserPromptSubmit and PostToolUse hook reason surfacing in the UI. (#545)
• Added run_id field to HookInput for per-run event correlation. (#482)
• Fixed UserPromptSubmit hook decision merging to enforce safety priority over allow. (#597)
• Fixed missing tool_use_id in PreToolUse hook input. (#559)
• Fixed memory hooks lock takeover with atomic rename and async IO. (#550)
• Fixed auto-memory workspace cleanup wiping user-added directories. (#548)
• Fixed auto-memory session hook missing read_file events due to wrong arg key. (#547)
• Fixed run_id ordering by setting it before UserPromptSubmit hook fires. (#537)
• Fixed UserPromptSubmit hook firing on tool-result and Stop continuations. (#534)
• Updated installer to support multiple install profiles. (#541)

2.3.0

• BREAKING Removed qwen-oauth authentication support. (#455)
• Added auto memory background extraction system. (#465)
• Added full shell command display in hook-ask and exec confirm dialogs. (#452)
• Added esc key to cancel running slash commands. (#290)
• Fixed JavaScript heap out of memory during long sessions. (#462)
• Fixed missing allow decision reason in UI when systemMessage is absent. (#435)
• Improved test coverage with standalone tests for ExecCommandPreview. (#460)
• Updated hook docs to clarify difference between systemMessage and reason. (#436)

2.2.1

• Fixed initial chat being blocked during skill/subagent first-load discovery. (#418)
• Fixed missing tool_use_id in PostToolUse hook event payload. (#414)
• Fixed missing skill_context in PreToolUse hook input for resolved skill path. (#409)
• Fixed missing auto-completion for /statusline subcommands. (#408)
• Fixed unavailable agents appearing in the key sharing prompt. (#394)
• Fixed bash option not being restored after canceling from the provider screen. (#393)
• Fixed hook systemMessages to be concatenated with a [name] prefix for clarity. (#387)

2.2.0

• Added ask decision support for UserPromptSubmit hook. (#328)
• Added new command for Clawhub CLI. (#313)
• Added interactive Skills TUI Panel with enable/disable support. (#311)
• Added variable substitution and display control for extension TOML commands. (#291)
• Added immediate hook activation on extension install/uninstall. (#283)
• Added ask decision support for PreToolUse hooks. (#276)
• Added configurable status bar. (#251)
• Added /export command for session history. (#245)
• Fixed API key validation to skip non-Dashscope providers. (#337)
• Fixed PreToolUse ask dialog by unifying it to info type with diff preview. (#345)
• Fixed memory leak in memory management. (#309)
• Fixed extension lifecycle reliability. (#298)
• Fixed hook registry sync on extension enable/disable. (#298)
• Fixed interface crash caused by leftBottomContent of Box nested in Text in Footer. (#293)
• Fixed /hooks install command by removing it and adding default help. (#287)
• Fixed extension examples installation and package configuration. (#271)

2.1.0

• Added startup bash entry and simplified manual auth dialog. (#217)
• Added async fzf-based tab completion optimization. (#214)
• Fixed OpenAI API key and model validation via /models endpoint on auth. (#243)
• Fixed API key retention when navigating to apiKey field in auth dialog. (#241)
• Fixed node-pty native binary bundling for both linux architectures. (#232)
• Fixed stream redaction by replacing integer offset with committed text reference. (#210)
• Fixed missing fields in hook system. (#188)

2.0.4

• Added STS authentication support via ECS RAM role. (#161)
• Added BeforeModel, AfterModel, and BeforeToolSelection hooks. (#154)
• Added sandbox usage summary on session exit. (#137)
• Added Tab-completion for ! shell mode. (#131)
• Fixed config-dir source unification and prevented ~/.copilot creation on startup. (#171)
• Fixed /bug command crash in headless environment. (#175)
• Fixed undefined metrics.sandbox in StatsDisplay. (#171)
• Supplement /hooks install step to post-installation guide. (#142)
• Supplement hooks documentation (index, reference, writing-hooks). (#142)

2.0.3

• Migrated config directory from ~/.copilot to ~/.copilot-shell. (#78)
• Added API key detection from configured agents with user approval on bootstrap. (#127)
• Added support for configuring multiple custom model providers. (task#80737766)
• Added global API endpoint support for Dashscope. (#133)
• Added custom skill paths support via settings.json. (#128)
• Added support for loading skills from extension directories with cosh-extension.json compatibility. (#54)
• Added /bug command for submitting bug reports. (#122)
• Added sandbox-guard install command with bypass approval flow. (#125)
• Added secret redaction for model output and tool results. (#100)
• Added extensible feature tip banner for first-launch guidance. (#113)
• Added built-in /dir cd command for in-session directory navigation. (#19)
• Added session renaming command. (task#80737766)
• Added nvm-aware Node.js detection in cosh wrapper script. (#72)
• Added system-level install via Makefile with FHS-compliant directory layout. (#72)
• Fixed 24-item limit on @ file completion menu. (#92)
• Fixed TUI flicker on Qwen OAuth page in limited-height terminals. (#76)
• Fixed left-arrow key not wrapping from line start to previous line end. (#53)
• Fixed irrelevant info display in /model command. (#85)
• Fixed credentials encryption support in settings.json. (#90)
• Fixed test failure when running as root user. (#29)
• Fixed pre-commit hook working directory for lint-staged. (#90)
• Configured Husky hooks and documented pre-commit setup. (#65)

2.0.1

• Renamed OpenAI authentication label to "BaiLian (OpenAI Compatible)" for clarity.
• Fixed login shell stdin drain to prevent unwanted input echo.
• Removed ripgrep unavailable warning message.

2.0.0

• Synced upstream qwen-code to v0.9.0 and rebranded to Copilot Shell.
• Bumped version directly to 2.0.0 (skipping 1.x, which was used by a previous OS Copilot release).
• Integrated Skill-OS online remote skill discovery with priority-based fallback (Project > User > Extension > Remote).
• Added /skills remote and /skills cache clear commands for remote skill management.
• Added /bash interactive shell mode
• Added -c argument support for inline bash commands.
• Added PTY mode for sudo command support.
• Added hooks system with PreToolUse event for intercepting tool calls before execution.
• Added new model provider named Aliyun
• Added nested startup detection warning banner.
• Added system-wide skill path (/usr/share) support.
• Removed original Gemini sandbox.
• Fixed skill frontmatter parsing for YAML special characters (|, &, >).
• Fixed login escaped character echo issue in ECS workbench.
• Fixed Linux headless environment browser open failure when auth with Qwen OAuth.
• Fixed Qwen OAuth authentication, replay, and UI rendering issues.
• Fixed exception handling when adding workspace directories.
• Fixed user query start with unix path being misidentified as command.
• Fixed API key display explicitly.
• Fixed Chinese i18n for /resume command.
• Improved ? hint visibility — hidden while user is typing.
• Miscellaneous UI, branding, CI, and build improvements.

Changelog

All notable changes to ANOLISA will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[0.3.16] - 2026-09-23

Added

• Add prebuilt CLI archives and the @anolisa/cli-darwin-x64 npm package for Intel Macs running macOS 11 or later. The website installer remains ARM-only until Intel Mac installation is enabled separately (#3448).

Changed

• Recognize Intel macOS as a supported target for cosh-ng in the component catalog, allowing ANOLISA to resolve compatible releases when available (#3448).

[0.3.15] - 2026-09-22

Fixed

• RPM-installed adapters can now verify and use files split across declared subpackages, including adapter bundles and shared skills. Missing packages or unverifiable files still stop activation instead of accepting unverified inputs (#3417).
• RPM transaction and upgrade preflight errors now redact repository credentials, paths, and query strings from native package-manager diagnostics, including configured URLs containing whitespace. HTTP(S) origins remain visible for troubleshooting (#3431).

[0.3.14] - 2026-09-20

Added

• Manage OpenCode local plugins with anolisa adapter enable tokenless opencode, anolisa adapter status tokenless, and anolisa adapter disable tokenless opencode. Existing links to the same plugin can be adopted, conflicting user entries are preserved, and interrupted changes can be retried. Custom configuration directories are supported through OPENCODE_CONFIG_DIR. Restart OpenCode after enabling or disabling; runtime loading remains reported as unknown (#3346).
• anolisa bug --component cosh-ng now exports a local diagnostic bundle and includes its health findings and collection summary in Markdown and --json reports. COSH_SHELL_BIN can override the installed binary. Failed collection provides a reason and a manual retry command; --dry-run skips collection, and bundles are never uploaded automatically (#3317).

Fixed

• anolisa bug --component <name> now finds visible system installations from user mode and reads recent logs from the installation's scope. Unreadable cross-scope logs produce a warning without aborting the report (#3317).

[0.3.13] - 2026-09-20

Changed

• RPM installs, updates, removals, and dependency preflight checks now support Yum 3 and DNF 4. ANOLISA prefers yum and uses dnf only when yum is absent; requested versions remain exact, and system restrictions such as version locks cause a failure instead of silently selecting another version (#3318).
• RPM candidate queries now read and validate the configured repository metadata directly, without requiring dnf repoquery. Repository access honors proxy and private CA settings in /etc/yum.conf, or /etc/dnf/dnf.conf when the former is absent. Local package queries and Raw installs also work without a configured RPM repository; errors from a configured repository are still reported (#3318, #3353).
• Raw installs now name the requested platform and list published alternatives when the component has no installable artifact for the host OS and architecture, including in --json errors, making platform gaps distinguishable from unknown component names (#3326).

Fixed

• Runtime dependency checks, provisioning, and anolisa doctor now consistently recognize RPM and Debian derivative distributions through ID and ID_LIKE. Unsupported package families receive manual installation guidance instead of selecting an unrelated package manager from PATH (#3318).
• Cloud metadata collection now continues reading other fields after an HTTP error or empty response for one key, preserving available instance information in telemetry snapshots. Connection and transfer failures still stop subsequent queries to an unreachable endpoint (#3308).

[0.3.12] - 2026-09-16

Changed

• anolisa upgrade --dry-run now checks the combined set of new RPM installs with the native dependency solver when run as root. Conflicts appear as errors; non-root previews remain available with an explicit warning that install conflicts were not checked. Rerun with sudo and preserve any --target option to perform the check (#3294).
• The bundled ws-ckpt adapter metadata now requires OpenClaw >=2026.2.13, preventing adapter enablement on older hosts whose config writes can persist expanded environment values and runtime defaults (#3239).

Fixed

• anolisa adapter enable <component> openclaw now explicitly activates the plugin after installation, restoring plugins left disabled by a previous uninstall. Capability consent is detected separately for activation, and --dry-run includes the activation command (#3223).
• Sandbox install and uninstall now honor DNF's exit status even when its output contains phrases such as “already installed” or “No match”. Failed installs no longer continue to later setup phases or record success (#3226).
• RPM package and file-owner queries now distinguish clean absence from database and command failures, avoiding false “not installed” observations (#3230).
• Raw component service management now reports failed systemctl is-active queries instead of treating them as missing units; valid inactive and failed service states remain supported (#3240).
• Runtime dependency checks now stop automatic provisioning when RPM queries fail or system-package and language-runtime probes encounter permission, execution, or signal failures. anolisa doctor retains the diagnostic and recommends inspecting the probe instead of installing a supposedly missing dependency (#3280, #3285).
• Debian runtime dependency checks now distinguish usable packages, absent packages, incomplete package states, and query failures. Incomplete states require manual recovery before provisioning; doctor directs users to inspect the package state. Multi-Arch queries select the native architecture unless the dependency explicitly requests one (#3292).

[0.3.11] - 2026-09-09

Added

• Register ktuner in both component catalogs for Linux x86_64 RPM discovery and installation when the configured repository provides it (#2084).

Changed

• anolisa adapter enable <component> openclaw now accepts the plugin's declared capabilities when the host advertises --accept-capabilities. Unsafe-install bypass still requires separate explicit authorization (#3126).
• status and doctor now allow content edits to raw-installed type = "config" files, including directory-expanded files, while still checking presence, file type, path safety, permissions, and capabilities. Legacy state recovers config kinds where the installed manifest is unambiguous. Update and uninstall behavior is unchanged; back up edited configs before those operations. Older CLI versions cannot read the new kind = "config" state: before downgrading, back up state and change those owned-file entries to kind = "file", restoring content digest checks (#3142).

Fixed

• OpenClaw adapter cleanup can now finish when uninstall reports no tracked package and plugins list --json confirms the plugin is absent with clean diagnostics. Inconclusive results retain cleanup ownership for a retry (#3118).
• Component index reads now use a temporary private cache when the system cache is not writable, allowing ordinary users to resolve components for previews while retaining index validation. RPM install preflight still requires root with DNF 4 (#3127).
• Fresh raw installs now record file digests after post_install and post_enable hooks, avoiding false corruption reports for hook-written content while detecting subsequent changes to immutable files. Repair and update still restore the package payload without replaying install hooks (#3141).
• RPM installs, including --dry-run and merged install --all transactions, now check DNF conflicts before creating recovery journals, so solver refusals no longer leave false pending operations. Use sudo for RPM --dry-run with DNF 4; the check may refresh repository metadata (#3158).
• anolisa list now uses the same authoritative RPM package mapping as install, preventing legacy aliases or stale provider declarations from showing the wrong component as installed (#3158).
• anolisa forget now directs journal-only pending operations to anolisa repair <component> instead of reporting nothing to forget, preserving the recovery evidence (#3158).

[0.3.10] - 2026-09-06

Added

• QwenPaw plugin adapters can now be discovered, enabled, inspected, and disabled through anolisa adapter. For Tokenless packages that include the QwenPaw bundle, use anolisa adapter enable tokenless qwenpaw. Installation and removal use QwenPaw's CLI and verify the resulting plugin files; failed removal preserves the plugin directory and receipt for a retry, and cleanup uses the working directory recorded at enable time (#3075).

Fixed

• anolisa logs --limit N now returns the most recent N matching records in append order, with the oldest record in that window first, instead of returning the earliest matches. The default limit of 50 therefore shows recent activity as logs grow, and scanning existing logs no longer blocks new records from being appended (#2618).

[0.3.9] - 2026-09-02

Added

• Applied and failed anolisa update self operations now enter the central operation log with their version and apply-mode context. Administrators can audit them through anolisa logs, while generated bug reports include only failed records and redact credentials from handled update URLs; previews and already-current no-ops remain log-free (#2994).

Changed

• Newly shipped Raw repository configurations no longer advertise the unused cache_ttl_secs and offline_fallback settings. Existing configurations containing either field remain compatible, while Raw resolution continues to fetch the current distribution index and fail when it is unavailable (#3002).

Fixed

• Global and command-local sandbox uninstall dry-runs now show the planned package changes without applying them, while system-mode telemetry mutation previews return before privilege checks or side effects (#2922, #2926).
• Commands without a preview implementation now reject global --dry-run before dispatch. Sandbox remove plus kernel and security install reject both dry-run forms with INVALID_ARGUMENT and confirm that no action was taken, instead of reaching mutation, privilege, or not-implemented paths (#2952, #2957, #2961).
• The standalone installer now detects when PATH still resolves anolisa to another installation, reports both paths and versions, and provides a directly runnable PATH fix or matching npm/Homebrew removal command instead of printing an unqualified success message (#2944).

[0.3.8] - 2026-08-26

Added

• Tagged ANOLISA releases now include verified prebuilt CLI archives for Linux x64, Linux arm64, and macOS arm64. Users can download a standalone binary archive for each supported target directly from the GitHub Release (#2883).

Fixed

• Raw installs now preserve ${VAR} references in rendered file content for shell and systemd consumers, while continuing to expand nested ANOLISA layout placeholders and reject environment references in destination paths. anolisa install cosh-ng --backend raw can now install the gateway service template instead of rejecting its EnvironmentFile=-backed workspace reference as an unknown placeholder (#2903).

[0.3.7] - 2026-08-25

Changed

• Source and RPM builds now require Rust 1.93, with the rustup toolchain pinned to 1.93.1 and Cargo dependency resolution constrained by the declared MSRV. Builders can use the newest compiler packaged by Alibaba Cloud Linux 4 without Cargo selecting dependencies that exceed the supported compiler; older Rust toolchains must be upgraded (#2810).

Fixed

• anolisa --dry-run restart <component> now lists the units that would be restarted without invoking systemctl daemon-reload or systemctl restart. System-mode previews read recorded state without taking the exclusive install lock, so they no longer require write access to the state root (#2774).

[0.3.6] - 2026-08-22

Fixed

• anolisa --quiet adapter scan and anolisa --quiet adapter status now suppress all non-error human output, including empty-state messages and result tables, while --json continues to emit the standard envelope. Agents can rely on quiet adapter inspection producing no human output (#2752).
• anolisa --dry-run forget <component> now refuses a component that still has enabled adapters with the same INVALID_ARGUMENT, exit code 2, and adapter disable guidance as the real operation. Previews no longer report that an impossible forget would succeed, while unrelated adapter receipts remain ignored (#2762).

[0.3.5] - 2026-08-20

Fixed

• Uninstalling a component with a bare systemd service template now stops every loaded instance through name@*.service before disabling the declared name@.service template. Template-backed services no longer remain running after anolisa uninstall, while individual stop failures continue to surface as warnings without blocking cleanup (#2603).

[0.3.4] - 2026-08-19

Changed

• Component-targeting commands now use the repository component index as the sole authority for names absent from local state. Installed and recovery identities remain usable offline, while unsupported names return INVALID_ARGUMENT, an unavailable index returns EXECUTION_FAILED, and NOT_INSTALLED now reliably means a supported component is absent. A --repo override also governs identity and package selection for the whole invocation, so site-local package mappings and RPM Provides metadata can no longer establish unrecognized component names (#2637).

Fixed

• Missing local Raw repository index errors now identify whether the active repository came from the exact repo.toml path or a one-off --repo override and provide matching recovery guidance. Users no longer need to guess which source configured the missing repository (#2650).

[0.3.3] - 2026-08-18

Added

• Telemetry instance snapshots now include the detected container runtime as instance.container for Docker, Podman, containerd, Kubernetes cgroups, and LXC, while bare-metal hosts omit the field. This gives downstream deployment statistics and troubleshooting a container-aware signal without collecting container or pod identities (#2642).

Changed

• anolisa status <component> now validates new targets against the component index, resolves package aliases, rejects unsupported names with anolisa list guidance, and directs telemetry service targets to anolisa telemetry status. Exact installed identities remain inspectable when repository metadata is unavailable (#2626).

Fixed

• Raw adapter bundle installs now preserve each archive file's mode and record the effective mode for integrity checks. Framework hooks and scripts retain their executable bit instead of being installed uniformly as data files (#2619).

[0.3.2] - 2026-08-17

Added

• ANOLISA now provides a native DSH adapter driver for plugin bundles. anolisa adapter enable <component> dsh --profile <name> accepts repeatable profiles, validates the bundle identity, delegates profile changes to DSH, and remembers the enable-time DSH home so status, disable, and re-enable keep targeting the same profiles even if DSH_HOME or the working directory changes. Disable DSH adapters before downgrading to an earlier ANOLISA release (#2580).
• anolisa logs --level <LEVEL> is now a visible alias for the existing --severity option, with the same validation and filtering behavior while severity remains the canonical JSON field (#2558).

Changed

• anolisa list and anolisa install --all now evaluate component availability against an exact OS and architecture target from schema v2 components-v2.toml. JSON output replaces platforms and platform_available with targets and target_available; repository publishers must deploy the v2 index beside the unchanged v1 index (#2533).

Fixed

• anolisa --dry-run install now reads meta.toml beside the resolved Raw artifact before falling back to version-level metadata only when the sibling file is absent. Previews now validate the selected target's contract, reject corrupt published metadata instead of masking it, and still avoid downloading the artifact (#2551).
• System-helper status now reports unknown when systemctl cannot be started and reports failed only for a unit whose actual state is failed (#2604).

[0.3.1] - 2026-08-13

Fixed

• Adapter discovery now excludes undeclared shared resource directories unless a contract, receipt, or built-in framework driver identifies them as real adapters. Shared assets such as Tokenless common hooks no longer appear as unsupported frameworks in adapter scan and status output (#2502).

[0.3.0] - 2026-08-12

Fixed

• Adapter enable, status, and update now derive adapter revisions from ANOLISA-owned Raw files or native package metadata instead of hashing whole resource trees. Runtime caches and other unowned files no longer cause false drift or get copied into frameworks, while changed package-owned inputs block enable before framework mutation and unavailable metadata is reported with an unknown status (#2419).
• Re-enabling adapters now removes only stale materialized files recorded by the previous receipt, preserves runtime-created files, previews the cleanup with --dry-run, and retains the old receipt when a directory-to-file replacement would discard runtime data (#2438).

[0.2.20] - 2026-08-11

Changed

• anolisa list now announces the detected host platform and reports component availability instead of backend and ownership columns in human-readable output. Components unsupported on the host remain visible with their supported platform and no install action, while JSON adds platforms and platform_available without removing backend or ownership metadata (#2367).

Fixed

• npm installs now keep @anolisa/cli as the sole owner of the public anolisa executable. With npm 10, local installs reliably create node_modules/.bin/anolisa instead of losing the command when platform packages are linked (#2345).

[0.2.19] - 2026-08-10

Fixed

• Raw installs that provision system dependencies now map resolver-provided rpm and deb package-family hints directly to the matching package manager backend. Minimal supported hosts no longer report an unsupported package base merely because the optional which command is absent, while distro-specific hints remain compatible (#2314).
• anolisa --json osbase sandbox list and anolisa --json register status now use the standard success envelope with ok, schema_version, and command metadata and nest business fields under data. Scripts can parse these legacy commands the same way as other JSON surfaces (#2319).
• OpenClaw adapters now honor OPENCLAW_STATE_DIR with OpenClaw-compatible whitespace, tilde, and absolute-path handling, keeping plugins, skills, receipts, status, and disable operations on the configured state. Re-enabling safely migrates resources recorded under the legacy fallback, preserves the old receipt when cleanup must be retried, and previews the migration during --dry-run. If an older receipt used an OPENCLAW_HOME that is no longer present in the environment, temporarily restore it before migration or cleanup (#2337).

[0.2.18] - 2026-08-06

Changed

• Telemetry upload now treats SLS_PROJECT_PREFIX as an SLS project prefix and appends the detected region, for example anolisa-cn-hangzhou. Deployments that set the legacy SLS_PROJECT must migrate to SLS_PROJECT_PREFIX so uploads reach their region-specific project (#2260).

Fixed

• Raw installs now stream only selected archive payloads through private, disk-backed staging instead of retaining uncompressed contents in memory. Large packages can install with bounded payload memory while preserving atomic placement, rollback, cleanup, and digest verification (#2250).
• anolisa status and anolisa doctor now hash ANOLISA-owned files up to 2 GiB and treat larger files as unchecked and degraded instead of failed. Intact components with large artifacts no longer appear damaged or trigger spurious repair, while recovery still fails closed when verification is required (#2271).
• Enabling a Codex adapter that declares hooks now discovers the installed plugin's hook identities and atomically persists their trusted hashes, so non-interactive codex exec sessions can run them. Missing hooks or overridden trust settings stop enablement with actionable diagnostics (#2281).

[0.2.17] - 2026-08-05

Added

• Raw installs can now render layout placeholders such as {bindir} and {datadir} inside declared text files before placement, so shared package templates follow the selected install scope and prefix. Integrity checks and repair use the rendered bytes (#2222).

Changed

• Raw repository resolution now prefers the generation-2 index when published and enforces each component's minimum CLI version. Incompatible entries fail with an anolisa update self hint instead of silently installing an older or malformed result, while generation-1 repositories remain compatible (#2222).
• RPM-backed adapter scan, status, and enable operations now use a declared package-owned resource root and report a missing or invalid root instead of falling back to stale raw files. Codex adapters that target an external RPM root record a trust anchor; disable them before downgrading to 0.2.16 (#2222).

