Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.6.1] - 2026-11-04

Component Versions

Release composition: These versions are pinned to the Agentic OS 1.6.1 component release and may differ from rolling or Nightly component manifests on main.

Note: copilot-shell and os-skills are unchanged since v1.6; they are listed to show the complete stack composition. This release updates component RPMs only and does not publish a new Agentic OS system image.

Highlights

• cosh-ng: Updated to v0.28.0, prevents project configuration and changed commands or hooks from weakening approval boundaries while bounding session and diagnostic storage, users get safer long-running shell sessions with predictable disk use (#7244, #6787, #6788, #7157, #7158, #7159)
• agent-sec-core: Updated to v1.1.1, makes policy reconciliation and policy storage more resilient, scans command strings passed to Python process APIs, and standardizes the SkillSec CLI, administrators get more consistent enforcement and actionable recovery paths (#6944, #8782, #9128, #8907)
• agentsight: Updated to v0.15.3, activates structured file protection and expands local trajectory, token, cost, export, HTTP, and resource analysis, operators get more complete and accurate Agent observability across supported runtimes
• tokenless: Updated to v0.9.0, preserves complete JSON shape and numeric literals while validating RTK output before further compression, agents avoid silent tool-result changes and can use TOON spec v4.4 when compatible (#8814, #7784, #7752, #8901)
• anolisa: Updated to v0.3.20, recognizes container deployments, preserves user-added or edited Skill files when disabling OpenClaw and Hermes installations with per-file Skill ownership records, and provides actionable adapter-path recovery guidance, administrators can identify container deployments and recover failed adapter lifecycle operations (#8206, #6221, #9220)
• agent-memory: Updated to v0.2.12, rechecks capture consent, isolates new observations by Agent, publishes overwrite operations atomically, and validates snapshot restoration, users get more reliable memory writes, recovery, and retrieval (#8865, #7776, #8982, #7631)
• skillfs: Updated to v0.5.4, recovers managed mounts, hides installation staging state, and refreshes discovery immediately after Skill moves, agents see a consistent Skill view during installation and runtime changes (#8883, #7767, #9124)
• ws-ckpt: Updated to v0.6.0, resumes interrupted rollbacks, rejects checkpoints under unsafe btrfs pressure, and paginates large snapshot sets, users can recover workspaces without compounding storage or index damage (#8570, #7888, #3451)

Updated

• cosh-ng: Updated to v0.28.0, ignores project-level approval_mode, allowed_tools, and configuration hooks that would lower system or user security; binds command approval and project-hook consent to exact content; enforces 100 MiB/7-day session and 20 MiB/3-day diagnostic-log budgets; redacts access keys and PEM material; and fixes routing restoration, timeout prompts, approval cards, special-filename diffs, and low-space checkpoint handling, users retain secure and stable sessions without unbounded local state (#7244, #6787, #6788, #7158, #7157, #7159, #7396, #7350, #7489, #7333, #8042)
• agent-sec-core: Updated to v1.1.1, rejects stale policy results, supersedes exhausted Apply retries with newer Delete intents, recovers SQLite state deterministically, and falls back to /var/lib/agent-sec/policy/policy-state.db when the default location is unsafe; Python os.system, os.popen, and subprocess command strings now use the existing Shell rules; skillsec is the primary command group with skill-ledger retained as an alias; YAML-sensitive Skill names remain valid; and the unsupported scope create --cgroup-id option is removed, administrators get a more predictable system security service and clearer migration behavior (#6944, #8782, #9128, #8907, #8948, #9134)
• agentsight: Updated to v0.15.3, lowers structured file policies into enforceable kernel rules for deletion, rename or exchange, truncation, and ordinary writes; discovers Gemini CLI, Hermes, and Claude SDK sessions; removes collected trajectories when source histories are cleared; retains partial, usage-only, and bare JSON SSE token records; scopes accuracy analysis to the latest answered request; preserves developer instructions, tool completion times, and local identities in ATIF; decodes stacked HTTP content encodings; validates resource evidence before reporting thresholds; and reduces missed TLS traffic and capture-query memory, operators receive file-protection status and analysis that reflect the evidence actually collected
• tokenless: Updated to v0.9.0, retains empty fields, null values, and array positions in complete JSON candidates; falls back to exact JSON when TOON cannot preserve a number's value or type; upgrades TOON encoding to spec v4.4; resumes post-tool compression only when the executed RTK command and byte-identity evidence match; and emits compress-response and compress-schema payloads without an added newline, agents can compress supported responses without changing their structure, numeric meaning, or emitted bytes (#8814, #7784, #7752, #8901, #7789, #7796)
• anolisa: Updated to v0.3.20, reports container deployments as container instead of inheriting the host cloud product, preserves user-added or edited OpenClaw and Hermes Skill files on disable when their installation records track per-file Skill ownership, refuses cleanup through redirected or dangling ancestor directories while retaining installation records, explains how to recover adapter operations rejected by path boundaries, and returns standard JSON envelopes for telemetry lifecycle commands, administrators can identify container installations and recover lifecycle failures (#8206, #6221, #9220, #8706)
• agent-memory: Updated to v0.2.12, rechecks persisted OpenClaw capture consent on every automatic observation, immediately attributes new observations to MCP_CLIENT_NAME, prepares replacement files before mem_edit or mem_write publication, limits mem_revert to the requested file, verifies gzip snapshots before restoration, starts watching before indexing, treats dotted filenames and Boolean-looking terms as literal search text, reports corrupted index rows, and publishes all 38 runtime tools in the packaged catalog, agents receive current, isolated, and recoverable memory results across write, revert, startup, and search paths (#8865, #7776, #8982, #9082, #7631, #8880, #9127, #9089, #8012, #8854, #9148)
• skillfs: Updated to v0.5.4, lets skillfs mount --config mount.toml --managed recover a failed worker from the startup configuration while reading current sources, starts reliably on dot-prefixed mountpoints and slow hosts, keeps Flat and Hermes staging directories hidden, removes stale discovery entries after moving a Skill, leaves ambiguous npm commands unchanged when Yarn is selected, and treats --logs-dir literally, agents and operators see consistent mounts, installation state, discovery, and statistics (#8883, #8080, #7767, #7742, #9124, #9003, #9180)
• ws-ckpt: Updated to v0.6.0, finishes interrupted rollbacks after daemon restart and restores the correct rollback head, rejects new checkpoints when btrfs data or metadata reaches safety thresholds, paginates snapshot listings, verifies cron-lock ownership and rejects line breaks in scheduled values, isolates temporary diff snapshots and rejects malformed lists, validates metadata and parent chains before snapshot creation, refuses plugin updates from inside a workspace, surfaces initialization failures, and re-arms file watching after rollback, users can operate large or stressed workspaces with bounded failure and recovery behavior (#8570, #7888, #3451, #8273, #3755, #6774, #6198, #3558, #5695, #6956, #8467, #6216, #6217, #5054)