Fixed

• Qoder native plugin bundles now use Qoder's own plugin lifecycle instead of being copied or rewritten as legacy hook bundles. Existing same-ID plugins across user and project scopes are protected, and unverified installs or removals retain a retryable receipt rather than claiming or deleting user state (#2221).

[0.2.16] - 2026-08-03

Added

• Successful anolisa update <component> and anolisa update all operations now report adapters whose resource bundles changed, with the exact anolisa adapter enable ... or anolisa adapter status ... follow-up command. JSON responses expose the same information through stable adapter_actions arrays (#2018).

Fixed

• Raw system-scope installs on Debian-family hosts no longer fail with rpm not found on PATH when both RPM tooling and an RPM database are absent. An existing or newly appearing RPM database still stops the raw install before files change (#2061).

[0.2.15] - 2026-07-30

Added

• Interactive anolisa install, anolisa install --all, and anolisa uninstall now display phase-based activity during long-running planning and execution. ANSI-capable terminals animate the current phase, while limited interactive terminals print static phase lines (#2036).

Changed

• Human-readable failures now use conventional error: and hint: labels without exposing machine codes. --json retains structured error codes, and exit statuses remain unchanged.
• Update notifications now quote the recommended sudo anolisa upgrade and anolisa update --check commands so their boundaries are clear.

[0.2.14] - 2026-07-29

Fixed

• anolisa status and anolisa doctor now detect Unix mode and Linux file capability drift for raw-managed files, including installations recorded by earlier releases, and recommend anolisa repair for recovery.
• anolisa repair now replays raw-managed components when only file metadata has drifted, restoring declared modes and confirmed capabilities. Failed updates restore only capabilities known to have been active before the operation, avoiding optional grants that never applied (#1987).

[0.2.13] - 2026-07-28

Added

• The @anolisa/cli npm package now supports macOS arm64 and selects the matching native binary during installation.
• Tokenless adapters now support Qwencode while keeping the Cosh extension independent from shared hook assets.

Fixed

• Raw installs now refuse to provision a system package reserved by another pending RPM install and direct the user to anolisa repair, preventing components from claiming or later removing each other's dependencies.
• cosh-ng RPM installations now retain the cosh-ng component identity. Unambiguous legacy records and recovery journals stored as cosh are repaired so lifecycle commands target the correct component.
• Failed raw updates and repairs now restore file permissions and capabilities during rollback, keeping restored binaries executable.
• Enabling the Tokenless Qoder adapter now resolves shared hook paths in the cached plugin, preventing matching tool calls from failing because of broken hook commands.

[0.2.12] - 2026-07-27

Changed

• Commands that act on an installed component now report an absent target as NOT_INSTALLED instead of INVALID_ARGUMENT, so a caller can tell "there was nothing to act on" from "the invocation was wrong" without parsing the error message. The code reports state absence only, and does not indicate whether the name was valid. Affects uninstall, update, repair, forget, restart, and adapter; the exit code stays 2 (#1915).

Fixed

• Adapter status now ignores empty or incomplete stale source directories and reports missing bundles as degraded; raw uninstalls prune empty directories so another installation scope cannot be shadowed (#1850).
• Raw install dry-runs now validate component conflicts before execution, keeping preview results aligned with real installs. Repositories without lightweight sidecar metadata warn that conflict validation was skipped (#1898).

[0.2.11] - 2026-07-24

Added

• Raw anolisa install --version now installs the exact published component version.
• Raw anolisa install --version output now reports requested and resolved versions, artifact URL, and source repository.

Changed

• Raw anolisa install --version now lists published alternatives when the requested version is unavailable.

Fixed

• Raw anolisa install --version no longer installs another version when the requested version is unavailable.
• Raw component uninstalls with many files now complete faster and write substantially less data.
• Recovery now preserves installed state when operation recovery data is missing or corrupted.

[0.2.10] - 2026-07-23

Added

• anolisa telemetry now lets administrators enable or disable data collection.
• anolisa telemetry now lets administrators link or unlink named reporting.
• anolisa telemetry status now reports collection and named-reporting states in text or JSON.
• Adapter enable and disable commands now display component-provided follow-up notices.
• Adapter JSON output now includes structured component-provided notices.
• anolisa install --version JSON output now includes requested and resolved versions, source repository, and exact RPM.

Changed

• Fresh ANOLISA RPM installations now enable anonymous telemetry by default.
• RPM installation output now explains how to disable telemetry.
• Enabled telemetry now resumes automatically after restarts on supported hosts.
• anolisa register now warns that the command is deprecated.
• anolisa register now enables telemetry without prompting.
• anolisa register status now directs users to anolisa telemetry status.
• anolisa unregister now disables telemetry while preserving local logs.
• anolisa install --version now selects the exact host-compatible RPM matching the requested version.
• anolisa install --dry-run --version now validates availability and displays the resolved RPM details.
• Adapter dry-runs now preview component-provided notices without changing the host.
• Adapter quiet output now suppresses component-provided notices.

Fixed

• anolisa register now prevents duplicate uploads from earlier telemetry configurations.
• anolisa unregister no longer leaves earlier telemetry configurations reporting.
• anolisa install --version no longer changes the host when the requested RPM is unavailable or incompatible.
• anolisa install --version no longer records success when a different RPM version is installed.
• anolisa repair now rejects interrupted RPM installs whose installed version differs from the original request.
• anolisa repair now reports when an interrupted RPM install's architecture cannot be verified.
• anolisa adapter disable now shows saved follow-up notices even when component files are unavailable.
• Adapter notices can no longer inject terminal formatting into human-readable output.

[0.2.9] - 2026-07-22

Added

• anolisa update all now updates every tracked raw and RPM component while leaving the CLI unchanged.
• anolisa repair now restores damaged raw installations from their recorded versions.
• anolisa repair now supports user-scope installations without root privileges.
• anolisa repair now recovers interrupted install, update, adopt, uninstall, and batch operations.
• anolisa repair now reinstalls missing managed RPM packages.
• anolisa status now reports unclassified legacy records as needs-attention with scope-aware repair and forget guidance.
• anolisa status and anolisa doctor now run health checks from each installation's saved component manifest.
• User-mode adapter commands can now target visible system installations.
• anolisa repair can now restore unclassified legacy records from installed packages or intact files.
• anolisa forget can now remove unclassified legacy records without touching installed files or packages.

Changed

• anolisa install now refuses unmanaged system RPMs and directs users to anolisa adopt.
• anolisa install now succeeds without changes when the component is already tracked.
• anolisa adopt now makes existing RPMs updatable while keeping package removal opt-in.
• anolisa adopt now succeeds without changes for already adopted packages.
• anolisa update now requires observed-only RPMs to be adopted first.
• anolisa install --all now applies new RPM packages in one package transaction.
• anolisa upgrade now applies planned RPM updates in one package transaction.
• anolisa upgrade now applies planned RPM installs in one package transaction.
• anolisa list and anolisa status now show separate user and system rows for shadowed components.
• anolisa list now labels tracked installations as owned, managed, adopted, or observed.
• anolisa --install-mode user install can now create a user installation beside a visible system installation.
• Lifecycle mutations now remain within the selected scope, including package aliases.
• The first modifying command now upgrades legacy state and preserves installed.toml.v4.bak.
• Newer state formats now produce an error instead of appearing empty.
• install-anolisa.sh now leaves distribution index retrieval to the CLI, keeping mirror data current.
• install-anolisa.sh now stages only OS-base manifests because component manifests are fetched when needed.
• install-anolisa.sh --strict now validates only binary and manifest bundle checksums.
• ANOLISA_INDEX_URL and ANOLISA_INDEX_SHA256 no longer affect install-anolisa.sh.
• Lifecycle JSON output now includes explicit plans across install, adopt, update, repair, and uninstall.
• Uninstall JSON output now uses one schema for raw and RPM components, including package removal and plans.
• anolisa uninstall --dry-run now reports missing components as errors instead of empty successful plans.
• anolisa forget and anolisa restart now stop while an earlier component operation needs recovery.
• anolisa doctor now reports incomplete operations even without an active component record.

Fixed

• RPM-managed components no longer fail status or doctor because of raw-install health checks.
• RPM component updates now refresh saved component manifests before reporting success.
• Incomplete RPM manifest refreshes now appear in anolisa logs --severity warn.
• Interrupted RPM updates now remain repairable instead of appearing successful with stale settings.
• anolisa doctor no longer recommends lifecycle commands when recovery data is unreadable or ambiguous.
• anolisa doctor no longer duplicates recovery findings across components sharing one state location.
• anolisa doctor --help now states that --fix remains unavailable.
• Batch RPM failures now preserve repairable state for packages that changed.
• Component aliases no longer redirect lifecycle changes into a different installation scope.
• Health checks for user services now use the correct service manager across installation scopes.
• Failed batch RPM operations now retry unaffected components individually.

[0.2.8] - 2026-07-21

Added

• anolisa adapter enable now supports --allow-unsafe-plugin-install for explicitly authorized OpenClaw plugin installation.
• OpenClaw adapter settings can now target specific OpenClaw versions.

Changed

• anolisa adapter enable now checks OpenClaw compatibility before making changes.
• anolisa adapter enable now verifies OpenClaw plugins are loaded before reporting success.
• When OpenClaw blocks an unsafe plugin, ANOLISA now shows the reported findings.
• When supported, OpenClaw safety errors now suggest retrying with explicit unsafe authorization.

Fixed

• Failed OpenClaw setting updates can now be retried without losing track of affected settings.
• Re-enabling an OpenClaw adapter no longer loses track of settings applied by an earlier successful enable.
• anolisa adapter disable now warns when OpenClaw settings may remain after an uncertain update.

[0.2.7] - 2026-07-18

Added

• anolisa adapter now manages Qwen Code extensions through the qwen CLI for Qwen Code 0.17 and newer.

Changed

• anolisa upgrade and anolisa repair now explain component manifest reconciliation in human and JSON output.

Fixed

• anolisa upgrade now refreshes component manifests after RPM package upgrades.
• anolisa upgrade now reconciles same-version RPM component manifest changes.
• anolisa repair now refreshes stale component manifests from the installed RPM.
• Failed component manifest refreshes now keep RPM components repairable and report the affected component.

[0.2.6] - 2026-07-16

Fixed

• anolisa status no longer reports healthy RPM-managed components as failed.

[0.2.5] - 2026-07-14

Added

• anolisa repair now recovers interrupted fresh RPM installs after the package has been installed.
• anolisa update --check now reports RPM components whose saved state requires reconciliation.

Changed

• Install, adopt, and upgrade commands now require interrupted RPM installs to be repaired before continuing.

Fixed

• Concurrent RPM installs now fail safely instead of overwriting another operation's component state.
• Reinstalling a missing ANOLISA-managed RPM now preserves the component's settings and history.
• anolisa uninstall --dry-run --json now includes dry_run: true and omits removal phases for components that are not installed.
• anolisa upgrade now refreshes saved RPM versions and package details after upgrades.
• anolisa upgrade now reconciles older RPM records that lack package details.

[0.2.4] - 2026-07-13

Added

• anolisa update --check now shows progress while checking for updates in interactive terminals.
• anolisa upgrade now shows progress while planning and applying upgrades in interactive terminals.

Fixed

• Raw component installs and updates now choose installable archives even when binary releases are also listed.

[0.2.3] - 2026-07-12

Changed

• Package installation and removal progress now uses stderr, keeping command output safe for redirection.

Fixed

• ANOLISA commands now exit cleanly when a downstream pipeline closes standard output early.
• ANOLISA commands now report standard output write failures instead of silently succeeding.

[0.2.2] - 2026-07-09

Added

• anolisa update --check now reports RPM upgrade opportunities without changing state.
• anolisa update --check --motd now prints a short login-friendly upgrade summary.
• anolisa upgrade now applies RPM image upgrades for RPM-managed toolchains.
• anolisa upgrade now installs missing default components from the selected target profile.
• anolisa adapter scan now marks enabled receipts with missing sources as orphaned.
• anolisa adapter status now reports missing adapter sources as degraded receipts.

Changed

• anolisa list now shows component scope for visible user and system records.
• anolisa status now shows scope, mutability, shadowing, and state path metadata.
• anolisa doctor now includes readable system components in user-mode diagnostics.
• anolisa doctor now suggests system-mode commands for read-only system records.
• anolisa update --check now uses the latest target profile when --target is omitted.
• anolisa update --check --motd now points users to sudo anolisa upgrade when action is needed.

Fixed

• anolisa uninstall, forget, and update now reject read-only system targets with system-mode guidance.
• anolisa upgrade now reports unresolved target defaults as check errors.
• anolisa upgrade now warns when refreshed RPM details are unavailable after an upgrade.

[0.2.1] - 2026-07-08

Added

• anolisa adapter enable now supports Tokenless adapters for cosh, Codex, and Claude Code.
• anolisa adapter enable now supports Tokenless adapters for Qoder.

Changed

• Claude Code adapters now use per-component marketplaces to avoid affecting other ANOLISA plugins.
• anolisa adapter enable now rejects invalid framework and adapter_type combinations before changing settings.

Fixed

• Codex adapters now work when component resources come from packaged data directories.
• Qoder adapter enable now keeps malformed settings.json unchanged instead of replacing it.
• Qoder adapter disable now removes only hook entries previously added by ANOLISA.
• Qoder adapters now prefer stable qodercli releases over matching prereleases.

[0.2.0] - 2026-07-07

Added

• Raw components can now declare conflicts to block incompatible raw installs.

Fixed

• anolisa install now rejects raw component conflicts before changing the host.
• anolisa install --dry-run now reports raw component conflicts instead of showing an invalid plan.

[0.1.20] - 2026-07-03

Added

• ANOLISA can now be distributed as @anolisa/cli with Linux x64 and arm64 binaries.
• repo.toml now enables the npm backend for component distribution.

Changed

• anolisa list now shows local state, ownership, and next action for each component.
• anolisa list --json now includes RPM package, version, architecture, and source repository details.

Fixed

• RPM installs and updates now keep system repositories available for dependencies.
• Adapter commands now distinguish missing component manifests from invalid manifests.

[0.1.19] - 2026-07-02

Fixed

• anolisa adapter disable --dry-run now previews cleanup without removing adapter receipts or resources.
• Read-only commands now use downloaded repo config when saving repo.toml fails.
• Component commands now accept package aliases consistently when targeting installed components.
• Ambiguous package aliases no longer choose an arbitrary installed component.
• Unknown component names now report no match without querying packages.

[0.1.18] - 2026-07-01

Added

• anolisa install now auto-installs missing system packages for raw components in system mode.
• anolisa install --dry-run now labels unresolved dependencies as auto-install or manual.
• anolisa install now reports packages auto-installed during raw component installs.
• anolisa status --verbose now shows packages auto-installed for each component.

Changed

• Commands that need repo access now download and validate repo.toml on first use.
• Repo config dry-runs now fetch and validate without writing repo.toml.
• RPM install and update now use only the repo.toml RPM repository.
• User-mode raw installs now report missing dependencies with install commands before changing files.
• Failed raw installs now list any auto-installed packages left on the system.
• anolisa update self no longer fetches repo config before checking CLI updates.

Fixed

• anolisa list --installed now includes adopted RPM components.
• anolisa list now shows adopted, failed, and disabled component statuses.
• Adapter commands now prefer resources from the datadir that supplied the component contract.
• RPM installs now fail before dnf when [backends.rpm] is missing.
• RPM updates now explain missing [backends.rpm] instead of using host repositories.

[0.1.17] - 2026-06-30

Added

• Repository components.toml can now define component names, package aliases, and raw/RPM package mappings.
• anolisa list --installed now filters installed components.

Changed

• anolisa list and install --all now read components from components.toml instead of catalog.json.
• anolisa list now shows NAME, SUMMARY, BACKENDS, and STATUS.
• anolisa list --enabled is now a hidden alias for --installed.
• ANOLISA_CATALOG_URL no longer changes list sources; configure repo.toml instead.
• anolisa install, status, adopt, and repair now resolve RPM package aliases from components.toml.
• anolisa status now suggests sudo anolisa adopt <component> for untracked RPM components.

Fixed

• anolisa status <RPM package> now reports the canonical component row when an alias is installed.
• anolisa repair <RPM package> now refreshes the canonical component row when an alias is used.
• Non-root anolisa osbase mutations now reach the system helper instead of failing install-mode checks.
• Commands now reject root --install-mode user before writing ambiguous user-mode state.
• System-mode write commands now fail before changes when sudo is missing.
• Existing installs with managed symlinks no longer show false symlink integrity failures after upgrade.
• anolisa status now reports referent_mismatch when managed symlinks point elsewhere.

[0.1.16] - 2026-06-29

Added

• anolisa osbase sandbox install runc now installs runc, containerd, Docker, and Docker client.
• anolisa osbase sandbox install now enables services declared by sandbox scenarios.
• anolisa osbase sandbox install now runs scenario verification commands after installation.
• anolisa osbase sandbox install now records sandbox scenarios in installed.toml.
• anolisa osbase sandbox install now reports optional scenario packages as hints.
• rund, firecracker, and gvisor sandbox scenarios now define post-install checks.
• anolisa adapter enable now supports adapter_type = "skill_bundle" for OpenClaw and Hermes skills.
• The RPM package now installs default repo.toml to /etc/anolisa/repo.toml.
• ANOLISA telemetry setup now installs log rotation for ops .jsonl files.

Changed

• anolisa osbase sandbox install --dry-run now shows preflight, package, service, verify, and state phases.
• anolisa osbase sandbox install runc now requires Linux kernel 4.18 or newer.
• anolisa osbase sandbox install now reports verification failures as warnings when other phases succeed.
• repo.toml now points RPM installs to the agentic-os repository path.
• anolisa update self --json now reports apply mode, RPM package, and RPM version observations.
• anolisa adapter status now treats skill bundles as healthy without plugin registration.
• anolisa adapter enable now rejects skill bundles that declare framework config entries.

Fixed

• RPM-backed commands now use the component name as the default package name.
• anolisa update self now delegates RPM-owned CLI updates to dnf.
• Non-root sandbox installs now show package, service, verify, and state phases.
• Telemetry setup now runs the ilogtail installer with bash-compatible script handling.
• anolisa adapter disable now cleans skill bundles without plugin unregister errors.

[0.1.15] - 2026-06-25

Added

• anolisa doctor now reports component health, dependency status, and suggested fixes.
• Raw components can now declare runtime dependencies for install and update preflight checks.
• anolisa install --dry-run now previews runtime dependency status for raw components.

Changed

• anolisa install and update <component> now refuse raw components with missing runtime dependencies before changing files.
• anolisa restart <component> now restarts service units shipped by RPM-backed components.
• anolisa restart <component> now shows guidance for RPM-backed template services instead of failing.

Fixed

• anolisa adapter enable now expands {datadir} from the package that provided the adapter metadata.
• After anolisa uninstall or forget, adapter commands no longer see stale component metadata.

[0.1.14] - 2026-06-24

Added

• Raw components can now place systemd unit files with {unitdir}.
• Raw components can now place user service unit files with {userunitdir}.
• User-mode anolisa install now activates declared user-scope services.

Changed

• User-mode anolisa install now resolves %u service templates to the current user.
• System-mode anolisa install now preserves %u user service templates for later per-user activation.
• anolisa uninstall now reloads systemd after removing declared service unit files.
• anolisa restart <component> now restarts user-scope services from user-mode installs.

Fixed

• anolisa install now starts freshly installed service units without a manual systemd reload.
• anolisa uninstall now deactivates user-scope services from user-mode installs.
• anolisa adapter enable now finds {datadir} skills from the package directory that provides the adapter.

[0.1.13] - 2026-06-23

Added

• anolisa adapter enable now supports Hermes plugins.
• anolisa adapter enable now installs declared OpenClaw skills.
• anolisa adapter enable now applies declared OpenClaw config values.
• anolisa install now starts declared services for raw components.
• anolisa install now applies declared file capabilities for raw components.
• anolisa install now runs declared hooks for raw components.
• anolisa update <component> now restarts declared services for raw components.
• anolisa update <component> now reapplies declared file capabilities for raw components.
• anolisa uninstall now runs declared hooks for raw components.
• anolisa uninstall now disables declared services after stopping them.

Changed

• anolisa adapter scan now honors declared adapter resource locations.
• anolisa adapter enable now reads package-installed adapter resources.
• anolisa install --dry-run now previews declared capabilities for raw components.
• anolisa register status now reports the latest registration after repeated changes.
• Cancelled anolisa register and unregister prompts now exit successfully.

Fixed

• anolisa adapter status now detects OpenClaw plugins from wrapped table output.
• anolisa adapter status now ignores bundled Hermes plugins during checks.
• anolisa adapter commands now find metadata shipped by RPM-installed components.
• anolisa register status now reports sysom console registrations as active.

[0.1.12] - 2026-06-22

Added

• anolisa update <component> can update raw-managed components from the raw backend.
• anolisa osbase sandbox list shows scenarios from sandbox.toml.
• anolisa osbase sandbox uninstall <scenario> can remove packages for a sandbox scenario.
• anolisa system setup can install the helper service for non-root osbase commands.
• anolisa system status can show helper health, version, uptime, and last operation.
• anolisa system teardown can remove the helper service and sandbox config.
• anolisa env --json includes distro identity fields.

Changed

• anolisa osbase sandbox install <scenario> now installs scenarios defined in sandbox.toml.
• Omitting --install-mode now selects system for root and user otherwise.
• anolisa update <component> --dry-run now lists raw backend candidate versions.

Fixed

• Legacy yum backend names in repo.toml and --backend now resolve to rpm.
• Raw components installed with --package now update from the same package name.
• anolisa update <component> now refuses raw updates that would downgrade a component.
• anolisa update <component> now refuses raw updates when versions cannot be safely compared.

[0.1.11] - 2026-06-18

Added

• anolisa adopt <component> can track a pre-installed system RPM without installing it.
• anolisa repair <component> can refresh RPM component state after package details change.
• anolisa forget <component> can stop tracking a component without removing packages or files.

Changed

• anolisa status <component> now reports drifted RPM components when system package details change.
• anolisa uninstall now keeps observed system RPMs unless --remove-system-package is used.
• anolisa install now preserves adapter package resources when adopting RPM components.

[0.1.10] - 2026-06-17

Added

• anolisa install --backend rpm can install missing RPM components through dnf and track them as managed.
• anolisa install can adopt matching pre-installed system RPMs without downloading a raw package.
• anolisa update <component> can update RPM-managed and RPM-observed components through dnf.
• anolisa status now shows package, version, architecture, and source repo for RPM-backed components.
• anolisa status <component> now reports matching untracked system RPMs as observed.

Changed

• anolisa update runtime <component> is now anolisa update <component>; self and all stay subcommands.
• repo.toml now uses [backends.rpm] instead of [backends.yum].
• anolisa install --all now lists adopted RPM components in the batch summary.

Fixed

• anolisa install --all now prints the reason for each failed component in human output.
• anolisa install now refuses automatic RPM detection when rpm or dnf is missing, with a --backend raw hint.
• anolisa install no longer replaces a raw install if another install finishes first.

[0.1.9] - 2026-06-16

Added

• anolisa install --all can install every available component from the catalog.
• anolisa install --all --fail-fast can stop after the first failed component.
• anolisa install --all --json returns one batch summary with per-component results.
• anolisa status now shows adapter summaries for installed components.

Changed

• installed.toml now distinguishes ANOLISA-managed packages from observed system RPMs.

[0.1.8] - 2026-06-15

Added

• anolisa adapter enable can now register installed adapters with OpenClaw.
• anolisa adapter disable can now remove OpenClaw adapter registrations.
• anolisa adapter status can now report OpenClaw adapter health.
• anolisa adapter scan can now show installed adapter resources.

Changed

• anolisa install now places adapter resources needed by later enablement.
• anolisa uninstall now blocks components that still have enabled adapters.