Compatibility

• agent-sec-core: scope create --cgroup-id has been removed; use --pid, --process-name, or --executable, and confirm that the system-level daemon is running after upgrade (#9134).
• agentsight: The Enforcer protocol moves from v4 to v5 and is not backward compatible; upgrade AgentSight and Enforcer together. The default CPU throttle target is 25% of one logical CPU and the default connection capacity is 128.
• tokenless: Complete JSON compression no longer removes empty fields or values. External TOON consumers must support spec v4.4 (#8814, #7752).
• anolisa: Consumers of product_type must accept the new container value; refresh or remove stale PRODUCT_TYPE declarations from container images. Skill-file preservation requires per-file Skill ownership records; legacy OpenClaw and Hermes installation records without them still use whole-directory cleanup after path validation. Back up user-added or edited Skill files before disabling these legacy installations (#8206, #6221).
• agent-memory: Upgrade the server and adapters together to v0.2.12 because older servers reject the new memory_capture hook. Validate time-decay settings before upgrade (#8865, #8701, #8699).
• ws-ckpt: Refusing checkpoint creation under storage pressure is expected protection. Plugin updates cannot run from inside the workspace, and cosh-ng v0.28.0 or later is required for the updated protocol.

[1.6] - 2026-10-16

Component Versions

Release composition: These versions are pinned to the Agentic OS 1.6 stable release and may differ from rolling or Nightly component manifests on main.

Note: copilot-shell, os-skills, and ws-ckpt are unchanged since v1.5; they are listed to show the complete stack composition.

Highlights

• cosh-ng: Updated to v0.27.0, adds managed-installation update notices and IMDSv2-aware regional telemetry while making login fallback safe, users can discover upgrades at an idle prompt and retain shell access when Enhanced startup fails (#3465, #3406, #3395)
• agent-sec-core: Updated to v1.0.1, ships the root-owned V2 daemon as the default runtime in the Agentic OS 1.6 RPM and Raw packages for policy, scanning, observability, and Skill Ledger operations and hardens daemon, storage, and SkillFS integration, administrators get one system-wide security control plane with explicit migration boundaries (#3257, #6551, #7563, #3295, #6826, #6931, #7122, #7629)
• agentsight: Updated to v0.14.2, unifies SQLite storage under a hot-reloadable total budget and improves provider parsing, token accounting, trajectory analysis, dashboards, and enforcement reliability, operators get more complete and accurate Agent observability across supported runtimes (#7478, #7329, #7193, #7398, #6562)
• tokenless: Updated to v0.8.7, adds QwenWorkCN local-mode integration and same-turn OpenClaw compression, enables complete HTML rendering by default, and preserves numeric, schema, and archived-conversation fidelity, agents can reduce more live context without silently changing tool results (#7257, #7124, #3473, #7069, #7048, #7042)
• anolisa: Updated to v0.3.18, adds Intel Mac delivery, the sec-core Raw backend, and QwenWorkCN Tokenless management while hardening installation, updates, logs, telemetry, and rollback records, administrators can deploy the 1.6 stack on more platforms with safer recovery (#3448, #6551, #7368, #7635, #6450, #7197)
• agent-memory: Updated to v0.2.10, adds verified Linux x86_64 and ARM64 Raw packages, discoverable deferred tools, and clean MCP child shutdown, users can install without a source build and reload the OpenClaw plugin without leftover memory processes (#7648, #7649, #7645, #7482, #7661)
• skillfs: Updated to v0.5.2, connects authenticated notifications and live-source resolution to the Rust sec-core daemon and hardens hidden-Skill writes, watchers, mount recovery, parsing, and large notification handling, operators get safer and more consistent Skill views under mutation and shutdown (#3295, #5382, #4530, #6202, #7297, #7189)

Updated

• cosh-ng: Updated to v0.27.0, shows an available-update command only for managed installations at a safe idle prompt, discovers regional SLS endpoints on IMDSv2-only instances while preserving older metadata compatibility, and starts the native login shell only when Enhanced startup fails before side effects, users receive actionable upgrade guidance without duplicate login sessions or unmanaged-install noise (#3465, #3406, #3395)
• agent-sec-core: Updated to v1.0.1, in the Agentic OS 1.6 RPM and Raw packages, moves PII, prompt and code scanning, Security Events, observability queries, Policy/Scope/Binding reconciliation, and Skill Ledger trust into a root-owned V2 daemon; adds owner-scoped queries, local-model scanning, system-wide signing and default Skill directories, reproducible V2 RPM builds and V2 Raw packages, root-daemon verification, connection limits, retention, SQLite path checks, and bounded SkillFS notification responses; removes legacy local execution from the V2 CLI, selected V1 commands, and SkillSec key rotation, administrators can operate a hardened shared security service while preserving clear ownership and revocation rules (#3257, #6551, #7563, #3286, #3384, #6596, #6679, #6745, #6826, #3295, #6931, #7099, #7419, #7188, #7122, #7103, #7295, #7296, #7629)
• agentsight: Updated to v0.14.2, applies a configurable 2200 MB default budget across SQLite stores and trims the largest stores first; records body-less calls when an agent exits; strengthens Anthropic, Gemini, Codex, Responses, legacy completion, HTTP/2, SSE, tool-call, finish-reason, tokenizer, and token-usage handling; accepts --db in query commands and improves agent discovery, trajectory filters, batch analysis, reuse labels, semantic search, dashboard pagination and metrics, interruption aggregation, storage maintenance, audit validation, enforcement, OOM detection, and legacy-kernel compatibility, users can query and analyze longer-running Agent workloads with fewer missing or misattributed events (#7478, #7329, #7193, #7398, #6562, #7385, #7451, #7032, #7403, #7413, #6781, #7326, #7467)
• tokenless: Updated to v0.8.7, reclaims expired Stash rows during writes, enables full-page HTML extraction by default, adds a packaged QwenWorkCN local-mode adapter, and moves supported OpenClaw tool-result compression before the same-turn model request; preserves quiet sed reads and inline code, passes malformed tool arguments back to AgentScope/QwenPaw hosts, deduplicates Selective-Claw recall, protects JSON numeric precision and OpenCode runtime validators, previews Qwen Code/OpenCode uninstall under ANOLISA_DRY_RUN=1, and keeps compression available when statistics storage is unavailable, agents gain broader lossless compression with safer framework integration (#3565, #3473, #7257, #7124, #4963, #6393, #5288, #5299, #4859, #7040, #7069, #7048, #7348, #7395)
• anolisa: Updated to v0.3.18, ships Intel macOS x86_64 CLI artifacts and recognizes compatible cosh-ng releases, adds the sec-core Raw backend and an OpenClaw capability-consent opt-out, and manages the Tokenless QwenWorkCN local-mode plugin; validates RPM backends, repositories, kernel requirements, archive paths, Raw conflicts, registration schemas, adapter state, and post-uninstall hooks, repairs npm launchers, redacts repository errors, improves RFC3339 log queries and telemetry retry/shutdown behavior, and recognizes Linux ARM64 SkillFS/ws-ckpt packages, users get safer multi-platform lifecycle management and more recoverable failed operations (#3448, #3554, #6551, #7368, #7635, #6450, #7197, #7294)
• agent-memory: Updated to v0.2.10, requires an executable OpenClaw adapter binary, publishes verified Linux x86_64 and ARM64 archives containing the memory server and bundled adapter, guides agents to discover deferred memory tools through Tool Search or direct calls, and waits for the MCP child process during plugin disposal, users receive earlier configuration errors, simpler installation, reliable tool invocation, and clean shutdown or reload behavior (#4855, #7648, #7649, #7645, #7482, #7661)
• skillfs: Updated to v0.5.2, interoperates with the Rust sec-core SkillSec daemon for authenticated scanning and activation, blocks hidden-Skill mutation through open handles and nested filesystem operations, preserves listings and inode identity across flat and Hermes changes, bounds watcher and activation waits, preserves existing views and reports skipped or colliding Skills, hardens managed mount reuse and shutdown, accepts varied Skill text formats, and falls back to whole-Skill rescans for notifications near the 64 KiB frame limit, agents see stable Skill content while operators retain source data and actionable mount state (#3295, #5382, #4530, #6202, #7297, #7189)

Compatibility

• agent-sec-core V2 RPM/Raw migration: When upgrading through the Agentic OS 1.6 V2 RPM or Raw packages, security operations require the root-owned agent-sec-core.service and default /run/agent-sec-core/daemon.sock. Move AGENT_SEC_DATA_DIR and model-service settings into the daemon environment, move PII rules to /etc/agent-sec/pii-checker/rules.yaml, update scripts that use harden, verify, or log-sandbox, and preserve V1 Security Events and Observability data because it is not imported automatically. Source installations using make build-all and make install still provide the V1 Python CLI and user service (#3257, #6551, #7563, #3217, #7283, #3286, #6605).
• agent-sec-core Skill Ledger trust: V2 uses one system signing key and does not import V1 keys or trust history. Rescan Skills after upgrading. Version 1.0.1 rejects rotate-keys and init --force-keys. To revoke a certified Skill, ensure its path is no longer covered by an enabled default directory, another exact or wildcard managedSkillDirs entry, or an authenticated SkillFS mount; remove or disable every applicable authorization source, restart the daemon, and use check or show to verify that the Skill is no longer trusted (#3295, #7629).
• Tokenless OpenClaw requirement: The OpenClaw adapter requires OpenClaw 2026.6.6 or newer and compresses supported live tool results before the same-turn model request. Hosts that truncate text before middleware runs cannot be repaired by Tokenless; use a host build containing upstream fix 2f620b970a04 when applicable (#7124).
• Tokenless HTML default: Complete HTML page extraction is enabled by default in the CLI, Runtime, and Python SDK. Set TOKENLESS_HTML_EXTRACTION_ENABLED=0 or SDK html_extraction_enabled=False to retain the previous opt-in behavior; Git diff cropping remains opt-in (#3473).
• QwenWorkCN local mode: Tokenless and ANOLISA support the macOS local desktop mode, not security-workspace or Linux VM execution. Existing script-based installations must be uninstalled before ANOLISA adopts the plugin; restart QwenWorkCN and verify activation in the application because CLI status cannot confirm runtime loading (#7257, #7368).
• SkillFS and sec-core pairing: Upgrade SkillFS and agent-sec-core together to use authenticated Rust-daemon scanning and activation. Notifications are best-effort rather than exactly once; oversized path lists are converted to whole-Skill rescans within the daemon frame limit (#3295, #7188, #7189).

[1.5] - 2026-09-24

Component Versions

Note: copilot-shell and os-skills are unchanged since v1.4; they are listed to show the complete stack composition.

Highlights

• cosh-ng: Updated to v0.26.0, adds persistent managed Tasks with progress inspection after reconnecting and snapshot preview, diff, and switching, users can continue long-running work and launch new Tasks against the restored workspace without restarting the Gateway (#2911, #3438)
• agent-sec-core: Updated to v0.13.2, adds V2 Policy, Scope, and Binding management and brings code scanning, security events, telemetry, and AgentSight policy delivery into one runtime flow, administrators can manage and audit security policies through a unified workflow (#3062, #3097, #3103, #3203, #3246, #3300)
• agentsight: Updated to v0.13.1, adds user preference analysis, classified trajectory-step search, and human labeling and review while strengthening file-delete protection, users can discover reusable experience in historical Agent sessions
• tokenless: Updated to v0.8.4, adds Git diff and HTML reduction plus shared paths in search results, agents can reduce context while retaining key structure, diagnostics, and access to the original content (#3299, #3306, #3173)
• anolisa: Updated to v0.3.15, adds OpenCode integration and cosh-ng diagnostic bundles, unifies Yum 3/DNF 4 behavior, and strengthens RPM verification and diagnostic redaction, administrators get more trustworthy installation and troubleshooting results (#3346, #3317, #3318, #3417, #3431)
• agent-memory: Updated to v0.2.8, adds unprivileged session-directory fallback, corrects BM25 ranking, and separates plugin tool names from OpenClaw's built-in memory tools, agents can recall more relevant memories and use both memory systems without naming conflicts (#3266, #3296, #3347)
• skillfs: Updated to v0.5.0, merges multiple Skill sources into a unified read-only view and adds Kubernetes delivery through Skill Ledger scanning and activation with automatic FUSE recovery, operators can distribute Skills more flexibly while controlling agent-visible access (#3200, #3182, #2701)
• ws-ckpt: Updated to v0.5.0, unifies workspace path identity, recovers interrupted initialization and unregistration, and provides guarded rollback for cosh-ng managed Tasks, users can recover workspace state safely across interrupted operations (#2911)