[0.1.7] - 2026-06-13

Changed

• User-mode library paths now resolve to ~/.local/lib/anolisa; other directories continue to follow XDG_* overrides.

Fixed

• anolisa install no longer requires a local catalog entry before downloading from the remote repository.
• anolisa install --dry-run can preview files and services without downloading the full package.

[0.1.6] - 2026-06-12

Added

• anolisa osbase sandbox install gvisor now supports standalone, containerd, and substrate deployments. (#851)
• anolisa list can derive the component catalog from repo.toml configuration. (#854)

Changed

• Replaced the legacy "capability" model with a unified component lifecycle; old state auto-migrates on next write. (#876)

Fixed

• anolisa list --enabled now correctly shows installed components instead of an empty list. (#872)
• anolisa list no longer requires a separate local catalog file when repo.toml is configured. (#854)

[0.1.5] - 2026-06-11

Added

• anolisa list reads from a remote or local component catalog and returns structured JSON. (#850)
• anolisa install <component> downloads, verifies, and installs components from the remote repository. (#852)
• anolisa uninstall supports the new component model while preserving legacy fallback. (#852)

Changed

• Simplified CLI help around list, install, uninstall, status, doctor, logs, restart, update. (#850)

Fixed

• anolisa list returns an empty list with a config hint when no catalog is configured. (#850)
• Failed installs now automatically roll back partially-written files. (#852)

[0.1.4] - 2026-06-10

Added

• anolisa adapter scan detects available framework integrations. (#808)
• anolisa adapter install downloads verified packages and registers adapters with the target framework.
• anolisa adapter remove safely removes only ANOLISA-managed files, with dry-run and JSON preview support.
• anolisa adapter install tokenless openclaw wires up the tokenless adapter via the OpenClaw CLI.
• anolisa enable fetches component metadata from the remote repository, with offline fallback.
• anolisa status now includes component health check results.

Changed

• Renamed subscription commands to top-level anolisa register / unregister.

Fixed

• Adapter install/remove failures now roll back or preserve state for retry.

[0.1.3] - 2026-06-09

Added

• anolisa --help now groups commands by category (everyday vs. management).
• list command shows its ls alias in help output.
• anolisa update self prints a changelog link on success.

Changed

• Corrected package license metadata to Apache-2.0.

[0.1.2] - 2026-06-08

Added

• anolisa bug generates a local diagnostic report with environment info and recent error logs.
• anolisa self update added as an alias for anolisa update self.

Fixed

• Restored the bug report issue template.

[0.1.1] - 2026-06-07

Added

• anolisa osbase sandbox install provisions sandbox environments (firecracker and e2b backends).
• anolisa register / unregister manages data-upload consent with 30-day deferral.
• anolisa enable can configure log upload (ilogtail) with automatic region detection.
• anolisa update self downloads and applies CLI updates with integrity verification and rollback.
• Real dnf/apt package manager backends replacing placeholder stubs.
• GitHub Actions CI for the anolisa workspace.

Fixed

• Install script uses portable bash expansion instead of sed.

[0.1.0] - 2026-06-04

Initial alpha release of the ANOLISA CLI.

Added

• CLI commands: env, list, status, logs, enable, disable, uninstall, restart, update, info, doctor.
• Environment detection: OS, arch, kernel, distro, container runtime, user identity (graceful degradation).
• Component lifecycle engine with preview-then-execute, integrity checks, and audit logging.
• Configuration-driven feature gates for shipping new capabilities without code changes.
• Declarative TOML component manifests with multi-architecture support.
• install-anolisa.sh installer with three modes (local, checkout, URL), checksum verification, and --dry-run.
• End-to-end smoke tests for agent-observability and token-optimization.

Capabilities shipped

Known limitations

• Real-execute paths are Linux-only (darwin hosts can --dry-run only).
• No signature verification or rpm/deb backend yet.
• update command returns NOT_IMPLEMENTED.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[0.2.8] - 2026-09-20

Added

• agent-memory: Falls back to a private per-user runtime or temporary directory when the configured session directory is unusable, unprivileged installations can use session logs and mem_promote without creating a root-owned directory; fallback paths are checked for ownership, permissions, and symlink redirection (#3266)

Changed

• agent-memory: Breaking change: renames the OpenClaw tools to anolisa_memory_search and anolisa_memory_get, agents can access ANOLISA memories alongside OpenClaw's own memory tools without name conflicts; update prompts and tool allowlists, restart the gateway, and start a new conversation. Internal MCP names and stored memories are unchanged (#3347)
• agent-memory: Declares all four plugin tools in OpenClaw's coding profile, agents retain access to the plugin tools under that profile without disabling memory-core; custom policies still need explicit tool entries, and disable markers from intermediate installers require the manual recovery described in the user guide (#3347)

Fixed

• agent-memory: Accepts sessionId and sessionDir in the OpenClaw plugin schema and enforces the server's 128-byte UTF-8 identifier limit at plugin startup, users can pin session scratch across respawns and receive configuration errors before an invalid identifier changes their namespace (#3213)
• agent-memory: Ranks stronger BM25 matches first and aligns keyword scores with the higher-is-better convention, search, hybrid retrieval, and automatic recall prioritize the most relevant matching memories (#3296)
• agent-memory: Rejects the unsupported OpenClaw expert profile with guidance to use basic or advanced and stops the previous client before validating a reload, operators see actionable configuration errors without leaving the old memory process holding storage locks (#3238)
• agent-memory: Restores the required files in make dist source archives, source-package and RPM builders receive the example target, configuration, and adapter assets needed to build and install (#3231)

[0.2.7] - 2026-09-09

Fixed

• agent-memory: Negotiates OpenClaw installer flags from host help and grants declared capabilities by default, operators can install on hosts that require consent or withhold it with AGENT_MEMORY_ACCEPT_CAPABILITIES=0; deprecated no-op unsafe-install flags are omitted and failures distinguish consent rejection from unwritable destinations (#3149)
• agent-memory: Labels corpus hits as agent-memory and supplies read handles for memory_get corpus=all, agents can retrieve matching stored memories even when their paths overlap OpenClaw workspace memory and receive accurate fromLine / lineCount for windowed reads (#3177)
• agent-memory: Validates plugin configuration before locating the binary, operators see invalid userId / sessionId errors even when agent-memory is not installed (#3155)
• agent-memory: Declares its RPM component identity, ANOLISA can recognize the installed package as the agent-memory component (#2560)
• agent-memory: Declares Node.js >= 20 and npm as source-build dependencies in the unified build workflow, user-mode setup provisions the tools needed to bundle the OpenClaw adapter and system-mode preflight reports missing tools before building (#3187)

[0.2.6] - 2026-07-30

Fixed

• agent-memory: Updated to v0.2.6, retries short-token LIKE searches with OR matching when strict matching finds nothing and ranks stronger keyword matches first, agents can recall relevant memories from stopword-heavy prompts instead of receiving an empty result (#2040)

[0.2.5] - 2026-07-27

Fixed

• agent-memory: Updated to v0.2.5, derives focused recall queries from long English and CJK prompts and combines their results, agents can recall relevant memories from verbose prompts without silently dropping topics (#1574)

0.2.4

• fix(memory): auto-recall returns empty results after observe — synchronously reindex after memory_observe so before_prompt_build hook finds new content (#1520)
• fix(memory): install.sh sets allowConversationAccess for hooks (#1521)

0.2.3

• fix(memory): normalize OpenClaw content blocks from array of content blocks [{type:"text", text:"..."}] to string before trigger matching and hashing, so auto-capture actually fires instead of coercing to "[object Object]"
• fix(memory): add BM25 OR fallback — when implicit-AND FTS5 query returns 0 rows and there are multiple tokens, retry with '\"token1\" OR \"token2\" OR ...' so partial matches still surface instead of silent failures
• fix(memory): sanitize audit_log by replacing format!("{:.120}", query) with format!("bm25:len={}", query.len()) to prevent user query content from leaking into log paths

0.2.2

• fix memory_observe hint sanitization so YAML-escaped hints round-trip through the hand-rolled frontmatter reader (which does not interpret YAML escapes): replace yaml_escape_hint() with sanitize_hint() that only substitutes newlines and ASCII control chars with spaces; add 8 unit tests plus a real-parser round-trip test covering Windows paths with backslashes
• add max_hint_bytes (default 512) to MemoryConfig with MEMORY_MAX_HINT_BYTES env override; thread &MemoryConfig through memory_observe, the MemoryService facade, and the MCP server
• fix make install INSTALL_PROFILE=user PREFIX=$HOME/.local failing with Permission denied at install-adapter-resources: honor INSTALL_PROFILE and derive DATADIR/SHARE_DIR from $(PREFIX) so all writable paths follow the profile (system mode unchanged); aligns with the tokenless/ws-ckpt install contract
• add safe_fs security-boundary unit tests (path escape, symlink traversal, sandbox root violations) plus formatting/import-order fixes exposed by cargo fmt --all --check

0.2.1

• fix vector/hybrid search panic and empty index when an embedding provider is configured: the index worker ran on a std::thread with no tokio Handle so embeddings were never produced, and memory_search mode=vector|hybrid called Handle::block_on from a worker thread; the runtime handle is now captured at spawn and threaded through to the worker, and the search path uses block_in_place
• fix memory_get_context leaking .git internals (e.g. .git/logs/HEAD) into agent context by extending the reserved-path filter to cover .git/ via a shared is_under_git predicate in safe_fs
• fix full_scan (startup and inotify-overflow recovery) only building the BM25 index and never dense embeddings, so preexisting files were invisible to vector search until modified; a paths_without_vec query plus a backfill pass now embeds them, centralised in an embed_sync helper shared with flush
• fix memory_search returning zero hits for short CJK query terms (< 3 chars, e.g. "花名"/"小云"): the trigram tokenizer emits no tokens for terms shorter than 3 characters, so such queries now fall back to a body LIKE '%term%' substring scan that preserves recall, agent-scope filtering, and cold/superseded exclusion
• resolve embedding dimensions from the first real response instead of hardcoding 1536 (DashScope text-embedding-v3 is 1024): dimensionality is stored in an AtomicUsize seeded with the estimate and overwritten on first embed
• add anolisa-cli adapter contract via .anolisa/component.toml so the CLI adapter manager can discover the openclaw plugin bundle through the [[adapters]] TOML schema

0.2.0

• add prompt-injection safety module (looksLikePromptInjection + escapeMemoryForPrompt) mirrored between Rust core and TS adapter
• add secret detection and PII redaction to the safety module
• add auto-recall before_prompt_build hook injecting relevant memories each turn
• add auto-capture agent_end hook with trigger filtering, SHA256 dedup and injection rejection
• add dense-vector semantic search via pluggable EmbeddingProvider (OpenAI /v1/embeddings, Ollama /api/embed)
• add files_vec table (schema v2) for per-file dense embeddings alongside FTS5 BM25
• add hybrid search with reciprocal rank fusion (RRF, k=60) of BM25 + vector scores
• add memory_search mode parameter (bm25/vector/hybrid) with graceful fallback to BM25
• add per-agent memory isolation via [memory].agent_scope (shared/isolated/filter), schema v5
• add memory sovereignty tools (memory_about/forget/auto_created/consent) with consent.toml preferences
• add 4-type closed memory classification (user/feedback/project/reference) to memory_observe
• add mem_export and mem_import for cross-agent memory migration (AMA archive format)
• add memory_summary tool for memory overview and source tracking
• add memory_session_context tool
• add memory_sessions and memory_timeline session history query tools
• add MEMORY.md index file and mem_index_refresh tool
• add user profile synthesis (Dreaming V3 mem_dream)
• add memory consolidation: auto-extract L1 atomic facts from session audit logs on shutdown
• add episodic memory extraction from coherent tool-call chains
• add cross-session task persistence and incremental consolidation
• add consolidation quality filters (mutual exclusion, non-derivable, date normalization)
• add time-decay ranking (exp(-λ×age_days)) applied to BM25/vector/hybrid scores
• add cold archival of old never-accessed files with mem_compact tool
• add conflict detection via BM25 similarity before writing new facts
• add category subdirectories (facts/<category>/) with memory_search category filter
• add token tracking (tokens field in AuditEntry)
• add mem_consolidate tool for manual consolidation trigger
• add corpus supplement registration for memory_search corpus=all
• add EmbeddingConfig (None/OpenAI/Ollama) with TOML parsing and env overrides
• extend memory_search signature with optional mode and category parameters
• cap memory_search query at 1024 characters to prevent FTS5 resource exhaustion
• truncate embedding error response bodies to 200 chars to prevent API key leakage
• distinguish CJK vs ASCII token estimation in ConsolidatedFact
• hold FactWriter JSONL file handle under mutex to prevent line interleaving
• derive BM25Store mount root from db path with canonicalize + starts_with traversal guard
• compute Episode duration from entry timestamps instead of chain length
• propagate session_id to extracted episodic facts
• return fact count from consolidate() for mem_consolidate reporting
• fix effectiveMode in search response to reflect actual mode used
• fix embedding API empty-response handling to return zero vector of correct dimensionality

0.1.0

• introduce filesystem memory MCP server for AI agents (Linux only) with 21 tools over stdio JSON-RPC 2.0 in three tiers (Tier A file ops, Tier B BM25 search, Tier C governance)
• add per-namespace mount under ~/.anolisa/memory/<ns>/ with optional user-namespace + private tmpfs isolation (auto/userland/userns strategies)
• enforce path sandbox via openat2(RESOLVE_BENEATH | RESOLVE_NO_SYMLINKS) on every Tier A file open
• add SQLite FTS5 BM25 background index with transactional upsert, schema migrations, trigram CJK tokenizer and inotify-driven debounced flush
• add optional git versioning with auto-commit serialized under a per-handle mutex
• add tar.gz snapshots with strict id whitelist, atomic rename swap on restore and rollback entries under .anolisa/trash/
• add optional cgroup v2 memory.max self-limit applied before the tokio runtime starts
• add JSONL audit log (O_NOFOLLOW | O_CLOEXEC, Mutex<File>) with optional systemd-journald fan-out
• enforce profile gating (basic/advanced/expert) at both tools/list and tools/call with deny_unknown_fields on config structs
• add per-session scratch and log under /run/anolisa/sessions/<sid>/ (0700) with tmpfiles.d snippet
• add systemd user template anolisa-memory@.service with hardening (ProtectKernelTunables/Modules/Logs, SystemCallFilter, MemoryDenyWriteExecute, RestrictNamespaces, RestrictAddressFamilies=AF_UNIX)
• add RPM packaging with offline vendor tarball and single statically-linked binary (bundled SQLite + vendored libgit2)
• add OpenClaw plugin memory-anolisa with install/detect/uninstall lifecycle and 4 memory contract tools routed to the MCP server as a stdio child
• add single-source version sync from Cargo.toml into manifest/package/openclaw/mcp JSON and the bundle
• add mcp-harness example and 140 automated tests across 12 integration suites

Changelog

0.13.0

V2 Policy & Daemon Runtime

• Added V2 daemon Policy, Scope, and Binding CRUD APIs with root-only authorization. (#3062)
• Added V2 CLI commands for Policy, Scope, and Binding management through the daemon. (#3097)
• Added AgentSight policy adapters, client integration, and binding reconciliation. (#3103)
• Added bounded concurrent reconciliation workers so one binding failure cannot block the daemon. (#3194)

V2 Security Operations

• Added the V2 daemon-backed Bash and Python regex Code Scanner with compatible structured results. (#3203)
• Added the V2 capabilities command with V1-compatible environment capability reporting. (#3243)
• Added V1-shaped JSONL and SQLite persistence for accepted V2 code-scan events. (#3246)
• Added shared scan lifecycle recording and allowlisted telemetry sinks for V2 security operations. (#3300)

Skill Ledger Runtime

• Skipped unmanaged read-only raw user Skills during default batch initialization and scanning. (#3183)
• Unified Skill Ledger CLI and configuration inputs around supported names, initialization, and policies. (#3253)

Build & Packaging

• Delivered the V2 daemon as a hardened systemd system service. (#3217)

Skills

• Added the bundled pii-checker Skill for PII and credential scans with optional redaction. (#3241)

Testing & CI

• Added installed V2 RPM end-to-end coverage for CLI, daemon, plugins, and service contracts. (#3162)

Documentation

• Added AARM registry and OWASP Agentic Top 10 security-control mappings. (#3227)

Maintenance

• Flattened the V2 crate layout and updated internal references. (#3319)

0.12.0

cosh & Cosh-NG Hook Integration

• Normalized legacy cosh and Cosh-NG Skill invocation payloads in the cosh Skill Ledger hook so Cosh-NG invocations follow the configured policy instead of bypassing the check. (#2871)

Skill Ledger Runtime

• Tightened six Skill scanner detector patterns to remove deterministic false positives and bumped the static scanner identifier to cisco-static-only-0.1.1. (#2928)
• Completed the skill-ledger and check help output with all eight integrity statuses and their production conditions. (#2707)

Daemon Runtime

• Added a POSIX shell daemon.health probe that avoids Python cold start for container health checks. (#2879)

Rust v2 Framework

• Added the v2 foundation and policy type crates as the base for the Rust security core migration. (#3007)
• Added the v2 daemon service framework with UDS server, request dispatch, and shutdown handling. (#3040)
• Added the v2 PAP service with Policy, Scope, and Binding CRUD over a repository abstraction. (#3027)

Build & Packaging

• Raised the cryptography runtime floor to 50.0.1 and refreshed the lock and exported requirements. (#3015)

Documentation

• Added design docs for the current daemon protocols and the v2 framework requirements. (#2881)

0.11.1

Prompt Scanner

• Restricted the invisible-character injection rule so emoji ZWJ sequences, Persian ZWNJ, and leading BOM no longer score as critical injections. (#2900)
• Refused non-loopback model service base URLs derived from the environment in both the Rust and Python model service paths. (#2893)
• Reported daemon.health prompt_scan state as untracked instead of unconditionally ready now that scanning runs in-process. (#2892)
• Dropped the dead prompt model preload environment flag and the obsolete scan-prompt protocol document. (#2886)

Skill Ledger Runtime

• Skipped host-backed read-only system Skills in batch scan --all and default init instead of failing them. (#2906)
• Rejected the placeholder set-policy and rotate-keys commands so they no longer report false success. (#2876)

Asset Verification

• Reported explicit CHECKED / PASSED / FAILED counters and a distinct zero-candidate outcome for agent-sec-cli verify. (#2875)

Security Events & CLI

• Enforced owner-only permissions on files created by the CLI. (#2873)

Documentation

• Documented the five hidden agent-sec-cli integration commands and their contract caveats. (#2887)
• Documented the rule-only L1 detection boundary and how to read pass together with degraded fields. (#2895)

0.11.0

Prompt Scanner

• Rewrote prompt scanner core in Rust for native performance. (#2409)
• Added ATR (Agent Threat Rules) rule packs and reduced compile time. (#2531)
• Added Warden-Gen L2 backend option for prompt scanning. (#2699)
• Routed Rust native extension logs to Python logging framework. (#2640)
• Corrected warmup documentation to describe model availability checks and silenced per-invocation scan mode logging in the Codex, cosh, and Qwen Code prompt scanner hooks. (#2745)

Hermes Hook Integration

• Dropped Hermes synthetic warning injection; PII and Skill Ledger policies now use native observe/block boundaries. (#2712)

PII Checker

• Refined PII detection to reduce JWT and Email false positives and aligned user notices across all host adapters. (#2443)

Skill Ledger Runtime

• Added SkillFS HMAC peer authentication for cross-container Skill Ledger deployments. (#2493)

Security Events & CLI

• Added agent-sec-cli capabilities subcommand for environment-based hook configuration inspection. (#2356)
• Set observability hook timeout to 10s and CLI default timeout to 5s. (#2346)
• Added security observability skill for structured event and session report queries. (#2245)

Documentation

• Corrected and restructured user docs to align with 0.10.x shipped behavior. (#2456)

0.10.1

OpenClaw & cosh Hook Integrations

• Piped prompt text through stdin instead of command-line arguments in the OpenClaw and cosh prompt scanner hooks. (#2445)

Security Events & CLI

• Validated events query parameters in the CLI and the daemon security query handlers. (#2451)

0.10.0

Agent Hook Policy Controls

• Added code scanner enable flags for agent hooks. (#2001)
• Unified hook policy controls across agent integrations. (#2141)
• Added an observability hook environment toggle. (#2199)
• Restored scanner mode environment variable names. (#2212)
• Aligned code scanner hook flags across supported agent integrations. (#2229)
• Added environment-based prompt scanner gating. (#2239)

OpenClaw Hook Integration

• Added block mode support for the OpenClaw code scanner hook. (#2242)

Prompt Scanner

• Widened prompt scan inbound text field coverage. (#2277)

Skill Ledger Runtime

• Added read-only skill analysis. (#2044)
• Included raw skill directories in skill ledger checks. (#2201)
• Authenticated manifests before loading skill package contents. (#2185)

Security Events & CLI

• Added session and run filters to agent-sec-cli events queries. (#2132)

Raw Packaging

• Added component-owned raw package build targets and archive validation. (#2133)
• Updated raw hooks to use the bundled Python launcher. (#2255)

0.9.0

Qoder CLI & Qwen Code Hook Capability Expansion

• Added Qwen plugin and observability hooks. (#1473)
• Added Qoder CLI hook framework support. (#1480)
• Added Qoder prompt injection scanner hook integration. (#1529)
• Added Qwen prompt scanner hook integration. (#1538)
• Added code scanner hook integration for Qoder CLI and Qwen Code. (#1535)
• Added Qoder CLI Skill PreToolUse skill ledger checks for user and project skills. (#1552)
• Added Qwen PII hooks. (#1559)
• Added Qwen skill ledger hook integration. (#1561)
• Added Qoder CLI observability hook integration. (#1580)
• Unified Qwen Code hook trace context handling. (#1738)

Codex & OpenClaw Hook Integrations

• Added observability capability in the Codex plugin. (#1495)
• Added Codex PreToolUse PII checker hook integration. (#1501)
• Showed OpenClaw policy hints in hook responses. (#1525)

Scanner & Policy Engine

• Skipped prompt model downloads when the model cache already exists. (#1467)
• Added custom PII regex rules. (#1522)
• Satisfied L1-L3 telemetry requirements. (#1527)
• Added Chinese prompt-injection and jailbreak rules covering instruction override, authority escalation, encoding evasion, and role-play framing. (#1554)
• Unified model resources into handles to make prompt scanning resource lifecycle more consistent. (#1553)
• Made prompt scan mode configurable through environment variables. (#1620)
• Hardened audit, PII, and notify hook behavior. (#1649)

Skill Ledger Runtime

• Isolated the skill ledger worker for more reliable hook execution. (#1492)
• Resolved canonical skill roots for skill ledger checks. (#1558)
• Exposed skill ledger verdicts to hook callers. (#1577)

Build & Packaging

• Moved prompt-scan benchmarks to a standalone repository to keep the CLI package lean. (#1557)
• Rejected stale CLI wheels during packaging and runtime validation. (#1651)
• Replaced and restarted the daemon service when upgrading RPM packages. (#1681)

Testing & CI

• Fixed OpenClaw E2E test dependencies by excluding ML packages. (#1631)
• Fixed skill-ledger E2E test execution on macOS. (#1643)

Documentation

• Centralized user guides and added documentation lint CI. (#1586)

0.8.0

Build & Packaging

• Installed the Codex plugin during source builds so source deployments include the same Codex integration as packaged installs. (#1302)
• Updated source build scripts for the sec-core install flow. (#1348)
• Fixed system-mode source builds by placing uv-managed Python under the shared sec-core library directory and adding a system install smoke check. (#1400)

Code Scanner

• Added sensitive file path rules for common agent credentials to block API key exposure. (#1401)