Updated

• cosh-ng: Updated to v0.26.0, adds /task submission for persistent Core/Codex Tasks with checkpoint policies and protected snapshot preview, diff, and switching; adds prefix search and Tab completion in /agent, automatic Provider naming and bounded, cancellable ECS RAM Role detection, native Bash 4+ login identity, and Intel macOS 11.0+ installation; hides the ownership status line by default, fixes readonly approval, system-directory traversal, /dev/null classification, and Hook request identification, and defaults diagnostic logging to info, users can reconnect to ongoing work and use restored workspaces with more reliable setup and shell interaction (#2911, #3438, #3224, #3298, #3358, #3448, #3449, #3345, #3208, #3436, #2708, #2710, #3248, #3331)
• agent-sec-core: Updated to v0.13.2, adds root-authorized V2 Policy/Scope/Binding APIs and CLI commands, AgentSight policy delivery with bounded concurrent reconciliation, daemon-backed Bash/Python regex scanning and capability queries, and compatible JSONL/SQLite scan-event records with trace-context correlation; unifies Skill Ledger inputs, skips unmanaged read-only Raw user Skills, bundles the pii-checker Skill with optional redaction, and delivers a hardened systemd service plus OpenClaw 2.0 capability consent and SQLite session evidence, administrators can manage policies and audit security outcomes without one failed binding blocking other processing (#3062, #3097, #3103, #3194, #3203, #3243, #3246, #3300, #3253, #3183, #3241, #3217, #3440)
• agentsight: Updated to v0.13.1, analyzes language, collaboration, testing, correction, and tool preferences with supporting user turns; adds contextual ATIF step queries by message, reasoning, and tool categories, reusable-trajectory labels with human review and search, and Linux 5.10/6.6 file-delete protection with domain isolation, violation events, and startup cleanup; fixes namespace PID resolution, enforcement event consumption, conversation_id initialization, silent macOS trajectory errors, and log filtering, and adds a Token Plan Provider preset, users can investigate and reuse historical runs with clearer evidence and more reliable observability (#3041, #3378, #3186)
• tokenless: Updated to v0.8.4, adds opt-in Git diff cropping that retains changed lines and file metadata, recoverable HTML-to-Markdown extraction with removed-element counts while preserving file reads, and shared search paths that retain matches, line numbers, and line endings; preserves output after </html>, handles SVG-heavy pages correctly, and provides rtk recall for retained truncated output; adds a standalone installer and install-tokenless Skill with failed-install recovery, ownership-aware uninstall that preserves runtime data by default, OpenCode support, and improved Claude Code activation, QwenPaw preflight, and repeated uninstall, agents can reduce more output and recover originals with safer installation management (#3299, #3306, #3173, #3386, #3396, #3273, #2322, #3324, #3346, #2193, #3289, #3412)
• anolisa: Updated to v0.3.15, adds OpenCode adapter enable/status/disable with custom config directories, conflict protection, and interrupted-operation retries, plus local cosh-ng diagnostic bundles with health findings in Markdown/JSON reports and no automatic upload; supports Yum 3/DNF 4 with exact versions, direct RPM metadata validation honoring system proxy/private CA settings, and local package queries or Raw installation without remote repositories; checks combined RPM install conflicts in root upgrade previews, distinguishes failed probes from missing components, verifies declared subpackage payloads, and redacts repository credentials, paths, and query strings while retaining origins, administrators get reliable lifecycle checks and actionable diagnostics (#3346, #3317, #3318, #3353, #3294, #3230, #3240, #3280, #3285, #3292, #3417, #3431)
• agent-memory: Updated to v0.2.8, falls back to private per-user runtime or temporary session directories with ownership, permission, and symlink checks, corrects BM25 ranking for search, hybrid retrieval, and automatic recall, and renames OpenClaw tools to anolisa_memory_search and anolisa_memory_get; declares all four tools in the coding profile, rejects the unsupported expert profile with guidance, strengthens sessionId/sessionDir validation and old-client shutdown ordering, and restores source-archive configuration, examples, and adapter assets, users can run without privileged session-directory setup and retain stable access to both memory systems (#3266, #3296, #3347, #3238, #3213, #3231)
• skillfs: Updated to v0.5.0, adds ordered multi-source mounts where earlier sources supply whole same-name Skill directories, copies read-only packages into a private writable source for Ledger scanning and activation, and prevents writes through the agent-visible mount; detects failures through real FUSE reads and attempts bounded remounts within the sidecar, while existing transformed SKILL.md handles retain consistent content and new handles see source updates with bounded caches and handle budgets, agents get stable Skill reads and operators can recover mounts with less impact on workload containers (#3200, #3182, #2701, #3202)
• ws-ckpt: Updated to v0.5.0, identifies workspaces by canonical path, rejects conflicting aliases, serializes concurrent initialization, and recovers interrupted init/unregister operations after daemon restart; adds guarded rollback V2 for managed Tasks, snapshots empty workspaces, fails fast with recovery guidance when directories are externally replaced, reports partial recover --all failures, and protects recovery data during failed recovery or removal while improving low-space handling; manages OpenClaw tool allowlists through its config CLI, preserves administrator-edited RPM configuration, and fixes Raw adapter discovery, users can trust snapshot outcomes and recover workspaces with fewer state conflicts (#2911, #3059, #3069, #3053, #3221, #3070)

Compatibility

• agent-memory OpenClaw tool names: Replace memory_search and memory_get in prompts and tool allowlists with anolisa_memory_search and anolisa_memory_get, restart the OpenClaw Gateway, and start a new conversation. Internal MCP names and stored memories are unchanged (#3347).
• ws-ckpt and cosh-ng version pairing: Managed Task guarded rollback requires ws-ckpt daemon 0.5.0 or newer. The ws-ckpt OpenClaw adapter requires OpenClaw 2026.2.13 or newer. Upgrade cosh-ng and ws-ckpt together and check the OpenClaw version before enabling the adapter (#2911, #3221).
• Tokenless installation requirements: npm requires Node.js 16.7 or newer. Linux source installation provides only the Tokenless CLI; RTK and framework adapters are supplied by npm. Prefer npm for full Agent integration and check resource ownership before switching installation methods (#2322).
• cosh-ng login shell behavior: Enhanced Bash uses native login shell identity by default on Bash 4+ and loads /etc/profile and ~/.bash_profile. Set shell.login_identity = false to retain the previous behavior (#3358).

[1.4] - 2026-09-10

Component Versions

Note: copilot-shell, os-skills, skillfs, and ws-ckpt are unchanged since v1.3; they are listed to show the complete stack composition.

Highlights

• cosh-ng: Updated to v0.24.1, routes natural-language and path-like input to the Agent in Enhanced Assisted Zsh while preserving ordinary Shell behavior and the user's terminal customizations, users get a more natural Zsh experience without rebuilding their existing setup (#3004, #3156)
• agent-sec-core: Updated to v0.12.0, applies configured policy checks consistently to legacy cosh and cosh-ng Skill calls while reducing false positives, users get consistent Skill enforcement and fewer incorrect security findings across both shells (#2871, #2928)
• agentsight: Updated to v0.12.1, adds collection without eBPF, native DashScope support, Kubernetes packaging, and more resilient long-running capture, operators can retain accurate observability in restricted and production environments (#2954, #2976, #3135, #3147)
• tokenless: Updated to v0.8.1, adds QwenPaw support and reversible compression for large JSON payloads, build logs, and CSV/TSV data, agents can reduce more kinds of context and retrieve omitted content precisely when needed (#3047, #3052, #3067, #3075, #3089)
• anolisa: Updated to v0.3.11, adds QwenPaw adapter management and ktuner discovery when the configured repository provides it while improving install, recovery, and audit behavior, administrators get more trustworthy lifecycle status and component-index previews without requiring root (#2084, #3075, #3127, #3141, #3142, #3158)
• agent-memory: Updated to v0.2.7, improves OpenClaw installation, corpus retrieval, configuration validation, and source-build setup, agents can share persistent memory with more reliable setup and recall (#2560, #3149, #3155, #3177, #3187)

Updated

• cosh-ng: Updated to v0.24.1, improves prompt routing, terminal redraws, history recall, custom Tab behavior, login-profile PATH loading, credential redaction, and Hook trust visibility while removing the system OpenSSL requirement, users can keep their existing shell configuration and receive reliable Agent assistance without losing commands, output, or sensitive-history protection (#2967, #2983, #2996, #2999, #3004, #3030, #3050, #3058, #3156)
• agent-sec-core: Updated to v0.12.0, applies the same Skill policies across legacy cosh and cosh-ng, reduces scanner false positives, reports every integrity outcome through skill-ledger and check, and speeds up container health checks, users get consistent enforcement, clearer verification results, and faster readiness checks (#2707, #2871, #2879, #2928)
• agentsight: Updated to v0.12.1, adds collection without eBPF, native DashScope and Kubernetes deployment support, Agent resource monitoring, and cosh-ng traffic capture while improving attribution accuracy, tool-result retention, enforcement synchronization, Token accounting, stream completion, duplicate suppression, startup recovery, and automatic capture recovery, operators can trust timelines and usage totals while keeping monitoring and protection running through long-lived workloads and transient failures (#2916, #2954, #2976, #2979, #3005, #3011, #3016, #3081, #3087, #3135, #3147, #3191)
• tokenless: Updated to v0.8.1, adds QwenPaw integration, reversible reduction for large JSON collections, build logs, and CSV/TSV output, omitted-content retrieval through existing Shell tools, and trace correlation while fixing installation and compatibility issues across supported hosts, agents can use less context across more tool results and recover the exact omitted data when needed (#2249, #3009, #3047, #3052, #3067, #3068, #3075, #3085, #3089, #3094)
• anolisa: Updated to v0.3.11, adds QwenPaw adapter lifecycle management and ktuner discovery from configured repositories, permits declared config edits without false corruption reports, records hook-modified files correctly, avoids false pending operations after package conflicts, enables component-index previews without root, and improves cleanup, logs, dry-run, and audit guidance, administrators can inspect and recover installations with state that better reflects the actual system (#2084, #2618, #2922, #2926, #2994, #3075, #3118, #3127, #3141, #3142, #3158)
• agent-memory: Updated to v0.2.7, negotiates OpenClaw installation capabilities, distinguishes permission and configuration failures, returns readable and accurately windowed corpus results, validates configuration before binary discovery, and prepares Node.js and npm dependencies for source builds, agents and operators get more reliable installation, diagnosis, and memory recall (#2560, #3149, #3155, #3177, #3187)

Compatibility

• Tokenless Protocol v2: tokenless compress now accepts only before_model, pre_tool, post_tool, and retrieve lifecycle requests; Protocol v1 and tokenless mcp serve have been removed. Upgrade Tokenless Core, CLI, SDKs, and adapters together and declare recovery capability explicitly to avoid protocol or retrieval mismatches (#2978, #3068).
• Tokenless Rust APIs: Replace TokenlessRuntime::compress with the Runtime lifecycle methods. Direct response-compression callers must migrate from the removed tokenless-pipeline crate and tokenless_schema::ResponseCompressor to the Runtime or tokenless-compressors APIs (#2974, #2978).
• Tokenless Python and AgentScope APIs: Replace the removed ModelRequest, ToolCall, ToolResult, and ToolResponseCompressor types with typed before_model, pre_tool, post_tool, and retrieve lifecycle requests. AgentScope integrations must add ToolContract metadata for custom tools and expose one static retrieval tool (#2986, #3029).
• Tokenless retrieval configuration: Custom retrieve_tool_name values must satisfy the tool-name rules. Lifecycle schema compression now requires an authorized static retrieval tool and an available Stash; without both, hooks preserve the original schemas. Recovering omitted content also requires a reachable CLI or static tool and a host that can replace the current tool result, including Claude Code 2.1.121 or newer. Existing <<tokenless:HASH>> markers remain readable (#2978, #2995, #3029, #3052, #3068).
• Tokenless adapter configuration: OpenClaw now uses post_tool_enabled for PostTool optimization; its former response, TOON, skip-tool, and shell-tool policy settings have been removed and no longer control compression. Remove those obsolete settings and configure post_tool_enabled when upgrading. DeepSeek Harness users must also remove adapter-specific thresholds and tool lists and use the shared compression policy. OpenClaw remains limited to lossless transcript updates without same-turn replacement or retrieval (#3009, #3036).
• Tokenless statistics fields: Dashboards and integrations must replace seam and compressor_chain with content_origin, applied_operations, and recoverability. The legacy SQLite columns remain for compatibility, but new records no longer populate them, so queries that keep using the old fields can return empty or incorrect reports after upgrading (#2978).
• AgentSight timestamps: Kernel event timestamps are now calibrated to host wall-clock time instead of container uptime. If NTP or an administrator steps the host wall clock while kernel events are queued, affected historical wall-clock timestamps cannot be reconstructed; persisted records are unaffected. Mark each wall-clock adjustment when analyzing timelines across it (#3128).
• agent-sec-core Python dependency: Python deployments and source builds now require cryptography 50.0.1 or newer. Refresh the environment from the exported requirements before upgrading custom installations (#3015).
• agent-memory source builds: Building the OpenClaw adapter from source now requires Node.js 20 or newer and npm. The unified user-mode build provisions them automatically; system-mode builds report missing tools during preflight (#3187).
• anolisa RPM previews: On DNF 4 systems, RPM install --dry-run requires sudo and may refresh repository metadata while checking solver conflicts. The check now runs before recovery journals are created (#3158).
• anolisa editable configs and state format: Allowing content edits to raw-installed type = "config" files does not change update or uninstall semantics, so back up customized configs before either operation. The new kind = "config" state records are unreadable by older CLI versions; before downgrading, also back up state and convert affected owned-file entries to kind = "file" to restore content-digest validation (#3142).