OpenClaw Plugin

• Hardened OpenClaw deploy compatibility handling and covered deployment edge cases with unit tests. (#1358)
• Added an OpenClaw plugin cross-version E2E matrix that validates packaged plugin loading, Gateway flows, policy behavior, and observability across supported OpenClaw hosts. (#1372)

Documentation

• Added bilingual agent-sec-core user guide documentation and documentation maintenance rules. (#1311)
• Documented OpenClaw plugin deployment, compatibility, and upgrade guidance. (#1370)

0.7.1

Prompt Scanner

• Degraded scan-prompt to fast mode when model unready; rewrote DENY to WARN and enriched degraded reason with diagnostics. (#1258)

Skill Ledger

• Clarified skill ledger fallback warnings and sanitized finding summaries. (#1240)
• Tamed ledger reconcile noise and typed live-root skip errors. (#1232)

Security Observability

• Added observability mapping for new pii_scan at before_tool_call & after_tool_call. (#1229)

0.7.0

Codex Plugin — Full security integration for OpenAI Codex

• Added codex-plugin with code scanning, prompt scanning, skill ledger, and PII checking hooks. (#1074)
• Supported packaging codex-plugin into RPM. (#1138)
• Fixed codex-plugin paths in Makefile and CI for correct RPM install verification. (#1165)

Code Scanner

• Added code-scanner LLM mode for AI-assisted security analysis. (#1108)
• Added code-scanner static rules for expanded coverage. (#1033)

Prompt Scanner

• Added L4 multi-turn intent detection with ollama model service. (#1060)
• Routed prompt scan to daemon and added prompt model preload for reduced latency. (#786)
• Controlled prompt scan call to use daemon by env variable. (#933)

Skill Ledger — Activation daemon and policy engine

• Added Skill Ledger activation daemon for background integrity monitoring. (#857)
• Added runtime activation resolver for skill trust decisions. (#826)
• Added skill ledger activation policy for configurable enforcement. (#944)
• Updated skill ledger activation and event contracts. (#983)
• Updated Skill Ledger hook defaults and reconcile notify behavior. (#1086)
• Aligned skill ledger hooks across all agent platforms. (#1135)
• Resolved Skill Ledger FUSE and unmanaged roots handling. (#1141)
• Fail-open unsupported Hermes skill ledger scenarios. (#1155)

Daemon & Telemetry

• Added daemon service with systemd integration and RPM build support. (#1090)
• Exposed SQL query endpoint at daemon for observability queries. (#1042)
• Enhanced daemon logging including requests and jobs. (#871)
• Added telemetry schema definition and SLS JSONL writer. (#977, #1008)
• Passed agent_name to telemetry data for multi-agent identification. (#1032)
• Added logging system for structured agent-sec-cli output. (#651)
• Added security daemon socket fallback under /run/user/<uid> for user-scoped deployments. (#1129)

PII Scanner

• Extended PII scanning coverage with additional pattern detectors. (#925)

Security Observability

• Added session report command for post-session security summaries. (#703)

Sandbox

• Converged sandbox trigger rules for consistent enforcement. (#979)

Adapter & Build

• Added ANOLISA CLI component.toml for adapter manifest integration. (#1067)
• Added systemd-rpm-macros as RPM build dependency. (#1156)

0.6.0

Self-Protection — Tamper-resistance for agent-sec-core itself

• Added self-protect code-scan rules that block disabling/uninstalling agent-sec plugins on OpenClaw and Hermes. (#692)
• Optimized self-protect rules in code-scan to eliminate false positives on prefix-matched plugin names and cover Hermes uninstall/rm patterns. (#710)

Prompt Scanner

• Unified prompt-scan warning format across cosh-extension, hermes-plugin, and openclaw-plugin with structured fields (threat type, risk level, interception stage, model confidence). (#709)

Agent-Sec-CLI

• Added daemon process for agent-sec-cli to amortize startup latency across hook invocations. (#677)

Adapter & Manifest

• Added standalone ANOLISA adapter entry anolisa-for-openclaw to package sec-core OpenClaw adapter scripts and drive install/detect/uninstall via the adapter manifest. (#549)
• Added Hermes adapter runner: refactored the OpenClaw entry into a target-agnostic anolisa-adapter-runner and added anolisa-for-hermes wrapper, with per-agent adapter directory layout under sec-core. (#617)
• Centralized sec-core adapter manifest parsing across adapter scripts and moved the manifest under the cli package. (#617)

OpenClaw Integration

• Normalized OpenClaw state directory handling: use OPENCLAW_STATE_DIR for adapter filesystem state, unset OPENCLAW_HOME when invoking the OpenClaw CLI, and aligned plugin install/list/uninstall handling. (#641)

0.5.0

PII Scanner — Personal information leak detection

• Added PIIChecker scan CLI with text/file input, regex/validator-based detection, redaction, and security middleware integration. (#525)
• Added PIIChecker hooks for cosh and OpenClaw with stdin-based input passing. (#539)
• Added Hermes PII checker hook. (#556)
• Fixed scan-pii module mode detection via subprocess. (#540)

Security Observability — Agent run metrics & posture insights

• Added security observability schema, metrics definition, and CLI with jsonl writer for agent runs. (#488)
• Added openclaw plugin for security observability. (#515)
• Added cosh hook for security observability. (#528)
• Persisted observability records to sqldb with CLI review command. (#544)
• Added observability plugin for hermes. (#553)
• Correlated security events with observability events and supported batch query. (#578)
• Respected trace-id filter in count queries. (#595)

Hermes Plugin — AI Agent integration framework

• Added hermes-plugin framework with abstract hook class and code scan capability. (#536)
• Added Hermes prompt-scan capability. (#579)
• Added Hermes PII checker hook. (#556)
• Added Hermes skill ledger hook. (#565)
• Added observability plugin for hermes. (#553)
• Supported correlation context in hermes agent plugin. (#590)
• Added hermes plugin install for rpmbuild and build from scratch. (#577)
• Stabilized Hermes skill-ledger warning delivery for non-pass skill checks. (#600)

Correlation & Tracing Context

• Unified caller tracing context across CLI, OpenClaw, and cosh with --trace-context JSON and SQLite schema v2. (#569)
• Supported correlation context in hermes agent plugin. (#590)
• Correlated security events with observability events. (#578)

Skill Ledger

• Integrated code-scanner with skill-ledger for unified security assessment. (#505)
• Updated skill ledger security interactions. (#529)
• Made openclaw skill ledger approval configurable. (#575)
• Added Hermes skill ledger hook. (#565)
• Refined skill ledger scan workflow and aligned documentation. (#529)
• Included skill-ledger e2e in install flows. (#573)
• Fixed skill-ledger hook scope limitation. (#497)
• Fixed managed skill dirs for discovery. (#510)
• Expanded home paths for skill-ledger. (#596)
• Hardened skill ledger recovery and key UX. (#575)

Code Scanner

• Added code-scan requireApproval config for openclaw. (#560)
• Added OpenClaw enableBlock hook policies. (#586)

Security Middleware & Event System

• Fixed TOCTOU race condition at sqldb read path. (#546)
• Made SQLAlchemy lazy import for non-DB subcommands. (#581)
• Lowered frequency for SQL maintenance operations. (#546)

Prompt Scanner

• Added Hermes prompt-scan capability via hermes plugin. (#579)
• Fixed warmup detection from error-string matching to file-based check. (#500)
• Fixed prompt text passing via stdin instead of argv. (#579)

Toolchain & CI

• Added build-all support with local space install for sec-core. (#527)
• Added hermes plugin install for rpmbuild and from-scratch build. (#577)
• Included skill-ledger e2e in install flows. (#573)
• Added adapter manifest for capability discovery. (#577)

0.4.0

Prompt Scanner

• Prompt scanner hook now asks user on missing model instead of fail-open. (#463)
• Added prompt injection detection benchmark dataset and evaluation toolkit. (#464)

Security Middleware & Event System

• Refactored security_events SQLite storage to SQLAlchemy ORM with multi-table extensibility and typed repositories. (#459)

Skill Ledger

• Fixed sign-skill auto-register config (exact awk match) and parse openclaw stdout unconditionally. (#445)
• Unified XDG paths under agent-sec/skill-ledger vendor namespace. (#445)
• Unified single-skill verify into structured result for consistent output. (#445)
• Converted integration tests from subprocess to Typer CliRunner. (#445)

OpenClaw Integration

• Registered plugin at openclaw gateway explicitly to support Gateway startup planning. (#446)

Refactoring

• Removed deprecated agent-sec-core skill directory; aligned README and spec with agent-sec-cli workflow. (#454)

Toolchain & CI

• Added coverage report for sec-core CI. (#431)
• Enabled rpmbuild and e2e test CI for main branch. (#432)

0.3.0

Prompt Scanner — Multi-layer prompt injection & jailbreak detection

• Added prompt injection/jailbreak detection scanner architecture with L1 rule engine (YAML-based) and L2 ML classifier (Prompt Guard 2). (#253)
• Integrated prompt scanner into cosh hook and openclaw plugin with security middleware lifecycle. (#261, #294)
• Added list-scanners command, improved CLI help, and made --scanner-version optional. (#284)
• Added prompt scan summary and backend tests. (#294)
• Added prompt-scanner skill definition. (#256)
• Added model warmup, audit logging, and comprehensive documentation. (#253)
• Stabilized batch scanning and verdict logic with thread-safe model loading. (#253)
• Unified prompt scanner response to use "ask" instead of "block". (#341)
• Added prompt-scanner e2e test suite and Makefile target. (#352)

Code Scanner — Static code security analysis

• Added code scanner component with rule-based detection for obfuscation, permission abuse, and more. (#234)
• Integrated code scanner into cosh hook (with ask decision support) and openclaw plugin adapter. (#234)
• Added code scanner CLI entry, error codes, and unit tests. (#234)
• Fixed code scan bugs and added e2e test. (#342)

Skill Ledger — Skill integrity tracking and signing

• Added skill-ledger CLI with middleware integration for skill integrity verification. (#252)
• Added skill-ledger skill definition. (#266)
• Added skill-ledger cosh hook for PreToolUse and openclaw-plugin capability. (#292, #281)
• Improved skill-ledger CLI and cleaned up imports. (#284)
• Restructured skill-ledger config defaults and documentation. (#296)
• Aligned skill-ledger tool name and added path validation. (#317)
• Reworked skill-ledger status, output, and check signing. (#335)
• Skill-ledger hook hardening, e2e suite, and posture integration. (#339)
• Known limitation: skill directory resolution assumes dir name matches SKILL.md name field; see #381.

Security Middleware & Event System

• Added security middleware framework with unified CLI entry point and metrics integration. (#121, #220)
• Added sqldb writer & reader with query command at CLI interface for security event persistence. (#254)
• Fixed cross-process event loss in SecurityEventWriter. (#226)
• Applied corruption whitelist to stop false-positive DB rebuilds. (#338)
• Added e2e test and fixed bugs revealed during testing. (#330)

Linux Sandbox

• Added sandbox guard and failure handler hooks. (#362)

OpenClaw Integration

• Added hook plugin for openclaw with integrated security scanning capabilities. (#242)
• Added jq requires for openclaw hook package. (#370)

Cosh Extension Integration

• Integrated with new cosh extension API and added builtin commands. (#302)

Performance

• Lazy-load ML dependencies to speed up non-ML subcommands. (#318)

Toolchain & CI

• Migrated Python toolchain to uv package manager and pinned Python 3.11.6. (#227)
• Added sec-core RPM build CI and adapted nightly build pipeline. (#295)
• Initialized code format check CI with python-code-pretty. (#229)
• Added e2e test in RPM build CI. (#369)

Bug Fixes

• Preserved seharden wrapper defaults. (#236)
• Removed dynamic import at middleware router. (#277)
• Improved missing loongshield guidance. (#289)
• Fixed build errors. (#288)
• Removed openclaw hook examples and fixed documentation. (#282)

0.2.0

• Added Hardened skill signing pipeline and added .skill-meta layout. (#129)
• Added Cargo.lock to version control. (#149)
• Added make install-sandbox target. (#68)
• Fixed bubblewrap version compatibility for --argv0 option. (#112)
• Changed Refactor SKILL.md to executable protocol and align sub-skills. (#130)

Changelog

Unreleased

Fixes

• Let agentsight-enforcer recover by itself when an upgrade leaves an enforcement layout the new binary cannot reuse: the stale layout is now detected and replaced automatically, so file-delete guard and enforcement health no longer stay down until someone removes the old layout by hand. (#3445)

0.13.0

Features

• Add GET /api/preferences and GET /api/preferences/export to surface the working habits inferred from recent conversations (language, plan-first workflow, test expectations, correction patterns, tool leanings), with /api/preferences/turns exposing the user turns an analysis was based on. Analysis runs per request over genai_events on Linux or collected trajectories elsewhere, so there is no derived state to migrate or go stale.
• Add GET /api/trajectories/steps to find ATIF steps by derived category (user_input, system, agent_message, thinking, tool_call, tool_result), returning each hit with its neighbouring steps. Categories are multi-label because a single agent step can carry a message, reasoning, tool calls and observations at once.
• Label trajectories for reuse triage, let a person settle a trajectory's label, add the reuse-label review page, and gate search to serve labelled trajectory history.
• Add an inode guard for file-delete-guard on 5.10/6.6 kernels, with domain isolation, violation events, and startup cleanup.

Fixes

• Initialize logging in the macOS trace path so trajectory collection failures surface instead of being silently dropped.
• Add a token-plan provider preset.
• Fix a stale fd in the enforcer ringbuf consumer after an mmap advance.
• Drop the trace_id alias in the traces list. (#3261)
• Honor the RUST_LOG regex in the main logger. (#3186)
• Resolve namespace PID to host PID with an init-ns self-check. (#3041)
• Add the conversation_id column before its index. (#3378)

0.12.1

Breaking

• Align kernel event timestamps by calibrating BPF monotonic clocks against realtime instead of container uptime. Historical wall-clock steps for events queued at the time cannot be reconstructed; already persisted records are unchanged.

Features

• Capture rustls plaintext for cosh-ng and attach the cosh plaintext tap by name. (#3191)

Fixes

• Stop counting cached tokens twice in token totals. (#3081)
• Stream the static SSL pattern scan. (#3087)
• Shorten the SSL uprobe re-attach TTL to 30s.
• Assemble fragmented HTTP responses.
• Complete HTTP/2 streams when SSE ends, and record streaming calls that signal via request headers instead of a body flag. (#3147)
• Merge duplicate records when a long-running call completes after an idle snapshot.
• Retry startup database cleanup when the database is locked, and recognise structured oom-kill records during startup recovery. (#3135)
• Match the OpenClaw gateway launched with the --max-old-space-size V8 flag.
• Add agentsight-enforcer logging.

0.12.0

Features

• Add --no-ebpf trajectory-only trace mode for environments where eBPF is unavailable.
• Support the DashScope/Bailian native protocol. (#2954)
• Add Kubernetes DaemonSet packaging. (#2976)
• Monitor agent resource usage. (#3005)
• Ground causal attribution in deterministic, re-checkable evidence. (#3011)
• Add an LSM-only agent file-delete guard profile and report its capability. (#2979)
• Add a vendored ABI guard, one-click audit protection, and Dashboard linkage. (#2775)

Fixes

• Avoid cgroup OOM during database purge by skipping VACUUM. (#2916)
• Merge Anthropic SSE token usage across events. (#2920)
• Warn when the data directory is on overlay storage. (#2977)
• Resolve PID lookups through a configurable procfs root.
• Keep conversation counts scoped by session. (#3014)
• Preserve tool results for causal attribution.
• Synchronize ActPlane policy deltas and prevent fail-open enforcement. (#2979, #3016)
• Reject oversized enforcement file paths instead of truncating them.
• Extract container IDs from systemd cgroup driver layouts. (#2997)
• Recognize modern OOM-kill dmesg format. (#3001)
• Resolve the PID namespace before seeding BPF cap_task state. (#3022)
• Pin Dockerfile RPM package selection to TARGETARCH. (#3025)

Docs

• Document --no-ebpf trace mode.

0.11.2

Features

• Show historical agent activity. (#2817)

Fixes

• Re-attach stale SSL uprobes after kernel-side consumer deregistration so capture self-heals without a restart. (#2792)
• Restart agentsight after an OOM kill. (#2925)
• Bound probe event channel by bytes to cap memory under event bursts. (#2925)
• Align CLI and dashboard with docs and de-duplicate the guide sidebar. (#2899)
• Trim oversized db by row fraction. (#2872)
• Trim interruption db to size limit. (#2823)
• Keep binding API state consistent. (#2794)

Docs

• Expand the AgentSight user guide into task pages. (#2825)

0.11.1

Fixes

• Keep null-session interruptions in breakdowns so per-session and per-conversation counts always sum to the total. (#2796)
• Add Bun SSL_do_handshake prologue pattern so Claude Code (Bun builds >= 2.1.113) LLM traffic is captured. (#2782)

0.11.0

Changes

• Version bump for RPM packaging; no functional changes since 0.10.3.

0.10.3

Features

• Add semantic search to the sessions list. (#2733)
• Add dsh plugin for DeepSeek Harness.
• Group agents by type in discovery.
• Add filtered_count to agent-health.
• Add /api/docs route inventory.
• Show LLM latency metrics in agent health cards. (#2586)

Fixes

• Drop hardcoded minus on savings. (#2754)
• Classify analyzer calls as internal. (#2755)
• Return savings rates as fractions. (#2732)
• Match tool args in loop detection. (#2719)
• Probe companion components for dashboard capabilities. (#2696)
• Scope graceful reap to worker agents.
• Count no_port gateways as healthy in dashboard. (#2694)
• Print deadloop hint on fresh install.
• Reload config on SIGHUP.
• Fill provider and session_id in audit events.
• Demote decompress fallback to debug level.
• Exclude sftp-server from agent discovery.
• Correct copilot cmdline rule typo.

0.10.2

Features

• Enforce size limits on sqlite stores. (#2644)
• Make dashboard UI bilingual (en/zh). (#2612)
• Add raw packaging for immutable release artifacts. (#2550)
• Add LLM latency metrics API. (#2578)

Fixes

• Match latency agents case-insensitively. (#2590)
• Address latency metrics CI follow-ups. (#2583)

0.10.1

Features

• Bootstrap dashboard i18n with preferred browser locale matching.
• Add agentscope framework to agent discovery rules.
• Streamline component onboarding docs and clarify service startup.

Fixes

• Treat pause_turn as a normal SSE finish. (#2320)
• Keep tool_call name across SSE continuation deltas.
• Report pids in the observer namespace. (#2360)
• Validate enforcer RPM payload, preserve RPM staging targets, and suppress repeated enforcer errors.
• Wrap extractor errors in JSON envelope and classify store errors by variant. (#2417, #2418)
• Dedupe unavailable state and refine dashboard metadata sync.

0.10.0

Features

• Add case containment lifecycle with policy handoff, no-gap replacement, dedicated API, and dashboard views.
• Add system audit protocol, event storage, dashboard, and extract audit service into a dedicated crate.
• Add ActPlane risk enforcement with enforcer service, hardened file controls, secure lifecycle, and risk enforcement dashboard.
• Convert Codex rollout JSONL to ATIF and cover Codex routing and tool calls with tests.
• Report process metadata on raw HTTPS events and carry it in the generic envelope.

Fixes

• Keep turn open on tool-call stop and add user_message_count to turn.id bucket key.
• Stream-decode fragmented zstd SSE responses.
• Improve QwenCode trace data accuracy and add QwenCode allow rules to agentsight config.
• Keep session across cosh restarts.
• Map cosh session temporary file writes. (#2080)

0.9.1

Features

• Rework optimization dashboard views and add detour-based cost waste analysis.
• Move agent health and interruptions to a dedicated dashboard page.

Fixes

• Extract cache tokens for OpenAI (prompt_tokens_details.cached_tokens) and DashScope (top-level cached_tokens) responses, and extract real user query from cosh-ng adapter prompt template.
• Capture Claude Code launched via absolute path or node wrapper.
• Skip agent_crash detection on clean exit and flush deferred GenAI events on agent exit.
• Skip message parse for non-LLM paths.
• Encrypt optimization config API key.
• Show known agent rules.

CI

• Pin eBPF build to clang 15 and use dedicated runner pools.

0.9.0

Features

• Add optimization analysis workspace, APIs, persistent analysis history, and dashboard pages for accuracy, performance, and cost reviews.
• Add Qoder trajectory collection, ATIF v1.7 export, batch analysis tooling, and subagent trajectory navigation with topology-style views.
• Add command-line discovery rules for CoshNG and normalize LLM event attribution with command-line context.
• Add six new interruption types and fallback capture for unparsable LLM HTTPS traffic.

Fixes

• Fix Anthropic SSE parsing, system prompt injection, and cache token accounting.
• Fix ATIF batch output to use the shared ATIF v1.7 schema and drop stale v1.6 paths.
• Fix optimization and trajectory collection edge cases, including stale conversation anchors and syscall tracepoint probe attach.
• Fix dashboard empty states, error banner wording, auth loopback handling, and session navigation behavior.
• Make raw HTTPS FFI output opt-in and skip duplicate SSE message parsing for OpenAI and Anthropic streams.

Changed

• Group optimization dimension analyses under per-target run roots and represent parallel LLM calls as ATIF subagent trajectories.
• Slim and gate default SLS output so trace content is not uploaded unless explicitly enabled.

0.8.1

Fixes

• Replace lock().unwrap() with poison-safe unwrap_or_else for mutex recovery.
• Correct SSL library attribution from aws-lc/BoringSSL to OpenSSL 3.x.
• Add Claude process name to BoringSSL classification.
• Preserve user config on schema migration instead of overwriting.
• Don't auto-overwrite invalid JSON configs; record process pid not thread tid in ns pid helper.
• Downgrade high-frequency event logs from debug to trace to reduce noise.

Tests

• Expand unit tests for handlers, interruption store, and token store.
• Add poison-recovery tests for mutex unwrap_or_else changes.

0.8.0

Features

• Add dashboard token-based authentication with file-only auth config.
• Add LAN/public IP address display and Chinese output in dashboard CLI.
• Add ECS security group guide and metadata integration to dashboard.
• Add conversation grader API and dashboard controls.
• Add COSH_SESSION_ID export for per-run session correlation.
• Auto-upgrade stale configs via schema_version.

Fixes

• Fix Codex SSL capture and SSE token extraction.
• Fix false interruption signals.
• Persist idle streams and tool results to avoid snapshot loss.
• Detect SSE stream errors explicitly.
• Restrict /health, /metrics, and server auth to localhost/file-only config.
• Remove hf-hub git fork from default build dependency.
• Fix IMDSv2 token fetching, probe deadlines, and ECS metadata deduplication.
• Fix RPM build to copy agentsight.json into source tarball.
• Address clippy single_match, nested if-let, and architecture boundary issues.

Tests

• Add dashboard mock HTTP and unit tests for coverage gate.
• Add build_output and public_address tests.
• Mark probe tests as #[ignore] for CI ECS runners.

0.7.1

Fixes

• Improve severity labels and agent sidebar UX.
• Show all verdicts in the summary command.
• Sync component.toml version with package version.

0.7.0

Features

• Add Codex CLI adaptation with three-tier SSL probe attach (symbol table → byte pattern → offset table) and cross-chunk SSE continuation buffer.
• Add security observability dashboard and server proxy for agent threat visibility.
• Add memory optimization with bounded event buffers, feature flags (features.*) and configurable runtime limits (runtime_limits.*).
• Add container_id to AgentsightLLMData for container-level attribution.
• Derive session_id from process environment variables and request metadata instead of message content.
• Add call_kind classification (chat / completion / embedding / tool_use) to GenAI semantic events.
• Add --exclude filter to agentsight audit CLI for noise reduction, and show non-streaming LLM calls in audit output.
• Add unified agentsight summary command for one-shot status overview.
• Enhance token savings page with baseline comparison, strategy breakdown, line-level diff highlighting and optimization tips.
• Upload skill metrics via SLS Logtail exporter.
• Improve agent health UX: role badges (P1/P2), TTL-based cleanup, process-ancestry grouping, and Session ID help tooltip.
• Filter client processes from health API to reduce dashboard noise.
• Add anolisa component contract for RPM lifecycle integration.