[1.3] - 2026-08-31

Component Versions

Note: copilot-shell and agent-memory are unchanged since v1.1; they are listed to show the complete stack composition.

Note: agent-sec-core follows a release-branch flow, so main still shows 0.11.0; the shipped 1.3 stack uses the sec-core/v0.11.1 tag, and the entries below describe behavior on that tag rather than on main.

Highlights

• cosh-ng: Updated to v0.22.2, added native shell integration with Shift+Tab Shell-only switching and card prefixes that mark output ownership, users can run a hook-free shell while still seeing which subsystem produced each line (#2759, #2832)
• agent-sec-core: Updated to v0.11.1, rebuilt the prompt scanner in Rust with updatable rule packs and an optional deep-analysis backend, and narrowed the invisible-character rule, users get faster prompt scanning with far fewer legitimate emoji and multilingual prompts flagged as critical injections (#2409, #2531, #2699, #2900)
• agentsight: Updated to v0.11.2, restores model-traffic capture on its own when it goes stale and now recognizes Bun-built Claude Code, users keep continuous observability without restarting the collector (#2782, #2792)
• tokenless: Updated to v0.7.14, added the unified tokenless compress entry point plus net-savings and Retrieve attribution in stats summary, adapters make at most one subprocess call and users can read estimated net token savings (#2844, #2885)
• ws-ckpt: Updated to v0.4.5, added k8s sidecar deployment (#2034, #2965) and a guarded checkpoint protocol with identity-fenced snapshots, users can checkpoint containerized workspaces and verify checkpoint state after a crash
• skillfs: Updated to v0.4.2, added Kubernetes sidecar deployment and optional mutual HMAC-SHA256 authentication for control and notify sockets, non-privileged workloads can consume a FUSE skill view across container namespaces (#2057, #2449)

Updated

• cosh-ng: Updated to v0.22.2, added a local gateway control plane exposed through cosh agent task|doctor|run, bounded transcript memory and a 32 MB run_command output cap, sub-millisecond interactive echo, automatic discovery of system extensions outside the package-managed root, and /hooks enable|disable layer disambiguation, and fixed terminal display and input routing (stray marker lines appearing after approved commands and slash commands, batch-pasted slash input, Han prompts containing paths, slash history recall, terminal left in raw mode after interrupts), security and audit gaps (hook-blocked commands running anyway in trust mode, approval batch races, malformed hook output silently passing tool calls through, fabricated exit codes for interrupted precmd markers), and packaging issues (RPM uninstall leaving a dangling login shell, gateway startup on systemd 255, dnf --dry-run false failures, missed awk system() calls in code scanning), users get a native shell with visible output ownership, bounded memory, and an auditable approval path (#2125, #2400, #2402, #2405, #2529, #2599, #2603, #2605, #2622, #2655, #2667, #2682, #2709, #2843, #2880, #2909, #2914, #2917, #2918, #2938, #2943, #2949, #2955, #2968)
• agent-sec-core: Updated to v0.11.1, added SkillFS HMAC peer authentication, an agent-sec-cli capabilities subcommand, and explicit CHECKED/PASSED/FAILED counters for verify, and stopped read-only system Skills from failing batch scans, placeholder set-policy/rotate-keys from reporting success, the daemon health check from over-reporting readiness, and non-loopback model service URLs from being accepted, users can audit Skills in cross-container deployments and trust CLI verification results (#2356, #2493, #2875, #2876, #2892, #2893, #2906)
• agentsight: Updated to v0.11.2, added historical agent activity views, semantic session search, a bilingual dashboard, LLM latency metrics, and store size limits, and fixed model-traffic capture that did not recover on its own, missing restart after the collector was killed for memory use, unbounded memory during event bursts, and interruption breakdowns that did not sum to the total, users keep long-running observability with bounded storage and self-healing capture (#2578, #2612, #2644, #2733, #2792, #2796, #2817, #2925)
• tokenless: Updated to v0.7.14, added the anolisa-tokenless Python wheel with framework-neutral lifecycles, AgentScope and DeepSeek Harness integrations, Gemini functionDeclarations schema compression, and a configurable array tail window, and fixed Codex double compression and inconsistent small-payload TOON handling, agents on more frameworks save tokens and can restore truncated payloads through the runnable command embedded in the marker (#2433, #2507, #2581, #2627, #2663, #2866, #2869, #2885)
• anolisa: Updated to v0.3.8, added verified prebuilt CLI archives for Linux x64/arm64 and macOS arm64, a native DSH adapter driver, container-runtime telemetry, and schema v2 target-based availability, and fixed raw installs expanding ${VAR} in rendered content, --quiet adapter output, --dry-run forget and restart previews, and systemd template instances left running after uninstall, users can install a standalone CLI per platform and preview operations without side effects (#2533, #2580, #2603, #2642, #2752, #2762, #2774, #2883, #2903)
• os-skills: Updated to v0.6.3, added the anolisa-component(os-skills) RPM capability, users can run anolisa upgrade for OS Skills even when the repository component index is unavailable (#2576)
• ws-ckpt: Updated to v0.4.5, added k8s sidecar deployment with a bilingual guide (#2034, #2965) and a guarded checkpoint protocol, and fixed a memory leak that eventually exhausted the daemon (#2554), loop-device checkpoint latency under concurrent IO (up to 5x lower) (#2523), orphaned images and loop devices after a failed bootstrap plus silent startup exits (#1956), config --global writes the daemon never loaded (#2813), and intermittent bootstrap failure when all loop devices are in use (#2965), users can checkpoint in containers with lower latency and actionable startup diagnostics
• skillfs: Updated to v0.4.2, added Kubernetes sidecar deployment, mutual HMAC-SHA256 socket authentication, an optional Alibaba Cloud Linux 4 sidecar image, and bounded backoff for startup reconciliation against a late notify daemon, and fixed categorized Skills not being found on flat normal-mode mounts, non-privileged workloads can consume an authenticated Skill view that converges automatically after a daemon restart (#2057, #2449, #2777, #2787, #2790, #2901)