Fixes

• Fix sslsniff BPF verifier rejection on kernel 5.15 and add BPF load tests.
• Fix traced_processes BPF map leak causing uprobe attach failure after long runtime.
• Prevent duplicate uprobe Links by retaining inodes in traced_files on detach.
• Decode compressed (zstd/brotli) SSE streams so Claude Code and similar agents are fully captured.
• Harden compressed SSE decode against partial chunk boundaries.
• Extract token usage from non-streaming and HTTP/2 responses.
• Fix namespace PID usage in udpdns and tcpsniff probes.
• Strip /proc/{pid}/root prefix for uprobe attach in containerized environments.
• Implement tiered SSL and tcpsniff ring buffer reservations to reduce dropped events.
• Clamp before mask in filewrite/udpdns BPF probes; cap stdout payload to MAX-1.
• Change cgroup gate to OR semantics and add trace_cgroup FFI interface.
• Tighten SSE truncation detection and write pending row for deferred GenAI calls.
• Respect dynamic sysom path in SLS exporter mode selection; replace removed sysom_logtail_path with logtail_path filter.
• Validate ring buffer size is power-of-two at startup.
• Wire feature flags and runtime limits to actual runtime code paths.

Refactoring

• Split genai/builder.rs into 4 focused modules and genai.rs into 5 submodules.
• Bundle shared BPF maps into SharedMaps for reduced duplication.
• Extract background threads module with stop-signal support.
• Replace remaining unwrap() calls with if-let / ? patterns.

CI & Quality

• Add fmt, clippy, unit test coverage, and architecture boundary check CI gates.
• Add clippy.toml + cargo-deny for lint and supply-chain auditing.
• Add architecture boundary check script (check-arch-boundary.py).
• Add scoped AGENTS.md for FFI, unified orchestrator, and storage modules.
• Define Footprint Ladder for code surface growth control.
• Add agentsight-code-review and pr-body develop-skills.

0.6.1

• Add real-time agent_crash detection in trace mode.
• Add OOM crash detection.
• Add cgroup-level event filtering with v1/v2 compatibility.
• Support QwenCode skill discovery via per-user home scanning.
• Support SLS Logtail activation reversible via dynamic path.
• Support bridging ilogtail SLS_LOG_PATH into config via token-collector switch.
• Default traceEnabled to false to drop conversation content from SLS by default.
• Drop gen_ai.system_instructions from SLS uploads when traceEnabled=false.
• Refactor session_id and conversation_id derivation from response_id instead of message content.
• Fix CJK deadloop detection, kill() error check, and SIGKILL escalation.
• Fix SQLite read/write contention via VACUUM optimization.
• Fix rpm-build.sh agentsight build failures.
• Fix allow log path re-init on repeated new+start.

0.6.0

• Add deadloop detection and auto-kill mechanism for runaway agent processes.
• Add retry storm detection and /metrics interruption counters.
• Add BPF-layer HTTP protocol filter and wildcard capture (*) for unknown IP/port targets.
• Add client-side hybrid encryption for sensitive message fields.
• Add traceEnabled configuration toggle with SLS upload layer enforcement.
• Add HTTP domain rules resolved to tcpsniff BPF map via DNS.
• Add default DashScope HTTPS rule and anolisa_release module.
• Add FFI interface for tcp_targets and input_delta config.
• Add CO-RE compatibility to UDP DNS probe for kernel 6.0+.
• Support runtime SLS logtail path via config hot-reload.
• Expand interruption types and add logtail export.
• Restructure config to https/http rules.
• Refactor query stats.db by tool_use_id and unify savings display.
• Refactor load encryption public key from agentsight.json.
• Fix decode HPACK Huffman headers.
• Fix BoringSSL probe attachment, FFI event delivery, and chunked-body panic.
• Fix preserve initial SSE chunk in event-stream responses.
• Fix c_char / BPF comm portability (i8 vs u8).
• Remove dead code and deprecated APIs.

0.5.0

• Add Claude Code support including SSL probe attach for BoringSSL, Anthropic SSE thinking/tool_use content blocks, and message.id-based session correlation.
• Add tcpsniff probe for plain HTTP traffic capture with configurable IP/port filtering (disabled by default with empty tcp_targets).
• Add User-Agent based agent detection with comm fallback for simplified agent matching.
• Add UDP DNS probe for agent discovery (replacing TLS SNI probe) with QNAME parsing moved to userspace.
• Add TLS SNI probe module and refactor discovery to config-driven rules.
• Add connection scanner for pre-established LLM API connections.
• Add tools field to AgentsightLLMData FFI struct, passed through as raw JSON.
• Add container PID namespace support in BPF traced process filtering and event emission.
• Add agent matching rules and reduce BPF ring buffer to 32MB.
• Add uid field to SLS logs with OnceLock cache and startup validation.
• Support profile-based installs.
• Fix duration_ns calculation in LLM data.
• Fix SSL probe cleanup of stale inodes on process exit.
• Fix BPF verifier -E2BIG issues by removing nested #pragma unroll in udpdns.bpf.c and masking payload_len on older kernels.
• Fix skill extraction for Hermes agent architecture.
• Fix Node.js process.title change handling in OpenClaw matcher.

0.4.0

• Add HTTP/1.1 request body reassembly for fragmented SSL writes.
• Add skill metrics analysis with cosh filesystem-based discovery.
• Add SLS upload and Logtail file exporter for GenAI events.
• Add hermes agent matcher for LLM process discovery.
• Detect uv Python static OpenSSL in SSL sniffer.
• Remove AK/SK-based SLS direct upload, keep Logtail file export.

0.3.1

• Fix simplify agent_crash detection and fix multi-process dedup. (#411)
• Fix use SqliteConfig for audit CLI db path. (#399)
• Fix hide Cosh from agent health UI and remove keepalive support. (#401)
• Fix API endpoint table in AGENTS.md. (#397)

0.3.0

• Add interruption detection system with drain mechanism and dashboard integration. (#315)
• Add token savings page and API endpoint for optimization visualization. (#310)
• Add compounded token savings and request count tracking. (#320)
• Add C FFI API with cbindgen header generation. (#306)
• Add filewatch and filewrite eBPF probes for file access monitoring. (#308, #309)
• Support SysOM AK/SK GenAI capture for cosh. (#305)
• Use LLM API response_id as trace_id and add conversation_id field. (#304)
• Resolve session_id from agent's own session via ResponseSessionMapper. (#303)
• Fix interruption CLI and align conversation_id naming. (#318)
• Fix cosh session_id recognition by supporting snake_case response_id. (#307)
• Fix wrong tool call id in token savings compounding. (#316, #317)
• Fix standardize call_id, add tool_call_ids column. (#319)
• Fix session_id and response_id mapping in genai builder and storage. (#321)
• Fix token savings display in conversation list. (#322)
• Fix cache agent name by pid for dead process resolution. (#358)
• Fix remove custom db path and use default paths. (#359)
• Support nightly docker image build in CI. (#302)

0.2.2

• Support starting backend-server for dashboard with AgentSight service.
• Fix dashboard frontend dynamic width for multiple display-size.

0.2.1

• Add /usr/lib/copilot-shell path to CoshMatcher for agent discovery. (#190)
• Add 200MB size limit for genai_events.db to prevent unbounded growth. (#211)
• Remove /api/stats endpoint returning incorrect data. (#197)
• Extract audit from HttpRecord and filter non-LLM calls. (#196)
• Always show comparison data when --compare flag is used in token queries. (#194)
• Fix incorrect discover command in README documentation. (#191)
• Remove breakdown command and keep token consumption commented. (#193)
• Replace deprecated MemoryLimit with MemoryMax in systemd service file. (#181)

0.2.0

• AgentSight Dashboard web UI with real-time monitoring interface. (#74)
• Agent health monitoring with offline alerting and hung process dashboard restart. (#158)
• One-click navigation from dashboard to ATIF trace analysis page. (#116)
• /metrics endpoint to expose standard Prometheus-format data. (#134)
• Support for HTTP 2.0 protocol. (#147)
• Support to build RPM package. (#166)

Changelog

All notable changes to ANOLISA Blaze will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[0.3.0] - 2026-07-22

Added

• Generic StorageProvider trait with pluggable backend architecture.
• FileStorageProvider: default file-based storage backend for development and standard deployments.
• [storage] config section: provider, pool_size, prefork, flush_interval fields with backward-compatible defaults.
• GET /v1/health now includes storage_pool status (ready/capacity/pending).
• BackendSpawner trait extended with restore, pause, resume, create_snapshot methods (default unsupported, enabling future snapshot workflows).

[0.2.1] - 2026-07-21

Changed

• Rebrand: Component renamed from Anvil to Blaze. Binary: blazed, config path: /etc/anolisa/blaze/, state: /var/lib/blaze/.
• Firecracker vCPU configuration now validated against upper bound (1–32).

Added

• Component registered in project manifests (root README, AGENTS.md, PR template).
• VM resource configuration fallback chain documented in README.

[0.2.0] - 2026-06-30

Added

• FirecrackerSpawner: Firecracker microVM backend, daemon auto-detects and selects strongest isolation at startup.
• TCP remote API: configurable [listen].http_addr enables TCP listener (port 14159) for platform calls.
• Prioritized backend selection: build_spawner() auto-selects by firecracker → linux-sandbox → mock priority.
• Storage section: [storage].images_dir unifies vmlinux/rootfs lookup path.
• Packaging skeleton: dist/anvil.service (systemd unit) + anvil.spec (RPM) + tmpfiles-anvil.conf.
• [backends] config section for direct backend binary path mapping.

[0.1.3] - 2026-06-24

Changed

• Sandbox processes now run with full namespace isolation (PID, network, filesystem).

[0.1.2] - 2026-06-22

Added

• Sandbox processes are now managed by the daemon: auto-spawn on create, auto-kill on destroy.
• Daemon gracefully degrades when backend binary is unavailable (useful for dev environments).

[0.1.1] - 2026-06-20

Added

• Policy validation rejects unsafe configurations before sandbox starts.
• Safe coordination with osbase sandbox uninstall (prevents removing in-use backends).

[0.1.0] - 2026-06-18

Initial scaffold of ANOLISA Anvil per-host sandbox daemon.

Added

• Create, list, inspect, checkpoint (state-only), reset, and destroy sandboxes via HTTP API.
• Policy-driven backend selection: assign workload class → get the right sandbox type automatically.
• Warm pool: pre-created sandboxes ready for instant allocation, configurable min/target/max.
• Template sharing: multiple sandboxes share one base memory image, reducing per-instance cost.
• Prometheus metrics endpoint for monitoring.

Changelog

All notable changes to the cosh-ng project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[0.26.0] — 2026-09-23

Added

• Login sessions started by the Enhanced Bash host now carry a real login identity on Bash 4+: shopt -q login_shell reports yes, $0 is -bash, and /etc/profile plus ~/.bash_profile are read, matching a native bash -l session; set shell.login_identity = false to opt out, and the previous behavior is restored automatically on Bash 3.2 or when the capability probe fails (#3358)
• cosh-ng can now be installed on Intel Macs: the raw backend ships an x86_64 macOS archive with a minimum of macOS 11.0, and the public installer recognizes Intel Macs instead of failing or falling back to the ARM package (#3448, #3449)
• cosh-cli checkpoint recover can recover an interrupted initialization even when the original workspace path no longer exists, reporting the notices through meta.warning (#3356)

Changed

• Diagnostic logging now defaults to the info level, so ~/.copilot-shell/logs/cosh-{shell,core}.log.<date> records shell/core startup, core spawn, and error choke-points that previously surfaced only in the UI; explicit COSH_LOG, RUST_LOG, or [logging] level settings still win, and debug: true raises the effective level to debug (#3331)

Fixed

• rtk-wrapped readonly commands whose only redirection suppresses stderr to /dev/null (e.g. find /tmp -name '*x*' 2>/dev/null wrapped as env TOKENLESS_* /usr/bin/rtk …) are auto-approved again in auto mode: the wrapper is peeled for classification while the wrapped form still executes, keeping RTK output compression active, and any deviation falls back to the approval card (#3436)
• When a Task created with checkpoint = on in an empty workspace fails against an older daemon, the Task now states why no snapshot was taken and offers clear next steps (upgrade ws-ckpt, add a file and resubmit, or select checkpoint = off) instead of failing without explanation (#3437)
• After a successful Task snapshot switch, new Core and Codex Tasks use the rebuilt workspace without a Gateway restart; if the workspace refresh cannot be established, new Runtime launches fail closed instead of using a stale view (#3438)

[0.25.0] — 2026-09-20

Added

• Managed Tasks are now end-to-end: submit persistent Core or Codex Tasks from the guided /task form, choose a checkpoint policy, reconnect to inspect progress, and safely preview, diff, and switch Task-owned snapshots through a Gateway-backed recovery flow (#2911)
• Slash command discovery inside /agent: typing / in the Composer offers prefix-filtered candidates with browsing and Tab completion, and submitted commands run through the normal handlers with confirmation cards (#3224)
• First-time provider setup is now automated: a conflict-free default name is derived from the template type and existing configs, and ECS RAM Role credentials are detected and submitted without manual confirmation through a bounded, cancellable probe (#3298)
• Readonly commands whose only redirection suppresses stderr to /dev/null (e.g. find /tmp -name '*x*' 2>/dev/null) no longer require approval in auto mode (#3208)

Changed

• Declared [[hooks.PreToolUse]] config hooks now run by default without requiring hooks.enabled; explicitly disabled hooks warn and are removed before extension registration, and empty hook output still blocks the tool call by default (#3330)
• Enhanced sessions no longer print the ownership status line (◇/◌) above the prompt by default, keeping the shell's native prompt appearance; set shell.status_symbols = true or COSH_SHELL_STATUS_SYMBOLS=1 to opt back in — when enabled, the symbol is published on its own line so narrow-terminal editing no longer loses CJK characters or misplaces the cursor (#3345, #3254)

Fixed

• Lexical path-traversal spellings that resolve into /proc, /dev, or /sys are now blocked by the readonly safety check, closing a bypass where variants like /../proc/version slipped through (#2708)
• Quoted /dev/null redirection targets such as 2>"/dev/null" are now classified as null redirections instead of redirection-write, so the approval card shows the correct reason (#2710)
• SysOM endpoint resolution now prefers a reachable in-VPC proxy, so ECS instances without public egress can reach SysOM; explicit overrides via COSH_SYSOM_ENDPOINT or the sysom_endpoint config keep the system proxy (#3188)
• Medium-risk tool requests whose names merely contain HOOK: as a substring are no longer misclassified as Hook requests, so the approval card offers the standard actions instead of the Hook action set (#3248)
• Valid token-plan credentials can again be saved through /auth when the gateway answers HTTP 400 on the model-retrieve route, while list-only providers still reject unverifiable credentials (#3276)
• zh-CN /help panel: the Registry group title is localized and the /agent summary wording corrected; en-US output is unchanged (#3363)
• RPM install/erase scriptlets now manage the /etc/shells entry safely: swapping between cosh-ng and copilot-shell no longer drops the login-shell registration the replacement still needs, updates are atomic and preserve file metadata, and install-time failures are reported instead of silent (#3367)

[0.24.1] — 2026-09-09

Fixed

• LLM token recording via agentsight broke silently when the Rust compiler version changed after the TLS library switch: cosh-core now exports a named probe symbol that agentsight attaches to by name, so capture stays stable across compiler upgrades (#3156)

[0.24.0] — 2026-09-08

Added

• In Enhanced Assisted Zsh sessions, slash-bearing, space-prefixed, and Han-leading path prompts are now routed to the Agent instead of falling through to the Zsh line editor, while ordinary shell input returns to Zsh unchanged once routing has been decided (#3004)
• The Tab key is handed back to the Zsh line editor before later typed input is processed, so custom Tab widgets keep working; retained input is replayed automatically without requiring another keypress, and user traps, key bindings, history, and prompt status are preserved (#3004)
• Default Bash Cosh sessions now include PATH additions from login profiles, so commands installed there are available in a new terminal; set COSH_SHELL_BOOTSTRAP_PATH=0 to disable this startup check (#3050)

Fixed

• Cookie headers assembled through braced shell parameter expansions (such as ${parameter#pattern}) are now recognized as sensitive data and kept out of native shell history; ambiguous nested syntax is redacted as a whole command (#3004)
• Zsh aliases and functions whose names contain slashes no longer get mistaken for missing filesystem paths and routed to the Agent; they continue to run in the shell (#3058)

[0.23.0] — 2026-09-02

Added

• The /hooks slash panel now lists individual shell hooks with their source and trust state, matching how agent hooks are displayed (#2999)

Changed

• cosh-ng no longer depends on the system OpenSSL runtime: HTTPS now runs on a pure-Rust TLS stack that still trusts the host OS certificate store, so Linux installs no longer require the openssl-libs / openssl1.1 system packages and source builds succeed on macOS without OpenSSL headers (#3030)

Fixed

• Secret redaction now respects word boundaries: ordinary text such as sk-hynix or npm_package_version stays visible in local evidence, while short credentials next to CJK text and structured Cookie/Bearer/JWT forms are consistently kept out of native shell history and redacted from journals, no matter which shell or entry path produced the output (#2996)

[0.22.3] — 2026-08-31

Fixed

• A damaged or unterminated terminal control sequence no longer hides subsequent terminal output or blocks command-boundary detection: oversized fragments are discarded and parsing resumes at the next valid marker (#2967)
• Installing the prebuilt cosh-ng package now works on newer distributions such as Ubuntu 24.04: the portable artifact bundles its own OpenSSL instead of requiring the OpenSSL 1.1 runtime that newer systems no longer ship (#2982)
• Natural-language prompts that are deliberately kept out of Bash history are now recalled and re-submitted with their exact original text instead of falling through to the shell or disappearing from history recall; leftover fragments from wrapped hint lines no longer linger on the next prompt (#2983)
• An unknown command entered right after a successful one still shows its failure insight: the command-not-found event is now attributed to the current input instead of being dropped (#2983)
• Prompt lines keep exactly one assisted marker after redraws caused by agent interactions, cancellations, or terminal width changes, instead of duplicating or dropping it (#2983)

[0.22.2] — 2026-08-28

Fixed

• Approved Bash tool commands handed off to the native shell now display the approved command itself instead of the internal wrapper line, including on Bash 4.4 terminals where fragmented redraws previously leaked that wrapper; execution, approval, history, and exit status are unchanged (#2949)
• Slash commands entered directly, recalled with Up-arrow, or typed on narrow terminals now appear exactly once in the terminal before their result panel again, while the internal guard line stays absent from terminal output, history, and logs; sensitive slash input is no longer expanded into Bash xtrace output (#2955)
• Natural-language prompts containing file paths that are routed to the Agent remain visible as a request notice even when the model's first response event is a tool call, so the original request no longer disappears from the screen; sensitive input is redacted as a whole field (#2953)
• An external interrupt signal sent to the shell process no longer leaves the parent terminal in raw mode: terminal settings are restored while the signal exit status is still reported to callers (#2968)

[0.22.1] — 2026-08-28

Fixed

• The internal builtin true __cosh_slash_guard__ sentinel line no longer appears in the terminal after an exact slash command in native Bash, including with verbose echo (set -v) enabled; slash routing, command execution, and history recall behave as before (#2943)
• Input that arrives pasted or piped in one batch together with a running command is no longer misrouted: slash-looking lines inside such a batch are delivered to the shell byte-for-byte instead of being intercepted as slash commands, keeping scripted pipelines intact (#2938)
• Command tracking and working-directory reporting keep working in directories whose names contain control characters, instead of dropping shell events (#2938)
• Headless one-shot runs with a prompt argument no longer hang for hours when an approval request goes unanswered: the request times out after 30 seconds and the run exits with a clear timeout error and a non-zero exit code (#2941)

[0.22.0] — 2026-08-27

Added

• Enhanced Assisted mode no longer relies on a global Bash DEBUG trap or forced tracing options; user-defined traps, shell options, and prompt hooks are preserved, and slash-command handoffs keep normal interactive shell semantics (#2832)
• System extensions installed outside the package-managed root (e.g. under /usr/local/share/anolisa/extensions) are now discovered automatically, so raw-installed sec-core and tokenless extensions load without a separate enable step; conflicting duplicate system installs stay disabled unless an exact source selection is persisted (#2909)

Fixed

• With xtrace enabled, cosh's internal hook activity no longer appears in the trace, so dynamic marker, working-directory, and environment data are not exposed; user commands and user-defined hooks keep producing trace output as before (#2914)
• Slash-bearing Han prompts such as 打开./missing/SKILL.md are routed to the Agent again instead of failing as a shell path, and the Agent now receives the correct prompt-time working directory, including after cd (#2918)
• Slash commands entered in the interactive shell are now persisted in Bash history so Up-arrow recall retrieves them correctly instead of an older command (#2917)

[0.21.1] — 2026-08-26

Fixed

• Registry slash commands such as /skills list, /hooks, and /extensions now discover project-level resources when no Agent turn has run yet and the process working directory differs from the shell cwd, e.g. after cd or daemon-style startup (#2686)
• Shell commands that produce very large output no longer exhaust memory: output is capped at 32 MB, oversized commands are stopped automatically, and the Agent sees a truncation notice with the start of the output instead of a bare error; when a hook's output exceeds the cap, the affected command stays blocked (safe side) instead of the hook's decision being silently ignored (#2880)
• Gateway tasks now start correctly on hosts running systemd 255, where the packaged service previously failed at startup because one of its security hardening settings is incompatible with that systemd version; workspace isolation is unchanged: task files stay confined to the workspace, host files remain read-only, and daemon state stays private to the service (#2843)

[0.21.0] — 2026-08-25

Added

• Add Native shell integration (shell.integration = "native") for a hook-free shell and Enhanced Shell-only mode toggled with Shift+Tab, while keeping Enhanced Assisted as the default with visible prompt markers; slash commands, tool calls, permissions, and system notices now use distinct /, *, !, and · card prefixes so output ownership is visible at a glance (#2759)

[0.20.0] — 2026-08-24

Added

• Report anonymous operational telemetry directly to SLS when cosh-ng runs without the anolisa unified uploader; no user prompts, code, or conversation content is collected; opt out at any time by creating ~/.copilot-shell/telemetry_disabled (per-user) or /etc/anolisa/.telemetry_disabled (system-wide) (#2715)
• Bind the local Gateway task profile to a closed task-only-v1 manifest so mismatched Core/Gateway pairs are rejected before task input or side effects (#2728)

Fixed

• Restore /usr/bin/cosh raw <adapter> to launch the TUI instead of failing with exit 127 after the transparency classifier misrouted the raw subcommand to bash (#2743)
• Route Han-leading natural-language prompts containing simple parameter references such as $HOME to the Agent, while keeping executable shell structures native so an intercept cannot alter adjacent command execution (#2746)
• Preserve the DEBUG trap across prompts on bash 4.2.x so command audit markers keep emitting after the first command (#2757)

[0.19.0] — 2026-08-21

Added

• Add a local gateway control plane with durable Task scheduling, runtime leases, and crash recovery, exposed through cosh agent task ... commands (#2603)
• Add direct ACP entrypoints cosh agent doctor and cosh agent run to verify and drive locally installed ACP adapters from outside the interactive Shell, with a once-only permission flow that prompts only on the local controlling terminal and records redacted evidence (#2603)

Fixed

• Detect system() calls in awk programs even when whitespace or line continuations appear before the opening parenthesis (#2655)
• Map missing precmd status markers to -1 instead of fabricating exit 0, preserving ledger integrity for interrupted or forged markers (#2709)

[0.18.0] — 2026-08-20

Added

• Cap in-memory transcript growth in long-running interactive sessions by keeping bounded working windows while spooling full terminal output to session files (#2682)
• Enable MCP tools that require long-running task augmentation, returning actionable errors when tasks fail or time out (#2645)

Changed

• BREAKING: /usr/bin/cosh now forwards non-TUI invocations directly to the configured shell; cosh --version, cosh --help, and cosh <script> outside an interactive terminal behave like the shell rather than opening the cosh TUI (#2625)

Fixed

• In trust approval mode under the cosh-core driver, hook-blocked shell commands can no longer execute through the staging grace window (#2125)
• Approval decisions are now resolved correctly when an external component has already logged the initial request (#2402)
• Approving a hook-rewritten shell command no longer fails with "could not route this approval" when another request in the same batch was refused (#2667)
• Audit logs now include a paired cancellation resolution when a pending turn extension is superseded, instead of leaving an orphaned request entry (#2695)

[0.17.2] — 2026-08-19

Fixed

• Cap run_command output at 32 MB to prevent out-of-memory kills from runaway commands such as dd if=/dev/zero or yes; when stdout or stderr exceeds the limit, the process group is killed and an OutputTooLarge error is returned instead of growing unbounded (#2405)
• Make RPM %post /etc/shells registration idempotent by normalizing content and probing before appending, and add a %preun scriptlet that fails closed when users still reference /usr/bin/cosh as their login shell, preventing dangling shells after rpm -e cosh-ng (#2599)

[0.17.1] — 2026-08-18

Fixed

• Reduce interactive echo latency from p50 20 ms to sub-millisecond and eliminate high-frequency idle CPU polling in long-running sessions by making the raw relay and SIGINT paths event-driven (#2622)
• Keep allowed commands executing when best-effort audit storage writes fail (#2631)
• Allow approved pipelines whose single-quoted arguments contain quoted newlines, such as multi-line jq or awk scripts (#2638)

[0.17.0] — 2026-08-17

Added

• Interactive disambiguation panel for /hooks enable|disable <id> when the hook id exists in both shell and agent layers, letting users choose to toggle the shell hook, the agent hook, or both (#2400)

Changed

• Skip redundant history processing during idle polling so long-running interactive sessions no longer repeat history-sized work while idle (#2546)

Fixed

• Reject hook output with an explicit "decision": null as invalid hook output: the tool call is blocked by default, or passes through with a recorded hook_failure notice when the hook sets fail_open = true; emitting {} remains valid pass-through (#2529)
• Report cosh pkg install/remove --dry-run success on dnf-based systems instead of returning a backend error for installable or removable packages (#2605)

[0.16.1] — 2026-08-14

Fixed

• Improve CJK text wrapping so East Asian characters fill the full terminal line width and punctuation stays attached to adjacent text (#2446)
• Validate credentials, endpoints, and models before persisting /auth changes, keeping the auth panel open on failure (#2458)
• Treat empty successful output from extension hooks as valid instead of fail-closed (#2506)

[0.16.0] — 2026-08-13

Added

• Raw packaging interface for deterministic cosh-ng archives with cross-target build validation and portable macOS launchers (#2411)

Changed

• Converge cosh-core and cosh-shell runtime paths, unify Claude and Qwen provider drivers, and add explicit shell/core protocol v1 negotiation with legacy fallback (#2403)
• Remove deprecated /draft slash command alias in favor of /agent (#2441)

Fixed

• Use monotonic clock for input-wait timing to avoid clock-skew stalls (#2176)
• Fix panel-family hint card rendering (#2196)
• Decode SSE events per spec and fail loud on malformed input (#2209)
• Confine and guard sensitive file writes across core (#2211, #2378)
• Pass raw prompt text through core and shell without normalization (#2256)
• Fix review marker activation on Enter key (#2274)
• Narrow interactive-cancel detection and pair ledger finish after correlated intercept (#2352, #2353)
• Send raw-mode disable to stdout on drop to prevent terminal state leaks (#2357)
• Harden hooks across core and shell (#2359)
• Avoid predictable temporary file paths (#2361)
• Enforce byte cap in line truncation branch (#2370)
• List all slash hint matches instead of first-only (#2410)
• Map missing failed exit code to -1 sentinel for consistent error reporting (#2412)
• Expose runtime context in core for consistent state access (#2428)

[0.15.0] — 2026-08-09

Fixed

• Restore hint cursor after inline hints in shell (#2172)
• Support ID_LIKE fallback for OS distribution detection (#2200)
• List hook commands in /help output (#2208)
• Skip audit logs for service lifecycle actions (#2213)
• Support macOS-specific file reads in core (#2220)
• Serialize handoff state to prevent race conditions (#2226)
• Normalize apt search glob patterns (#2227)
• Recover context budget after compaction in core (#2244)
• Deduplicate hook notices in shell (#2259)

[0.14.0] — 2026-08-04

Added

• /status, /about, and /stats slash commands for runtime introspection (#1778)
• /mcp slash command for MCP server management (#1949)
• /session list --all to enumerate sessions across workspaces (#2139)
• DashScope prompt cache support to reduce token cost (#2046)
• cached_tokens observability for cache-hit diagnostics (#2075)
• Dynamic max_tokens by model in the OpenAI provider (#2165)
• Advertise roots capability in MCP client initialization (#2007)
• Hook tools and environment support in core (#1894)
• Surface tool-argument status and cap retries across core and shell (#1925)
• Auto-execute fully readonly compound commands in shell (#1959)
• Extend capped runs across core and shell (#2035)
• Improved auth menu across core and shell (#2062)
• Bound agent handoff input-waits in shell (#2168)

Changed

• Terminal-agnostic multi-line prompt entry in shell (#1947)

Fixed

• Shell handoff and hooks: preserve LLM input, drop stale handoff text, resume handoff fallback within a provider session, redact handoff evidence, close secret-redacted handoffs via one-time claim token, converge Han NL input ownership, route sensitive NL to agent, and run project hooks for send-to-shell (#1955, #2010, #2055, #2074, #2130, #2137, #2151, #2154)
• Approval lifecycle: guarantee terminal state with lifecycle ledger and last-resort timeout, rearm auth input, surface sandbox-bypass approval in trust mode, and reject zero idle timeout (#1934, #1939, #1968, #2116)
• Auth flows: step /auth back on ESC, list /auth in /help, and hint /auth on noauth startup (#1891, #1906, #2166)
• Slash command and prompt input: prevent slash echo duplication on intercept, let Up recall slash commands, intercept slash-bearing NL prompts, support soft newline in NL prompts, keep card submit type-ahead, normalize CSI-u backspace, and key ghost ownership by route (#1868, #1899, #1911, #1922, #1942, #1993, #2167)
• Shell rendering: stop extdebug leak into prompt hooks, highlight code-block syntax, reply in user language, compact skills list, and disable implicit pagers (#1849, #1904, #1910, #1921, #1998)
• Command risk and safety: assess all compound-command segments for risk, gate irrecoverable system-control commands, and classify interpreter risk (#1905, #2081, #2119)
• File IO hardening: reject placeholder writes, make file writes atomic, bound and confine read tools, restore blocking before drop-write, and treat fd-dup redirect as non-write (#1918, #2069, #2120, #2121, #2124, #2127)
• Shell recovery and drift: prevent recovery storms and use zsh preexec $3 for drift (#2072, #2073)
• Audit logging: show hook context (#2082)
• Core runtime: preserve tool arguments, align compaction, show real session prompt, fail closed on emit error, and make truncation UTF-8-safe (#1844, #1847, #2003, #2005, #2118)
• Types, wire, and packaging: fix wire errors, drop cross-workspace dev-dep, align RPM identity, align bundle health checks, and add base-dir hint in skill tool (#1514, #1933, #1937, #1984, #2140)

[0.13.0] — 2026-07-26

Added

• Interactive session recovery via /session, /resume, and the --resume launch option (#1546, #1592)
• Workspace-scoped session persistence with schema versioning and legacy-session migration (#1546, #1592)
• MCP tool support for extensible agent capabilities (#1530)
• Contextual shell insight interactions (#1537)
• Secret redaction across core and shell layers (#1555)
• Diagnostic bundle export via cosh doctor (#1576, #1597)
• Extension platform in core and shell (#1583)
• Personalized prompt recommendations (#1606)
• Session compaction to manage persistence growth (#1668)
• PostToolUse response replacement and hook adaptation (#1669)
• Gated startup suggestions (#1671)
• Audit logging across core and shell (#1679)
• Improved session UX with slash command refinements and sysom /auth shortcut (#1726, #1813)
• Route unresolved natural-language input to Agent (#1742)
• Cancel active agent runs with ESC (#1761)
• Turn-scope batch approval consent (#1825)

Changed

• Revert persisted credential encryption (#1748)
• Align task scope documentation (#1445)
• Stabilize core and shell test gates (#1699)
• Speed up raw CLI tests and fake stream pacing (#1797)
• Track cosh-shell test inventory at 2469 (#1827)

Fixed

• Session command parsing, signal exits, slash argument handling, and prompt ghost ESC (#1632, #1634, #1636, #1663, #1724, #1843)
• Agent question interaction, suggestion controls, recommendation scopes, and tab redraw (#1725, #1741, #1749, #1758, #1821)
• Approval card layout, blocked-title alignment, and empty enter handling (#1786, #1788, #1838)
• Auth and trust hardening: validate providers, harden auth, preserve trust blocks, encrypt credentials, and expand paths (#1627, #1673, #1701, #1722, #1777, #1784, #1791, #1809, #1816, #1841)
• Audit logging fixes: kill trees, split compound commands, redact secrets, scope claims, and preserve export path (#1611, #1613, #1635, #1765, #1772, #1840, #1842)
• Core runtime stability: JSONL validation, tool selection errors, streamed state, ai-like tables, revision clock, free-text clearing, layout gates, and SysOM terminator (#1599, #1661, #1689, #1730, #1731, #1799, #1800, #1803, #1839)
• Platform and CLI correctness: honor dry-run, handle skipped checkpoints, allow search patterns, fix package dry-run/search results, respect cargo config, sync Bash HISTFILE, validate workspace paths, route --help to stdout, add skill arg checks, warn on redacted writes, skip DEBUG trap, restore utility tools, stop BASHOPTS extdebug leak, handle null redirection, keep provider handoffs alive, update DashScope URL, raw action relay watchdog, restore startup health row, hide receipt audit ref, and update test inventory baseline (#1426, #1440, #1633, #1637, #1642, #1646, #1672, #1675, #1676, #1710, #1719, #1733, #1783, #1787, #1790, #1795, #1808, #1812, #1818, #1820, #1845)

[0.12.0] — 2026-07-12

Added

• Move authentication ownership into cosh-core with isolated config layers (f028ad90)

Changed

• Consolidate logging under a unified runtime module (db86b3dd)
• Migrate component docs into user-guide/developer-guide and add cosh-ng docs (317d3f26, adf63ac2)
• Rename *_CN.md docs to *_zh.md and fix cross-references (82f8dab4)

Fixed

• Honor svc dry-run across platform and cli (4c593050)
• Preserve manual aliyun fallback and legacy STS auth (924dd76b, ee1dd179)
• Protect auth provider edits; prioritize aliyun auth option (f0c97efa, 904655fb)
• Bound host-executed shell preview (a6da7301)
• Route noninteractive cosh launcher calls; support raw command passthrough (ecb56739, 1490eb3c)
• Bind startup prompt and agent request context (14d6336f, 25d9d28f)
• Own prompt boundary in shell (#1310)
• Avoid UTF-8 split in loop detection (ef7f5147)
• Remove provider-visible skill hints; guide diagnostic skill use (a6024873, 7f695178)
• Drop redundant format borrow; satisfy clippy diagnostics (5e14a686, 063217f1)
• Stabilize CI, raw-cli, PTY, and service tests (d573796d, 3563a5ab, 0fb34ea6, fc28da5f, ad138d45, 65421d25, 5b17b892, 3e43ba6e, 707bc3c0)

[0.11.0] — 2026-06-28

Added

• Aliyun authentication provider with ECS auto-detection, STS credentials, and QR code flow
• SysOM Aliyun provider with ACS3 signing for LLM API access
• Per-turn SLS JSONL logging for observability
• SysOM request source identification headers
• Structured tracing logging system across all crates
• Sandbox bypass approval flow on PostToolUseFailure hook events
• Startup health scan for environment diagnostics
• Extension/hook/skill enable/disable commands (/extensions, /hooks, /skills)
• Unified component state management module
• Dedicated HOOK approval panel with simplified UI
• UserPromptSubmit hook with Ask approval enforcement
• Shell evidence read admission control in cosh-core
• Tool activity rendering in cosh-shell
• cosh-switch hint in startup banner for toggling between cosh-ng and copilot-shell

Changed

• BREAKING: Rename CLI binary from cosh to cosh-cli; remove dispatch_core
• RPM spec: install cosh-cli binary, /usr/bin/cosh launcher, cosh-switch script, Conflicts: copilot-shell
• Replace eprintln with structured tracing macros
• Unify hook decision aggregation with fold_decision
• Update workspace repository URL to github.com/alibaba/anolisa

Fixed

• Auth ECS flow and panel overlap on phase transitions
• Auth QR code rendered without ANSI escape codes
• Use SysomProvider for aliyun after auth success
• Align hook input fields and AfterModel/wrap_tool_response with copilot-shell protocol
• tool_result dedup guard and visibility
• Restore prompt before shell handoff
• Suppress duplicate evidence reads
• Reduce failed-command auto analysis noise
• Skill existence check and harden approval matching
• Resolve clippy warnings across cosh-core and cosh-shell

[0.10.0] — 2026-06-23

Added

• Shell evidence protocol for capturing and replaying command execution context
• Shell evidence control tool in cosh-core for evidence lifecycle management
• Hook protocol aligned with copilot-shell for zero-change extension support
• Per-hook decision propagation through notification protocol
• Hook warnings rendered with per-hook decision color-coding in cosh-shell

Changed

• Share agent error display text across cosh-shell modules

Tests

• Cover shell evidence raw CLI flows

[0.9.0] — 2026-06-22

Added

• Hook notifications integrated into approval panel with ⚠ warning display
• Hook ask decisions enforce user approval even in Trust/Auto modes
• Extended hook system with tool_use_id association and new event types
• Registry protocol for /extensions /skills /hooks slash commands

Fixed

• Show Registry group in /help output

Changed

• Remove dead skill management code

[0.8.0] — 2026-06-18

Changed

• Rename cosh-tui crate and binary to cosh-core across the entire workspace
• Update adapter system: CoshTuiAdapter → CoshCoreAdapter, AdapterKind::CoshTui → CoshCore
• Update environment variable COSH_TUI_PATH → COSH_CORE_PATH
• Update RPM spec, documentation, and all test fixtures

Fixed

• Neutralize agent status text in streaming cards
• Align streaming card widths in cosh-shell

[0.7.0] — 2026-06-17

Added

• Extension discovery and loading module with cosh-extension.json manifest support
• Extension hooks integrated into startup lifecycle
• Skill module with multi-level loading (built-in, user, project) and hot-reload
• SkillManager integrated into tool registry and startup
• Available skills injected into system prompt for LLM discovery

Fixed

• Infinite loop in expand_env_vars when environment variable is undefined
• Warn on unsupported extension hook events (PostToolUseFailure, BeforeModel, AfterModel) instead of silently discarding
• Align extension hooks format with copilot-shell nested group structure
• Remove unused args parameter from skill tool schema to avoid misleading LLM
• Show question free text answers in cosh-shell
• Harden foreground shell handoffs
• Share copilot shell config path and keep legacy config fallback

Changed

• Normalize cosh-shell config keys
• Standardize cosh-shell code and test organization
• Move user state under copilot shell scope

[0.6.0] — 2026-06-16

Added

• P0 hook system with 5 lifecycle events (on_session_start, on_turn_start, on_turn_end, on_tool_call, on_session_end) in cosh-tui
• Shell approval classification and hook origin tracking in cosh-shell
• Migrate current cosh shell into monorepo workspace

Fixed

• Address approval review findings in cosh-shell
• Harden shell evidence continuation to prevent dropped context
• Normalize tool call streaming protocol in cosh-tui
• Fix passthrough for subcommands in cosh-shell

[0.5.0] — 2026-06-15

Added

• CoshTuiAdapter persistent process mode (spawn once, reuse across agent runs, auto-restart on death)
• ask_user round-trip through control protocol (agent can ask inline questions routed to TUI)

Changed

• Split cosh-tui main into cli/headless/interactive modules
• Rename binary from cosh-tui-core back to cosh-tui

[0.4.1] — 2026-06-15

Added

• settings.json → config.toml auto-migration with AES-256-GCM encrypted API key decryption
• JSONL protocol and tool approval integration tests

Fixed

• Prepend precmd in PROMPT_COMMAND to capture real exit code (Alibaba Cloud Linux /etc/bashrc issue)

[0.4.0] — 2026-06-15

Added

• JSONL wire protocol (InputMessage / OutputMessage) for cosh-shell ↔ cosh-tui communication
• Provider abstraction with OpenAI-compatible streaming (DashScope, OpenAI, DeepSeek, Generic profiles)
• Tool execution framework with 7 built-in tools (shell, read_file, write_file, edit, grep, todo, skill) and approval control
• Context window management, message truncation, loop detection, conversation compression
• Lifecycle hooks framework
• CoshCore agent loop engine
• TOML-based multi-provider config with environment variable expansion

Changed

• BREAKING: Binary interface from ratatui interactive TUI to JSONL stdin/stdout backend
• BREAKING: Config format from settings.json to config.toml
• Rewrite session store with single-file JSON persistence

Removed

• Legacy ratatui-based TUI code (app, commands, llm, logger, theme, tools, ui modules)

[0.3.0] — 2026-06-15

Added

• cosh-shell crate — PTY-based AI-augmented shell host with OSC marker protocol
• Claude, Qwen, Fake AI adapters with streaming support
• Inline rendering engine (approval, question, recommendation, activity panels)
• Governance layer with approval modes
• Terminal recovery via signal handlers (SIGTERM/SIGHUP/SIGQUIT) and panic hook
• Exit code classification with 8 categories (Smart/Auto/Manual analysis modes)
• Tool display engine with per-tool-type parsing and ANSI color categories
• Hook engine with built-in hooks (FailedCommandHook, TestFailureHook) and skill routing
• External hook loading from ~/.config/cosh/hooks/ with subprocess execution
• Native shell compatibility (rcfile loading, PS1, history, login shell detection)
• Context window with sliding window (max commands, max age, token budget)
• Prompt intent optimization (do → Bash tool, know → prose)
• Natural language intercept with visual feedback
• InputClassifier conservative mode for native mode
• Analysis throttle (30s cooldown, max 3 consecutive)
• Consultation card rendering with keyboard capture
• Control protocol for tool approval round-trips
• Startup banner with gradient ASCII art logo
• /mode and /hooks slash commands
• Architecture documentation

Fixed

• Native mode input rendering with powerlevel10k dual-line prompts
• Slash/NL intercept via buffered-then-judge strategy in native mode
• Zsh preexec intercept for command_not_found
• CandidateRedraw line clearing for CJK input and backspace
• Suppress cosh-osc$ prompt leak in native mode
• Tool display label matching in bash tool executor
• Wide character placeholder cell handling in buffer extraction

Changed

• Unified workspace version (0.3.0) for all crates (cosh-types, cosh-platform, cosh-cli, cosh-shell, cosh-tui)

[0.2.0] - 2026-05-16

Hardening + audit-subsystem release. Workspace versions bumped to 0.2.0 together with the release profile and lockfile commit.

Added

• audit subsystem with PEP/PDP/log split: cosh audit check / cosh audit log for command-safety gating and per-session retrieval.
• Workspace release profile (opt-level = 3, lto = true, strip = true, codegen-units = 1), committed Cargo.lock, workspace-level dependency pinning, and native CA cert support.
• Command timeouts, input validation, and panic-safe JSON output across cosh-cli and cosh-platform so a panic still emits a CoshResponse envelope on stderr instead of an empty exit.
• forbid(unsafe_code) on cosh-cli / cosh-platform, plus svc list --state filter validation against an allow-list.
• pkg search cross-references installed status so results show which matches are already installed.
• ResponseMeta.warning field for non-fatal warnings; audit responses are explicitly marked as stub via this field.
• LLM tool surface expansion in cosh-tui: pkg / svc / checkpoint wrapper tools, plus svc enable / svc disable --dry-run.
• Timeouts + exponential-backoff retries on LLM and external command tools in cosh-tui; 60 s shell-tool timeout.

Changed

• TUI /help aligned with the full command set; title bar version and markdown prefix stripping corrected.
• Clippy warnings resolved across the workspace; dead-code allowances dropped; test code aligned with production lint level.
• Build warnings eliminated and version detection improved across cosh-tui / cosh-platform.

Fixed

• Shell safety check tokenized to close tab / newline / redirect / chain bypasses; substring matching on raw command strings replaced with whitespace (incl. \t / \n / \r) tokenization and metacharacter rejection (; | & > < $ ` ( ) { }) — is_safe_command in crates/cosh-tui/src/tools/shell.rs.
• Forbidden tool calls are now blocked even under Yolo approval mode.
• cosh-cli wrapper tool output is bounded so a chatty subcommand cannot blow the LLM context window.
• Tool-call IDs synthesized via a process-wide counter to guarantee uniqueness across the agentic loop.
• settings.json and session files written atomically with 0600 permissions.
• Runtime bounds enforced for the agentic loop, history, config, and tool messages; scrollback bounded with UTF-8-safe truncation.
• Panic hook installed in the TUI; history navigation recovered after panic.
• ws-ckpt IPC response size bounded to 64 MiB.
• Nonexistent systemd services detected via LoadState=not-found instead of misclassifying them as "inactive".

Security

• Audit-stub recoverable / hint semantics surface clearly to agents via the standard CoshError envelope.
• Atomic-rename + 0600 perms on credential-bearing files.

[0.1.0] - 2026-05-10

Initial public-shaped release after renaming the workspace from agos-core to cosh-ng and adding the interactive TUI crate.

Added

• 4-crate workspace: cosh-types, cosh-platform, cosh-cli, cosh-tui with strict dependency direction cosh-cli / cosh-tui → cosh-platform → cosh-types.
• cosh CLI binary with dual-mode dispatch: cosh (no args) execs into cosh-tui, cosh <subsystem> <action> returns structured JSON.
• Cross-distro pkg subsystem: install / remove / search / list routed across dnf / apt-get (apt-cache for search) / zypper based on Distro::detect() reading /etc/os-release.
• svc subsystem over systemctl: status / start / stop / restart / enable / disable / list, with uptime and corrected column mapping in list.
• checkpoint subsystem talking to the ws-ckpt daemon over Unix-socket IPC; bincode wire format with 4-byte LE length prefix and explicit protocol versioning + error handling. Commands: init / create / list / restore / recover / delete / diff / cleanup / status.
• cosh-tui interactive TUI on ratatui + crossterm: slash-command system with auto-complete, session management, theming, custom border set, echo-on-submit.
• Agentic loop with cosh-cli wrapper tools in cosh-tui, bringing pkg / svc / checkpoint tooling to the LLM (initially shipped as cosh-tui v0.4.0).
• LLM chat integration with config-driven providers and UI surfacing.
• Unified settings.json V2 config consolidating prior scattered config files.
• AES-256-GCM decryption for encrypted credentials.
• macOS detection + Homebrew backend in cosh-platform, with unit tests.
• Unified JSON envelope CoshResponse<T> with ok / data / error / meta, classified CoshError carrying recoverable and hint for agent retry decisions.
• Integration tests for pkg and checkpoint CLI commands.