[1.2] - 2026-08-14

Component Versions

Note: copilot-shell, agent-memory, skillfs, and ws-ckpt are unchanged since v1.1; they are listed to show the complete stack composition.

Highlights

• cosh-ng: Updated to v0.16.1, consolidated one-shot agent requests into /agent and converged the cosh-core and cosh-shell runtime paths with explicit protocol negotiation, users get one command for single agent requests and identical behavior from either runtime entry point (#2403, #2441)
• agent-sec-core: Updated to v0.10.1, unified hook policy controls so code scanning, prompt scanning, and observability are independently environment-gated across agent integrations, users can enable each protection per deployment without editing hook scripts (#2141, #2199, #2239)
• agentsight: Updated to v0.10.1, corrected turn boundaries and session continuity across cosh restarts, reclassified pause events as normal completions rather than interruptions (#2320), and added Codex trajectory conversion plus a dashboard that follows the browser locale, users get accurate cross-runtime trajectories in their own language
• tokenless: Updated to v0.7.6, added the OpenCode adapter and moved the Qoder adapter to native plugin and hook conventions, agents on both runtimes get command rewriting plus schema and response compression applied in place of the original tool output
• anolisa: Updated to v0.2.19, added package-family backend mapping for raw installs, adapter change notices after updates, and 2 GiB integrity degradation, administrators can install on minimal RPM/DEB hosts without large components being reported as damaged (#2018, #2271, #2314)

Updated

• cosh-ng: Updated to v0.16.1, added a raw packaging interface with cross-target build validation and portable macOS launchers, and fixed clock-skew input stalls, lenient streaming response decoding, sensitive file writes, raw-mode leaks on exit, predictable temporary paths, first-match-only slash hints, and CJK line wrapping, users get reproducible archives and a shell that wraps East Asian text correctly and leaves no terminal state behind (#2176, #2209, #2211, #2357, #2361, #2410, #2411, #2446)
• agent-sec-core: Updated to v0.10.1, added OpenClaw code-scanner block mode, wider prompt-scan inbound field coverage, read-only Skill analysis, raw Skill directories in ledger checks, manifest authentication before Skill package loading, and session/run filters for events queries, users can block risky code, inspect unpackaged Skills, and query security events by session (#2044, #2132, #2185, #2201, #2242, #2277)
• agentsight: Updated to v0.10.1, added Codex trajectory conversion to ATIF, process attribution on captured model traffic with ids resolved in the observer namespace (#2360), and dashboard localization, and fixed turns closing early when a tool call ended, pause events misclassified as interruptions (#2320), truncated streaming responses, QwenCode trace accuracy, sessions lost across cosh restarts, and unmapped cosh session temporary file writes (#2080), users get accurate cross-runtime trajectories in their browser locale
• tokenless: Updated to v0.7.6, allowed TOKENLESS_DATA_DIR to point outside the user home, hard-disabled Tool Ready pre-call checks and blocking, and fixed duplicate JSON Schema stashing, dry-run settings overridden by environment variables, and retrieve appending a trailing newline, agents recover stashed content in one retrieval and are no longer blocked by incorrect readiness results (#2380, #2386, #2396, #2399, #2425, #2434, #2487)
• anolisa: Updated to v0.2.19, added adapter change notices after anolisa update, Qoder native plugin lifecycle support, Codex hook trust persistence, OPENCLAW_STATE_DIR handling, and the standard JSON envelope for legacy commands, and migrated telemetry to SLS_PROJECT_PREFIX, users can manage adapters across frameworks and parse every JSON surface the same way (#2018, #2221, #2260, #2281, #2319, #2337)
• os-skills: Updated to v0.6.2, added the ktuner skill for deterministic kernel diagnosis, tuning, and rollback, removed legacy OpenClaw and Hermes adapter scripts, and documented authenticated Skill Ledger recovery, users get rule-based tuning advice they can apply and roll back in one step (#1172, #1278, #2185)

[1.1] - 2026-08-08

Component Versions

Note: os-skills remains at v0.6.1; it did not change in this release and is listed to show the complete stack composition.

Highlights

• cosh-ng: Updated to v0.14.0, added resumable workspace sessions, MCP management, runtime introspection, and DashScope prompt caching, agents can recover long-running work and extend capabilities while reducing repeated prompt cost (#1546, #1592, #1778, #1949, #2046)
• agentsight: Updated to v0.9.1, added optimization and trajectory analysis together with case containment, system audit, and ActPlane risk enforcement, users can diagnose agent quality and cost while investigating and containing risky behavior (#1728, #1789, #2051)
• agent-sec-core: Updated to v0.9.0, expanded prompt, PII, code, and observability hooks across Qoder CLI, Qwen Code, and Codex, users can apply consistent security policies across supported agent runtimes (#1473, #1480, #1495, #1501, #1529, #1535)
• tokenless: Updated to v0.7.3, added reversible compression with MCP retrieval plus Cosh-NG response and command compression, agents can reduce model context while recovering truncated payloads on demand (#1285, #1376, #1669)
• anolisa: Updated to v0.2.15, added exact-version RPM and raw installs, file-metadata repair, and interactive progress, administrators can select published versions and recover installation drift with visible operation phases (#1700, #1740, #1987, #2036)