Changed

• Workspace renamed from agos-core (with agos-types / agos-platform / agos-cli) to cosh-ng (with cosh-* crates); agos-cli and agos-platform removed in the same commit.
• cosh-tui checkpoint tooling adapted to the new daemon protocol.

Fixed

• cosh-cli stdout validated as JSON before forwarding to the LLM, preventing parser confusion on malformed bytes.

[pre-0.1.0] - 2026-05-03 → 2026-05-08

Pre-rename agos-core foundation.

Added

• Initial 2-crate workspace agos-types + agos-platform.
• agos-cli cross-distro CLI prototype with pkg, svc, checkpoint, audit command shapes.
• MVP v2 CLI Gateway architecture document and bilingual (English / Chinese) usage guide.

Changelog

All notable changes to ktuner are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Added

• Initial kernel-tuning engine: check/tune/fix/why/rollback commands evaluate 207 rules and output structured JSON tuning recommendations.

Changelog

All notable changes to OS Skills are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[0.6.3] - 2026-08-21

Fixed

• The RPM now provides anolisa-component(os-skills), allowing anolisa upgrade to resolve the OS Skills package from RPM metadata for an existing component when the repository-side component index is unavailable (#2576).

[0.6.2] - 2026-08-07

• Added the ktuner skill for deterministic kernel diagnosis, tuning, and rollback. (#1278)
• Removed legacy OpenClaw and Hermes adapter scripts from source and RPM installs. (#1172)
• Updated anolisa-guide with authenticated Skill Ledger recovery and tamper detection. (#2185)

[0.6.1] - 2026-07-03

• Rewrote sysom-diagnosis skill and removed legacy CLI. (#1241)
• Fixed OpenClaw gateway write scope verification in install-openclaw skill. (#1205)

[0.6.0] - 2026-06-29

• Added anolisa component contract (component.toml, Makefile, RPM spec). (#1159)
• Added OpenClaw bootstrap guidance to install-openclaw skill. (#1051)
• Added model endpoint preflight before gateway startup in install-openclaw skill. (#1031)
• Added static knowledge base update script for anolisa-guide skill. (#1010)
• Added anolisa-guide skill. (#849)
• Fixed Aliyun mirror fallback for uv and qwenpaw install. (#968)
• Fixed dashscope proxy URL to new Anthropic endpoint in install-claude-code skill. (#858)
• Renamed copaw to qwenpaw across os-skills. (#968)

[0.5.0] - 2026-06-11

• Added anolisa-register skill. (#829)

[0.4.0] - 2026-06-08

• Added auto-install tokenless plugin support for agent install skills. (#731)
• Added OpenClaw dependency precheck. (#719)
• Improved OpenClaw non-interactive setup. (#687)
• Added Hermes adapter runner. (#617)
• Added standalone ANOLISA adapter entry. (#549)
• Fixed OpenClaw state dir handling normalization. (#641)
• Improved Makefile install paths and contract. (#541)

[0.3.0] - 2026-04-26

• Added hermes-agent-install skill. (#353)
• Added clawhub-skill-mng skill with npm install support and YAML description matching. (#315)
• Fixed AgentSight custom db path issue, using default paths instead. (#366)
• Fixed AgentSight token savings query support. (#355)
• Fixed AgentSight interruption CLI and aligned conversation_id naming. (#334)

[0.2.2] - 2026-04-15

• Support enable AgentSight dashboard in agentsight skill. (#222)

[0.2.1] - 2026-04-14

• Upgraded xlsx skill with MiniMax open-source implementation. (#218)
• Updated skill descriptions from "suitable for alinux4" to "rpm-base linux". (#182)

[0.2] - 2026-04-12

• Added humanizer, image-gen, pdf-reader, and xlsx skills. (#178)
• Added cosh-guide skill. (#23)
• Support net/io/load diagnostic capabilities to sysom-diagnosis skill. (#163)

Changelog

All notable changes to SkillFS are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[0.5.0] - 2026-09-20

Added

• skillfs mount --config mount.toml now combines ordered skill sources in one mount. Earlier sources win whole skill directories; multi-source mounts are read-only and require remounting after configuration changes or adding or removing skills (#3200).
• An optional Kubernetes deployment seeds read-only skill packages into a private writable source for Ledger scanning and activation. The new --read-only option prevents writes through the agent-visible mount; missing or invalid activation keeps skills hidden (#3182).

Changed

• Both Debian and Alibaba Cloud Linux 4 sidecar images now supervise real FUSE reads and attempt remounts after repeated failures, with bounded retries. Workloads must reopen failed handles after recovery (#2701).
• Read-only transformed SKILL.md handles now retain their captured content across source edits, while new opens read the updated content. A bounded cache reuses transformation results across attribute queries and opens. Separately, new captured handles that would exceed the mount-wide 64 MiB or 1,024-handle budget fail to open with ENOMEM; closing captured handles frees capacity (#3202).

[0.4.2] - 2026-08-27

Added

• An optional Alibaba Cloud Linux 4 sidecar image now provides a reproducible alternative to the existing Debian image, with bilingual guidance for building and operating both variants (#2777, #2787).

Fixed

• Startup reconciliation now retries transient notify-daemon endpoint failures with bounded backoff, allowing hidden skills to converge automatically when the daemon starts late or restarts (#2790).
• Flat normal-mode mounts now resolve categorized skills through their stored physical directories, so writes, truncation, renames, and synchronization no longer fail with ENOENT (#2901).

[0.4.1] - 2026-08-21

Added

• A Kubernetes sidecar deployment now lets a privileged SkillFS container expose its FUSE view to a non-privileged workload, including readable paths advertised by skill-discover (#2057).
• Optional mutual HMAC-SHA256 authentication now protects control and notify sockets across container namespaces through --trusted-peer-key-file and --notify-auth-key-file, while existing host authentication remains unchanged (#2449).

Changed

• The reference Kubernetes deployment now marks the Pod unready after one failed FUSE read and restarts only the SkillFS sidecar after two liveness failures, allowing workloads to recover without restarting (#2705).

Fixed

• Nested Hermes skills can now update activation state through the control socket with layout-relative identifiers such as category/skill (#2407).
• Activation metadata permissions, in-place backing aliases, and control listener startup now fail closed instead of exposing metadata, accepting an unsafe source, or leaving an unusable endpoint (#2407).
• The bundled skillfs-mount skill now names the shipped analysis scripts and accurately describes managed mounts and writable source behavior (#1798).

[0.4.0] - 2026-07-24

Added

• Configurable read-time transforms now keep directive compilation enabled by default and add an opt-in OS adapter with bundled Ubuntu/Alinux rules and external catalog overrides (#1484).
• An authenticated live-source resolver and notify v2 protocol now give Skill Ledger canonical flat or Hermes skill identities, event kinds, and changed paths without exposing backing-root details (#1517).

Changed

• Agent-visible access checks now follow activated snapshot permissions while live-source permissions continue to govern writes (#1517).

Fixed

• SLS telemetry writers now honor /etc/anolisa/.telemetry_disabled dynamically and fail closed when the gate cannot be inspected (#1584).
• Hermes symlink boundaries, resolver paths, socket ownership, and peer authentication now fail closed across discovery, reads, and mutations (#1517).
• Control-socket prerequisite diagnostics now consistently include the public --control-socket flag name (#1739).

[0.3.4] - 2026-07-16

Fixed

• SLS ops logging now preserves exactly one command record when CLI output pipes close early and panic unwinds.

[0.3.3] - 2026-07-10

Added

• Hermes workspace layout compatibility. SkillFS now recognizes Hermes hub markers, preserves management paths, and exposes nested category/skill/SKILL.md skills alongside top-level skills.
• Nested Hermes skills now support activation state, installer lifecycle writes, notifications, audit attribution, fallback snapshots, and hidden visibility.

Fixed

• skillfs validate --json now includes source paths for warning and error entries so automation can locate invalid skills.
• FUSE teardown now bounds failed unmount cleanup and prevents leaked test mounts from affecting later sessions.

[0.3.2] - 2026-07-03

Fixed

• CLI SLS ops logging now records SkillFS mount and runtime operations.
• Runtime metrics now emit real-time deltas for SLS consumers.

[0.3.1] - 2026-07-03

Added

• Managed mount supervision can recover stale FUSE mounts and bound recovery retries during repeated starts.

Changed

• English and Chinese README guidance now covers managed mounts, in-place operation, security boundaries, and troubleshooting.

Fixed

• Post-publish grace reads fallback skill files from source paths after installers finish.
• skillfs validate now reports parse failures in the status summary.
• In-place authoring supports new skills and pending-install ownership changes.
• Managed stop and runtime-dir handling avoid stale ownership and unbounded recovery retries.
• Daemon-facing backing roots under PrivateTmp are rejected before mount startup.
• FUSE smoke cleanup handles leftover mounts and temporary paths more reliably.

[0.3.0] - 2026-06-26

Added

• Runtime security integration for agent skill directories. SkillFS can now consume activation decisions from .skill-meta/activation.json or the user.agent_sec.skill_ledger.activation xattr, then expose each skill as current, hidden, or a trusted fallback snapshot.
• File-change notification for external security daemons. With --activation-mode file, --notify-socket, --activation-events-log, and --activation-reload-mode poll, SkillFS reports skill mutations, reloads activation decisions, and keeps already-opened file handles pinned to their original target.
• Trusted control socket for activation writes. A daemon verified with SO_PEERCRED, executable identity, and start-time checks can update activation JSON or activation xattr through a bounded request API instead of writing .skill-meta through the agent-visible mount path.
• Installer compatibility for common skill installation flows. Staging directories, direct writes, quiet-timeout completion, and post-publish grace windows allow installers to finish writing a skill before SkillFS asks the security provider to scan and activate it.
• In-place mount support for security daemons. Ledger backing roots are bind mounted privately and validated at startup so scanners read the real source tree rather than the agent-facing FUSE view.
• Canonical skill identity based on the directory basename. Frontmatter name: remains display metadata and no longer changes the SkillFS store key or daemon-facing skill id.

Changed

• .skill-meta/** is hidden from ordinary agents and remains accessible only through trusted metadata paths or the control socket.
• Skill mutation notify uses ordinary filesystem event kinds, including create, write, rename, unlink, rmdir, and truncate events, instead of a separate install-complete protocol event.
• POSIX passthrough behavior was expanded for symlink, hardlink, FIFO, path length fallback, open-after-unlink, xattr, and inode consistency cases.

Fixed

• Prevented stale activation views by combining notify-triggered reload, polling, and activation watcher convergence.
• Hardened trusted-writer and trusted-peer checks against process reuse and executable replacement with start-time and file-identity validation.
• Avoided installer and daemon visibility bugs around hidden skills, fallback snapshots, staging paths, and backing-root propagation.

[0.2.0] - 2026-05-09

Added

• FUSE write passthrough for write, create, mkdir, rename, unlink, rmdir, and setattr(size) operations on skill directories.
• Background sync worker that reparses SKILL.md on write and upserts the entry back into SharedSkillStore.
• Immediate visibility for newly created skill directories: mkdir inserts a ParseStatus::Degraded placeholder, then the sync worker overwrites it with the real entry once SKILL.md is written.
• in-place mount mode that accesses the underlying source via /proc/self/fd/{n} to avoid the over-mount self-loop.
• Integration suite crates/skillfs-fuse/tests/write_guard_tests.rs covering both normal and in-place write paths.

Changed

• Directory name is now the authoritative store key. After rename, stale frontmatter name: no longer revives the old key.
• Read of SKILL.md still returns the compiled result; raw file is only used for writes and parsing.
• Architecture docs refactored into docs/specs/skillfs-spec.md, docs/specs/core-spec.md, docs/specs/fuse-spec.md.

Removed

• Workspace-related code paths and the unused workspace config support from skillfs-core (commit 6d604c7).
• Legacy ad-hoc test scripts (kept only scripts/build.sh and scripts/test.sh).

Fixed

• CLI tracing timestamps now use the local timezone instead of UTC.

[0.1.2] - 2026-04-29

Added

• Read-only mount write protection: mknod, symlink, link, and write callbacks all return EROFS.

Fixed

• Parser summary truncation now respects multi-byte character boundaries.

[0.1.1] - 2026-04-29

Added

• skillfs-mount agent skill under docs/skills/ to help users set up, mount, and unmount a SkillFS instance.

[0.1.0] - 2026-04-25

Added

• Initial release of the SkillFS workspace.
• skillfs-core: SKILL.md parser (with Ok / Degraded / Error status), in-memory SkillStore with flat and categorized directory layouts, skillfs-views.toml configuration, conditional compiler::compile, and environment probing (OS, commands, env vars).
• skillfs-fuse: read-only FUSE filesystem that exposes the configured default view at /skills, always-on virtual skill-discover, and compile-on-read for SKILL.md. Other files in a skill directory are passed through to the physical source.
• skillfs CLI: mount, classify, validate, list subcommands.

Changelog

All notable changes to Tokenless will be documented in this file.

Releases from 0.7.2 onward follow Keep a Changelog.

[Unreleased]

[0.8.4] - 2026-09-22

Added

• Add a standalone installer and an install-tokenless OS Skill entry point alongside npm installation. The installer chooses npm or a Linux-only source build before installation starts, records owned paths for uninstall, and restores the previous installation if replacement fails. Source builds install only the CLI; npm also provides RTK and adapters (#2322).

Changed

• npm installation now requires Node.js 16.7 or newer and preserves shared adapter resources owned by another installation. Users can explicitly replace them with ANOLISA_TOKENLESS_FORCE_ADAPTERS=1; otherwise, the installer reports the bundled adapter location (#2322).
• Standalone uninstall removes only resources still owned by its install receipt, preserves runtime data unless --purge is requested, and retains adapter resources when framework deregistration cannot be verified. Codex plugins listed as not installed are recognized as successfully removed, so repeated uninstall can complete (#2322, #3412).

Fixed

• HTML extraction now keeps command output after the page's </html> end tag, such as build logs and HTTP status codes, after the rendered page instead of losing it. Text that imitates the page wrapper is escaped, and original recovery remains available (#3386).
• HTML extraction no longer rejects shallow pages containing many self-closing SVG elements as excessively nested. Depth limits now follow the parsed page, and malformed markup or wide tables no longer trigger repeated scans that can delay tool results (#3396).

[0.8.3] - 2026-09-20

Added

• Git diff context cropping can now retain all changed lines and file metadata while reducing surrounding context, with the received original available through recovery. Enable it with TOKENLESS_DIFF_COMPRESSION_ENABLED=1 or SDK diff_compression_enabled=True; it is disabled by default and requires text replacement and recovery support (#3299).
• Complete HTML pages from command or API results can now be rendered as Markdown with original recovery and counts of removed page elements. Enable it with TOKENLESS_HTML_EXTRACTION_ENABLED=1 or SDK html_extraction_enabled=True; it is disabled by default, requires text replacement and recovery support, and preserves file reads, including HTML printed by shell file-reading commands (#3306).

Changed

• npm installation now automatically enables the Claude Code adapter when the Claude CLI is available, and prints retry instructions when registration cannot finish (#2193).
• QwenPaw installation now checks the matching SDK wheel before handing over the plugin bundle and reports a confirmed missing asset with its version and URL. Offline or mirrored installations can skip the probe with ANOLISA_SKIP_WHEEL_PREFLIGHT=1 (#3289).

Fixed

• Claude Code detection now retries a staged plugin within a bounded settling window with backoff, reducing false “not installed” results while the host registry catches up (#3272).
• Raw packages now declare and include the OpenCode adapter and adapter manifest, enabling ANOLISA to discover and manage the bundled plugin. Restart OpenCode after enabling or disabling it (#3324, #3346).

[0.8.2] - 2026-09-15

Added

• Supported search listings, including Claude Code native Grep results without context lines, now share consecutive file paths while retaining every received match, line number, and line ending. This lossless optimization is enabled by default and requires a text replacement slot; disable it with TOKENLESS_SEARCH_PATH_SHARING_ENABLED=0 or SDK search_path_sharing_enabled=False (#3173).

Changed

• Bundled RTK is upgraded to 0.49.0, with conservative pipeline rewriting and unchanged sudo commands. Direct rtk grep users must use --max-len and --max for RTK display limits: -l and -m now retain native grep meanings, and file-type filtering moves to rtk rg -t (#3273).
• Supported RTK filters now provide rtk recall HASH hints for retained failure or truncated output. Recovery storage is scoped to the host OS user, with limits and expiry; sessions sharing that user can access the same store. RTK recall and Tokenless Stash retrieval remain separate (#3273).

Fixed

• Cosh-NG and copilot-shell now correctly attribute failures carried inside JSON-encoded shell results under Protocol v2, preserving the original failed output and sending error details for diagnosis (#2238).
• Bundled RTK preserves pytest startup and fallback diagnostics, including when recovery storage is disabled, and keeps the no-tests summary alongside stderr (#3273).

[0.8.1] - 2026-09-09

Added

• CSV/TSV tool output can now preserve all cells through quoting and line-ending compaction, or reduce larger tables to boundary rows, diagnostic rows, and a representative sample when recovery is available. Reduced views identify omitted rows and provide byte-exact original retrieval; complete enumeration or calculations require the original table. File reads and hosts without a text replacement slot pass through unchanged (#3089).
• SLS records can now carry tokenless.trace_id and tokenless.span_id from TOKENLESS_TRACEPARENT or TRACEPARENT, so observability backends can correlate token savings with a host trace. The launching host or adapter must inject the context; without a usable value, records remain uncorrelated, and local stats.db data is unchanged (#3094).

Fixed

• Claude Code detection now briefly re-lists a staged plugin missing from the first successful registry scan, avoiding false “not installed” results immediately after installation (#3085).
• Hermes now skips trusted shared hook modules whose APIs or call signatures are incompatible with the adapter, tries later compatible candidates, and reports rejected candidates when none work. This prevents stale installations or cached modules from breaking lifecycle hooks (#2249).
• OpenClaw installation now accepts declared capabilities when the host supports that option and sends the unsafe-install flag only when the host advertises it as effective. Hosts marking it as a no-op receive no bypass flag, and rejected installs point operators to security.installPolicy (#3126, #3152).

[0.8.0] - 2026-09-06

Added

• Large JSON record arrays can now retain representative records, errors, unusual shapes, and numeric outliers under a 32-record base budget, with the complete collection available through Stash. Compact JSON and TOON candidates that save at least 15% take priority over record reduction (#3047).
• Recognized Cargo, pytest, npm/Jest, Go, Make/C, and generic build/test logs can now drop repeated routine progress while preserving diagnostics, summaries, phases, and stack traces. Supported build/test commands keep their native output for this compression, and omitted intervals remain retrievable when recovery is available (#3067).
• Cosh-NG, Claude Code, Qoder CLI, OpenCode, Hermes, and DeepSeek Harness can now recover omitted content through their existing shell tools. Successful standalone tokenless retrieve HASH results bypass further compression; recovery requires a reachable CLI and a host that can replace the current tool result, including Claude Code 2.1.121 or newer (#3052).
• A QwenPaw plugin now provides in-process schema compression, RTK command rewriting, response/TOON compression, and a static tokenless_retrieve tool. Installation selects the matching SDK wheel, and tools outside the supported built-in table pass through unchanged (#3075).

Changed

• Breaking: tokenless compress now accepts only Protocol v2 before_model, pre_tool, post_tool, and retrieve requests; Protocol v1 and tokenless mcp serve have been removed. Core, adapters, and custom callers must upgrade together, including the required explicit recovery capability (#2978, #3068).
• Breaking: Rust callers now use the Runtime lifecycle methods in place of TokenlessRuntime::compress. Direct response-compression callers must migrate from the removed tokenless-pipeline crate and tokenless_schema::ResponseCompressor to the Runtime or tokenless-compressors APIs (#2974, #2978).
• Breaking: The Python SDK now uses typed lifecycle requests with before_model, pre_tool, post_tool, and retrieve; the old ModelRequest, ToolCall, ToolResult, and ToolResponseCompressor APIs have been removed. AgentScope integrations require ToolContract metadata for custom tools and expose one static retrieval tool (#2986, #3029).
• Recovery instructions now name the available shell command or configured static tool and use a bare hash, so agents can choose the correct recovery action. Historical <<tokenless:HASH>> markers remain readable; custom retrieve_tool_name settings must satisfy the tool-name rules (#3068).
• Lifecycle schema compression now requires an authorized static recovery tool and an available Stash. Common BeforeModel hooks without that capability preserve the original schemas (#2978, #2995, #3029).
• Lifecycle compression now preserves declared file contents and results already optimized by RTK. Common hooks carry per-call optimization state, and hooks without a stable tool-call ID leave command arguments unchanged (#2974, #2978, #2995).
• Breaking: OpenClaw now uses post_tool_enabled for PostTool optimization; its former response, TOON, skip-tool, and shell-tool policy settings have been removed. DeepSeek Harness also uses the shared compression policy instead of adapter-specific thresholds and tool lists. OpenClaw remains limited to lossless transcript updates without same-turn replacement or retrieval (#3009, #3036).
• Hermes now delegates PreTool rewriting and PostTool result handling to Core, using the shared response and TOON policy instead of adapter-local decisions; older Hermes releases retain block-and-suggest command rewriting (#3018).
• Compression statistics now expose content_origin, applied_operations, and recoverability in place of seam and compressor_chain; authorized retrieval events also carry agent, session, and tool-call attribution (#2978).

Fixed

• OpenClaw now reads plugin-local configuration, so explicit enable and disable settings take effect even when global configuration contains conflicting values (#3009).
• npm packages now include executable shared hook dispatchers as regular files, so installed plugins can invoke Tokenless even though npm pack omits source symlinks (#3068).

[0.7.14] - 2026-08-26

Added

• The protocol-v1 tokenless compress command and TokenlessRuntime::compress now provide one entry point for schema, response, and TOON compression, so adapters make at most one subprocess call, apply one final size decision, and record only the winning operation (#2844).
• tokenless stats summary now excludes dry-run rows from active totals while reporting their count, and adds gross savings, retrieved tokens, net savings, Retrieve hit/miss/error counts, and unrecoverable truncation attribution; JSON output uses schema version 1.1, and the Python TokenlessStats API exposes the same typed fields (#2885).

Changed

• Truncation markers now include a directly runnable tokenless retrieve command, retrievals through the CLI, MCP, and embedded Runtime contribute to attribution, and MCP retrieval accepts uppercase hashes like the CLI (#2885).

Fixed

• The Codex integration no longer appends a second compressed copy after Tool use; it keeps environment diagnostics and RTK source reduction without increasing the Model-visible Prompt (#2866).
• tokenless compress-toon and the Runtime/Python SDK now consistently leave valid payloads shorter than 500 characters unchanged, while --min-toon-chars 0 can force encoding; malformed JSON still fails, and CLI output preserves the input's exact trailing-newline form (#2869).

[0.7.13] - 2026-08-25

Added

• Rust callers can now use the tokenless-protocol and tokenless-pipeline crates for versioned compression requests and responses, bounded content detection, registry routing, staged execution, and fail-open arbitration (#2783, #2788, #2799).

Changed

• The CLI compress-response command, TokenlessRuntime::compress_response, and the Python binding now route record-shaped JSON through the shared pipeline; scalar JSON roots pass through unchanged, while timeouts and rejected candidates return the original content and roll back their Stash writes (#2816).
• Runtime and Python disposition values now use the protocol's snake_case forms such as dry_run and no_savings, and may report passthrough, timeout, or error; cleanup-only savings can now apply under require_reversible without a Stash when no truncation occurred (#2816).

[0.7.12] - 2026-08-22

Changed

• Response compression now keeps a configurable tail window after the retained array head (8 items by default, controlled by --array-tail-preserve and the Runtime API), so final statuses and error details remain inline while Stash stores only the omitted middle segment (#2433).
• The BeforeModel schema hook now warns once per session when a payload is malformed or carries no tool declarations, making a skipped hook distinguishable from a successful run that produced no savings; explicitly empty tool arrays still pass through silently (#2606).
• L2 benchmark JSON, Markdown, and semantic-gate findings now identify the missing ground-truth items behind retention failures instead of reporting counts alone (#2433).

Fixed

• tokenless stats enable and stats disable now persist only the Stats toggle from the on-disk configuration, so temporary compression and SLS environment overrides are not copied into config.json (#2592).
• tokenless stats summary --compare now fails when either Session has no records, and --limit 0 is rejected, preventing typos or empty samples from appearing as successful 0% comparisons (#2674).
• Schema compression now handles complete request objects with a top-level tools array, compressing Function Calling entries while preserving non-function tools and fields outside the array (#2758).
• Lossy array truncation markers now survive TOON round trips intact, and extremely large tail-preservation values keep the full array instead of overflowing (#2433).

[0.7.11] - 2026-08-20

Fixed

• tokenless compress-toon now scores TOON savings with the same CJK-aware character estimator as stats summary and the Python/SDK path, so dry-run stderr predicted counts match recorded before_tokens/after_tokens. JSON parse, oversized input, and TOON encode failures still exit 2 (#2681).

[0.7.10] - 2026-08-19

Added

• Gemini-native functionDeclarations tool schemas are now compressed in BeforeModel integrations such as copilot-shell, including declarations that use parametersJsonSchema, while preserving unrelated Gemini Tool fields (#2663).
• The anolisa-tokenless Python SDK now exposes typed, read-only status, summary, list, show, diff, and comparison queries through TokenlessStats, using the same Runtime data directory and returning stored tool content only for explicit show and diff calls (#2666).

Changed

• Raw, RPM, npm, and source installations no longer build or ship the unused standalone toon executable; TOON encoding remains available through tokenless compress-toon and tokenless decompress-toon, and upgrades remove only Tokenless-owned legacy artifacts (#2657).

Fixed

• The AgentScope integration wheel now declares tqdm, so clean installations using the supported AgentScope 1.x range continue to import with OpenAI 3.3.0 and later without a manual dependency workaround (#2665).

[0.7.9] - 2026-08-18

Added

• The anolisa-tokenless Python wheel now exposes framework-neutral before_model, before_tool_call, after_tool_call, and retrieve lifecycles, with bundled RTK plus native schema and response compression, TOON, marker-authorized retrieval, and per-call attribution (#2627).

Changed

• AgentScope 1.0.11 through 1.x and AgentScope 2.0.x integrations now attach the same complete SDK contract, adding schema compression, command rewriting, TOON, environment-error guidance, and per-call attribution to the existing response compression and retrieval support (#2627).

Fixed

• The Cosh-NG extension's RTK rewrite hook now matches the lowercase shell tool name directly, so shell commands are rewritten without depending on host-side tool-name aliases (#2611).

[0.7.8] - 2026-08-18

Changed

• TOON encoding is now skipped for payloads under 500 characters; below that threshold the token savings are near-zero while the per-event encode cost stays the same (#2613).

Fixed

• npm platform packages (@anolisa/tokenless-*) no longer declare tokenless/rtk/toon bin entries. The name collision with the root package made npm remove every conflicting .bin link during install, leaving installs without a usable tokenless executable (#2613).

[0.7.7] - 2026-08-17

Added

• A source-built anolisa-tokenless ABI3 wheel now provides stateful in-process JSON response compression and marker-based Stash retrieval for CPython 3.11+ without spawning the CLI (#2501).
• AgentScope 1.0.11 through 1.x and AgentScope 2.0.x applications can install a separate same-version integration wheel to compress successful final Tool Responses and expose retrieval only for markers visible to the current Agent (#2507, #2528, #2553).
• DeepSeek Harness profiles can enable a bundled native Plugin that compresses successful single-block JSON Tool Results while preserving environment-error attribution and fail-open behavior (#2581).

Changed

• Claude Code Adapter detection now retries transient first-run binary and Plugin-registry initialization failures, reducing false not-ready results immediately after provisioning (#2519).
• The Tokenless RPM now provides the virtual anolisa-component(tokenless) capability, allowing ANOLISA to resolve the Package when the repository component index is unavailable (#2576).

Fixed

• Cosh-NG extension execution now treats the hard-disabled Tool Ready Hook's empty result as a successful no-op instead of failing closed (#2506).
• No-savings response compression now removes only Stash rows created by the discarded candidate, avoiding orphaned rows without deleting entries refreshed by another process (#2480).

0.7.6 - 2026-08-13

Changed

• TOKENLESS_DATA_DIR now accepts absolute non-root directories outside the real user home, while invalid explicit directories disable SQLite state instead of silently falling back to home (#2434).
• Tool Ready pre-call checks, repairs, and blocking are now hard-disabled across adapters so incorrect readiness results cannot block valid work; post-tool failure attribution and other Tokenless features remain active (#2487).

Fixed

• Direct JSON Schema descriptions are now stashed once, so one retrieval returns the original content without a nested marker (#2399).
• Dry-run compression settings from config.json now remain effective when statistics and SLS toggles are set through environment variables (#2380).
• tokenless retrieve now writes stored payloads byte-for-byte without appending a trailing newline (#2396).
• Stash retrieval now scans past malformed markers to find a later valid key and stays linear on adversarial input (#2386).
• RPM installations now include the shared Codex lifecycle helper required by the adapter install script (#2425).

0.7.5 - 2026-08-10

Added

• OpenCode users can now enable Tokenless through a collision-safe local plugin that shares the existing readiness, rewrite, schema, and response-compression hooks (1233cfcf).

Changed

• The Qoder adapter now uses native plugin and hook conventions, replacing compressed tool output in place while preserving fail-open behavior (13817938).

Fixed

• Rewritten shell commands now use the resolved absolute rtk path, so they continue to work in agent environments with a restricted PATH (ae83f7d3).
• Qoder and OpenClaw hooks now preserve agent, session, and tool attribution across rewrite and proxy boundaries (#2158, 2f330656).
• Adapter installation now recognizes legacy /usr/local layouts, recommends RPM upgrade mode, and removes stale packaged user-manual files during upgrades (f7ce3878, ec25d516, 917f151e).

0.7.4 - 2026-07-31

Added

• Tokenless can now be installed from npm on Linux and macOS x64/arm64, including the tokenless, rtk, and toon binaries plus framework adapters (#1929).
• tokenless stats diff now explains estimated savings for records, sessions, and tool uses with text or JSON reports and bounded unified diffs (#1991).
• TOKENLESS_DATA_DIR now sets one trusted directory for both statistics and reversible-compression databases while preserving per-database overrides (#2038).

Fixed

• The Qwencode adapter now declares its delivered compress-toon capability, keeping adapter discovery consistent with its compression behavior (#1945).
• Hermes copy installations now resolve shared hook resources from trusted system, XDG, and user data paths with actionable diagnostics when no safe candidate exists (#2058).

0.7.3 - 2026-07-28

Added

• ANOLISA can now install Tokenless on macOS and enable Qwencode as an independent adapter (#1964).

Changed

• Adapter hooks now discover tokenless, rtk, and toon across user, /usr/local, RPM, and legacy installation layouts (#1957).
• Hook launchers now prefer resources from the active installation, preventing mixed versions when multiple Tokenless installations coexist (#1964).

Fixed

• Tool schema compression now reads the canonical Cosh and Cosh-NG request field, so schemas are compressed instead of silently passing through unchanged (#1894).
• Cosh-NG compression statistics are now attributed to cosh-ng when hook environment variables are present (#1894).
• Qoder plugin installation now expands cached hook paths, preventing invalid /rewrite_hook.py commands from blocking tool calls; the user manual includes recovery steps for affected upgrades (#1924).
• ANOLISA packages now include the shared hook resources required by Tokenless adapters (#1964).

0.7.2 - 2026-07-27

Added

• Tokenless now compresses Cosh-NG tool responses by replacing the original model-visible content (#1669).
• Tokenless now rewrites supported Cosh-NG shell commands for more compact output (#1669).

Changed

• Shell environment checks now report only recommended tools referenced by the current command (#1598).
• tokenless env-check --fix now installs required dependencies only, leaving optional recommendations untouched (#1598).
• Automatic dependency fixes now fail quickly with actionable authentication, network, or permission messages instead of prompting for sudo (#1598).
• Cosh-NG compression statistics are now recorded under the cosh-ng agent (#1669).
• Cosh-NG compression now excludes display-only content from model context (#1669).
• Cosh-NG runs with undetectable versions now keep original tool responses unchanged (#1669).
• Compression now leaves tool results unchanged when the compressed output is not smaller (#1674).
• Tokenless user manuals now live in the central ANOLISA guide instead of the RPM package (#1586).

Fixed

• Claude Code 2.1.121+ now replaces original tool results with compressed versions, preventing duplicate context (#1674, #1686).
• Older or undetectable Claude Code versions now pass tool results through unchanged instead of duplicating compressed context (#1674, #1686).
• Claude Code replacements now preserve built-in tool result formats, including empty fields (#1674, #1686).
• ANOLISA now recognizes the packaged Tokenless version correctly (#1587).

0.7.1

• fix RPM tarball to exclude generated .anolisa/component.toml, ensuring rpmbuild always regenerates the adapter contract from the authoritative .toml.in template — previously stale checked-in copies shipped outdated contracts missing claude-code, codex, and cosh adapter declarations (closes #1470)
• synchronize adapter contracts: declare every shipped driver (qoder, claude-code, codex, cosh, qwencode) in component.toml.in and add CI check (check-component-contract) to keep them in sync
• raise test coverage from 75% to 90%: ~170 new unit tests across all four crates covering compression edge cases, stash round-trip, schema migration, SLS writer, and CLI dispatch
• harden test isolation: replace unsafe env-var mutations with RAII TempDbGuard / EnvGuard to prevent tests from touching real ~/.tokenless state; enforce --test-threads=1 in Makefile (Rust 2024 set_var is unsafe)

0.7.0

• add MCP tokenless_retrieve stdio server (tokenless mcp serve) so MCP-connected agents can recover truncated payloads on demand — the MCP analogue of the tokenless retrieve CLI, closing the stash MCP gap vs Headroom CCR's headroom_retrieve
• complete reversible-compression (stash / CCR) coverage across the remaining lossy paths: ResponseCompressor string truncation, ResponseCompressor depth truncation, and SchemaCompressor description truncation are now stash-backed with <<tokenless:KEY>> markers; fit-check before stash prevents orphan entries; shared stash_suffix() helpers keep marker budget consistent
• add --no-stash / --stash-db flags to compress-schema (mirroring compress-response); dry-run (compression_on=false) skips the stash so markers never reach the LLM without a retrievable entry
• add lazy TTL purge to SqliteStore: expired rows are physically deleted before retrieve lookups so the stash db does not grow unbounded
• add actual-savings-rate display: StatsSummary::actual_savings_percent(session_total_tokens); format_summary() / format_summary_json() accept optional session total and emit an "Overall Savings vs Total Consumption" section plus new JSON fields (session_total_tokens, actual_savings_tokens, actual_savings_percent) — backward-compatible when absent
• add stash write/size counters to compression stats (record_compression_stats extended); retrieve-side hits/misses deferred pending a stats use case
• add qoder framework driver (qodercli install + settings.json merge/prune, AdapterOps::read_file, symlink-safe atomic write_file); gate qoder to adapter_type=plugin; fail closed on forged receipts and require all managed hooks
• raise test coverage from 59% to 75%: 100+ new unit tests plus 18 CLI integration tests across all four crates, test code moved to src/tests/ via include!() for cleaner separation
• add reversible-compression user manual (docs/stash-reversible-compression.md) plus README updates: architecture tree entry for tokenless-ccr, retrieve subsection documenting hash/marker input and --no-stash/--stash-db, scenario-mapping rewrite of the "Applicable Scenarios & Expected Effects" chapter
• rename tokenless docs *_CN.md to *_zh.md, add bidirectional bilingual links, create README.md + README_zh.md
• address adapter review findings: trust packaged datadir roots for Codex symlink targets, scope Claude Code marketplaces per component and fail closed, reject framework/adapter type mismatches before enable
• silence clippy warnings surfaced by rustc 1.94 stable in existing tests (field_reassign_with_default in tokenless-cli, bool_assert_comparison and default_constructed_unit_structs in tokenless-stats)

0.6.1

• bundle tool_categories.json into dist for npm installs
• use node: prefix, eliminate shell subprocess in openclaw plugin

0.6.0

• add absolute saved values + schema version to JSON output
• use import.meta.dirname instead of __dirname in openclaw plugin
• add qwencode adapter for Qwen Code extension
• fix rtk pytest 'No tests collected' regression
• add trusted FHS fallback paths for hook_utils import in codex scripts
• add SLS JSONL data collection with config toggle
• add tokenless RPM component contract (publishing metadata)
• add compression toggle with dry-run compare mode (TOKENLESS_COMPRESSION_ENABLED, stats summary --compare)
• enable SLS recording by default and document usage
• align compression mode serde/db form and dedup config load
• expand RPM component contract (bundle.entry + hermes)
• make SLS writer append-only and skip when log file absent
• prefer tool_call_id over internal tool_use_id for qwencode hooks
• bump vendored rtk to v0.43.0; rework pytest stderr-surfacing patch for the refactored runner; drop grep-fallback-fix (root cause fixed upstream) and preflight-skip-python (reversed upstream)
• sync toon-format to 0.5.0 in Makefile and spec (was stale at 0.4.6)

0.5.1

• add --json output to stats summary
• implement unified tool categorization and 3-layer compression strategy
• add rtk grep fallback pattern fix patch
• add rtk pytest error report patch

0.5.0

• add Hermes adapter runner
• drop TOON wrapper prefix and slim diagnostic tags
• unify rtk rewrite exit code 3 handling across adapters
• secure shell variable interpolation in env-fix and hooks
• add subprocess returncode checks and extract shared hook utilities
• secure resolveBinaryPath and improve binary cache invalidation
• use mktemp in tests and safe home expansion
• bound SchemaCompressor recursion to prevent stack overflow
• propagate env-fix subprocess failures instead of returning stdout
• anchor home lookup on getpwuid_r and trust-check candidate binaries
• harden env-fix install paths with uid trust check and divert stderr to log
• recover from poisoned mutex in stats recorder instead of failing
• add input size limit and validate db path
• reserve truncation marker length in response compressor
• rename openclaw plugin Name to Tokenless and ID to tokenless
• add qoder CLI adapter
• compress-schema on array input
• warn when compression is skipped
• stats command syntax
• add Claude Code adapter plugin
• error on TTY stdin instead of hang
• add codex adapter plugin
• fix compression pipeline output inflation, truncation and hook timeouts
• harden env-fix, version extraction, file trust, schema, permissions
• address review findings — trailing newline, chmod guard, rate-limited log, comment
• make env attribution reachable for skip-tools entries
• add selective-claw context engine plugin
• address review findings for selective-claw plugin
• remove invalid "2" dependency from selective-claw
• restore indentation in compress_response_hook.py
• harden hook exit-code handling + trust model consistency
• only warn on truly unexpected rtk exit codes
• dedup rewrite_hook, import from hook_utils

0.4.1

• fix version_ge 3-segment truncation in env_check.rs (compare all segments)
• add qoder, claude-code, codex adapter plugins and documentation
• sync manifest.json with template to include all six agents
• update README and user manuals for new agent integrations
• add pycache to root .gitignore
• update response-compression.md with all agent integration paths
• derive Makefile version from Cargo.toml, fix spec changelog weekday
• normalize adapter version numbers to 0.4.0
• derive adapter plugin versions from Cargo.toml instead of hardcoding

0.4.0

• correct 5 bugs in stats, naming, SQL, paths and permissions
• align FHS paths, restructure adapter dir, remove install.sh
• address code review findings across schema, env-check, hooks, and plugin
• add hermes agent plugin
• security hardening & critical algorithm correctness
• behavioral correctness & logic fixes
• dedup, dead code removal & cosmetic cleanup
• support staged installs
• support Debian/Ubuntu FHS paths and harden binary resolution
• build OpenClaw plugin to dist/index.js

0.3.2

• replace spoofable home-dir uid derivation with libc::getuid() syscall for trust chain integrity
• replace subprocess toon -e calls with in-process toon_format::encode_default() library call
• replace rtk/toon git submodules with crates.io deps and inline toon-format source
• hard-fail on rtk stats patch failure in justfile setup-rtk recipe
• unify compress-toon/compress-schema/compress-response error exit codes (all exit 2)
• remove 2>/dev/null || true from Makefile toon install (hard fail on missing binary)
• remove redundant #[source] attribute on thiserror variants that already have #[from]
• deduplicate Python hook FHS path constants into shared hook_utils module
• add libc to workspace dependencies for uid syscall
• add detailed rust >= 1.89 comment in spec.in explaining CI pin rationale

0.3.0

• add tool-ready 4-phase environment pre-check with cosh extension integration
• skip compression and stats when no token savings
• pass caller context to rtk stats via .rewrite-context file
• remove redundant cosh extension install/uninstall from install.sh
• convert cosh hooks to extension format per cosh dev guide
• skip zero compression and stats recording
• use isExecutable() and resolved paths in openclaw plugin
• resolve rtk/toon binary paths for RPM-installed plugins
• correct RPM install paths to align with install.sh expectations
• preserve tool result message structure in TOON encoding
• align install paths with FHS
• auto-record stats with real tool_use_id from hook payload
• restructure RPM dirs and remove auto plugin/hook installation

0.2.0

• add compression stats with auto-record from real data
• add TOON context compression support
• skip compression for skill and content-retrieval tools

0.1.0

• introduce tokenless into ANOLISA (#199)

Changelog

0.5.0

Added

• Unified workspace path identity, conflicting alias registrations are rejected at init
• Workspaces whose init or unregister was interrupted are recovered on daemon restart
• Added guarded rollback V2 protocol and evidence wire variants used by cosh-ng governed tasks, cosh-ng requires ws-ckpt daemon 0.5.0 or newer

Changed

• OpenClaw tool allowlists are now managed through the OpenClaw config CLI, requiring OpenClaw 2026.2.13 or newer (#3221)
• /etc/ws-ckpt/config.toml is now RPM %config(noreplace): upgrades keep admin edits and land new defaults as .rpmnew; erase keeps a modified config as .rpmsave, restore it manually after reinstall (#3070)

Fixed

• Fixed empty workspaces being skipped instead of snapshotted
• Fixed checkpoint/rollback silently succeeding on a detached workspace directory, now failing fast with a recovery hint (#3059)
• Fixed recover --all exiting 0 when individual workspaces failed (#3069)
• Fixed rpm -e wiping the last remaining snapshot copies when recover failed (#3069)
• Fixed checkpoint failures under disk-space pressure by reclaiming deleted subvolumes (#3053)
• Fixed a race when two clients initialize the same workspace concurrently
• Fixed adapter discovery for raw installation layouts
• Fixed OpenClaw plugin install to probe the installed CLI before accepting capabilities (#3116)

0.4.5

Added

• Added bilingual (English/Chinese) sidecar deployment guide (#2965)

Fixed

• Fixed intermittent bootstrap failure when all loop devices are in use (#2965)
• Scoped sidecar preStop loop cleanup to ws-ckpt-owned devices only (#2965)

0.4.4

Added

• Added guarded checkpoint protocol with identity-fenced snapshot creation, checkpoint state stays verifiable across crashes

Fixed

• Fixed interrupted rollback state lost on daemon restart, ambiguous candidates are now preserved instead of deleted
• Fixed config --global to verify the daemon actually loaded the written config file (#2813)
• Fixed sidecar deployment guide missing the /etc/ws-ckpt shared volume required for global config (#2813)
• Fixed error hints to cover containerized deployments and the daemon's mount namespace (#2807, #2814)

0.4.3

Added

• Added k8s sidecar containerized deployment support (#2034)

Fixed

• Fixed daemon memory leak that caused unbounded growth under sustained checkpoint workloads, eventually leading to OOM (#2554)
• Fixed loop-device backend checkpoint performance under concurrent IO, reducing latency by up to 5x (#2523)
• Fixed bootstrap failure leaving orphan images and loop devices behind, and now reports clear startup errors instead of exiting silently (#1956)
• Fixed init failing with a cryptic EBUSY error when workspace path is already a mount point; now rejected with a clear message (#1798)
• Added RPM component identity declaration for anolisa-cli adapter discovery (#2568)

0.4.2

Added

• Added an telemetry gate to ops log writes (#1509)

Fixed

• Fixed auto-recover orphan .pre-init-bak from interrupted init (#1601)

0.4.1

Added

• Added skip auto-checkpoint after rollback (#1263)

Fixed

• Fixed workspace sync after config update (#1263)
• Fixed absolute path handling for ws-ckpt in crontab entries (#1263)
• Changed rollback -n offset, pass numAncestors as-is (#1263)

0.4.0

Changed

• BREAKING checkpoint -i/--id flag replaced by -s/--snapshot as primary; -i remains as hidden alias but may be removed in a future release (#1064)

Added

• Added plugin install/uninstall subcommand (#1005)
• Added component.toml for anolisa-cli adapter discovery (#1005)
• Added rollback preview support with --preview parameter (#1103)
• Added elapsed time display after each CLI operation (#1075)
• Added auto-generated snapshot ID when --snapshot is omitted (#1064)
• Added SLS ops log output for dashboard metrics (#1059)
• Added optional -t flag for diff to compare snapshot against current workspace (#848)
• Added rollback-by-ancestor-count and snapshot DAG tracking (#877)
• Added cron-based scheduled checkpoint snapshots (#819)

Fixed

• Fixed --snapshot/-s as primary flag and aligned plugin flag handling (#1103, #1064)
• Fixed SKILL.md to sync with actual CLI/plugin implementation (#847)
• Fixed init and recover to guard against replaced workspace symlink (#860)
• Fixed init rsync by dropping --copy-unsafe-links (#873)

0.3.3

Added

• Added per-workspace policy override with hermes/openclaw plugin support (#721)
• Added /proc cwd occupant guard for init and rollback (#684)
• Added Hermes adapter runner script (#617)

Fixed

• Fixed write lock contention and cwd guard deadlock in rollback (#721, #684)
• Fixed input validation for non-UTF-8 paths and path-traversal snapshot IDs (#695, #678)
• Fixed seccomp arch selection, workspace registry concurrency, and RPM packaging (#695, #684)

0.3.2

• Fixed openclaw uninstall to remove tool whitelist from config
• Fixed parent path refusal to apply as workspace-level rules for skill and openclaw plugin

0.3.1

• Fixed plugin workspace config registration and auto-loading
• Reject workspace paths that are hermes cwd itself or parent
• Fixed plugin tool to prefer explicit workspace parameter over config
• Fixed skill delete requiring --force flag
• Fixed daemon workspace path validation and fswatch fd leak
• Removed unused btrfs_ops.rs module

0.3.0

• Added openclaw plugin scaffolding for ws-ckpt
• Added hermes plugin scaffolding for ws-ckpt
• Made ws-ckpt skill agent-agnostic and prompted for workspace at invocation
• Followed make install contract for build-all integration
• Fixed bugs in list and diff sub-commands
• Made daemon stateful

0.2.0

• Added auto_cleanup feature and switch
• Unified config modification entry through the TOML file
• Added global CLI warning when any workspace>1000 snapshots or filesystem usage>90%
• Fixed backend detection and daemon state recovery logic
• Fixed image size configuration not taking effect after daemon restart
• Removed obsolete fs_warn_threshold_percent parameter
• Fixed config.toml to ship as a sample file

0.1.0

• Daemon with Unix Socket IPC and Bincode binary protocol.
• init / checkpoint / rollback / delete / list / diff / cleanup / status / config commands.
• Background scheduler: auto-cleanup, health check, orphan recovery.
• Multi-backend: btrfs-base / btrfs-loop / overlayfs with auto-detection.
• TOML config persistence with runtime hot-reload.
• systemd service with RPM packaging for Alinux 4.