Updated

• copilot-shell: Updated to v2.8.0, added the consent-gated /ktuner command, exported COSH_SESSION_ID, and reused compatible cosh-ng authentication during switching, users can tune hosts, correlate subprocess activity, and move between shells with less setup (#1279, #1491, #1951)
• agent-sec-core: Updated to v0.9.0, added Qoder CLI and Qwen Code hook coverage, Codex PII and observability hooks, custom PII rules, and Chinese prompt-injection detection, users receive broader protection across prompts, tool calls, skills, and agent output (#1473, #1495, #1501, #1522, #1554)
• agentsight: Updated to v0.9.1, added ATIF v1.7 trajectory analysis, accuracy/performance/cost workspaces, case containment, system audit, and risk dashboards, users can trace multi-agent behavior and act on optimization or security findings (#1728, #1789, #1828, #2051)
• tokenless: Updated to v0.7.3, added stash-backed reversible compression, an MCP retrieval server, Cosh-NG compression, and macOS/Qwencode adapter support, agents can save tokens across more runtimes without permanently losing compressed content (#1285, #1376, #1669, #1894, #1964)
• agent-memory: Updated to v0.2.6, added synchronous indexing plus focused-query and OR-ranked recall fallbacks, agents can retrieve newly captured memories from verbose or stopword-heavy prompts (#1520, #1574, #2047)
• anolisa: Updated to v0.2.15, added exact-version RPM and raw installs, telemetry controls, macOS arm64 npm delivery, file-metadata repair, and phase-based progress, users can select published versions across Linux and macOS, control reporting, and repair Linux installation drift (#1619, #1700, #1740, #1962, #1987, #2036)
• skillfs: Updated to v0.4.0, added Hermes nested-skill compatibility, configurable read-time transforms, authenticated live-source resolution, and hardened permission boundaries, agents can consume adapted skill views while source mutations remain safely controlled (#1146, #1484, #1517)
• ws-ckpt: Updated to v0.4.2, added telemetry gating and automatic recovery of orphaned pre-init backups, users can recover workspaces after interrupted initialization without stale backup state (#1509, #1601)
• cosh-ng: Updated to v0.14.0, added session recovery, MCP tools, slash-command introspection, and prompt-cache observability, agents can resume complex work, extend capabilities, and diagnose cache savings (#1530, #1546, #1592, #1778, #1949, #2046, #2075)

[1.0] - 2026-07-06

Component Versions

Highlights

• anolisa: Updated to v0.1.20, delivered unified CLI gateway with full component lifecycle and adapter orchestration, users can install/update/diagnose all components with a single command
• cosh-ng: Updated to v0.11.0, completed Core/Shell separation and AI-augmented terminal, Agent can execute structured OS operations deterministically across distros
• agent-memory: Updated to v0.2.1, added user data sovereignty and 4-type memory classification, users can query/forget/control auto-captured memories
• tokenless: Updated to v0.6.1, added compression toggle with A/B testing and QwenCode adapter, users can quantify Token savings per strategy without affecting task execution

New Components

• anolisa: First release v0.1.16, built unified CLI gateway managing component install/update/uninstall with dual-backend (RPM + Raw), users can deploy the entire ANOLISA stack with anolisa install --all
• cosh-ng: First release v0.11.0, implemented deterministic Agent-OS interface with 5-crate workspace, Agent can execute cross-distro structured system operations via stable API
• skillfs: First release v0.3.2, built FUSE virtual filesystem for agent skills with view-based SKILL.md exposure, Agent can discover and load skills from a mounted directory

Updated

• agent-memory: Updated to v0.2.1, added sovereignty tools (about/forget/consent), AMA export/import, 4-type classification, and incremental consolidation resilient to SIGKILL, users can control memory retention and migrate memories across agents
• tokenless: Updated to v0.6.1, added compression on/off toggle with dry-run mode, SLS JSONL telemetry default-on, and QwenCode adapter, developers can A/B test compression strategies and monitor Token savings in SLS dashboard
• agentsight: Updated to v0.7.1, added Token saving visualization (strategy pie chart + line-level diff), security dashboard, and container/K8s full support, users can visually assess which optimization saves the most Tokens
• copilot-shell: Updated to v2.6.1, added /model dialog for multi-provider switching and SLS session telemetry (32-field JSONL), users can freely switch LLM providers without losing configuration
• agent-sec-core: Updated to v0.7.0, added Skill Ledger integrity chain with GPG signing workflow and Prompt Scanner, users can audit skill security status and get confirmation prompts before risky operations
• os-skills: Updated to v0.6.1, added ANOLISA Guide knowledge skill (13 official docs) and OpenClaw pre-check with bootstrap, Agent can reference accurate product documentation in responses
• ws-ckpt: Updated to v0.4.1, added auto-cleanup scheduling and TOML config hot-reload, users can set retention policies that take effect without restarting the daemon

Changed

• Documentation governance established via specs/documentation-standard.md
• Bilingual naming convention unified to _zh.md (migrated from legacy _CN.md)

[0.6] - 2026-06-12

Component Versions

Highlights

• agent-memory: First release v0.1.0, delivered sandboxed filesystem MCP memory server, Agent can persistently store and retrieve context across sessions via BM25 search
• tokenless: Updated to v0.4.1, added Hermes Agent plugin and Tool Ready 4-stage pre-check, Agent environments are automatically validated before tool execution to avoid wasted retries
• agentsight: Updated to v0.5.0, added Skill-level Token metrics and Hermes support, users can pinpoint which Skills consume the most Tokens

New Components

• agent-memory: First release v0.1.0, built 19-tool MCP server with namespace isolation and BM25 background index, Agent can read/write/search persistent memory in a sandboxed filesystem
• cosh-ng: First release (MVP), completed production-ready functionality for deterministic OS operations, Agent can execute structured commands with predictable output format

Updated

• tokenless: Updated to v0.4.1, added Hermes adapter runner and Tool Ready mechanism (4-stage env pre-check as cosh extension), Agent tool calls are pre-validated reducing Token waste from environment failures
• agentsight: Updated to v0.5.0, added Skill-dimension Token/call metrics and Hermes matcher with SSL support, users can see per-Skill Token breakdown in the dashboard
• agent-sec-core: Updated to v0.5.0, added PIIChecker (output PII detection + desensitization) and Skill Scanner (text/code scan + lifecycle trigger), Agent output containing sensitive information is automatically intercepted
• copilot-shell: Updated to v2.4.1, added cross-session auto memory extraction and hook reason visibility in UI, users can see exactly why a security hook blocked an operation

[0.5] - 2026-05-28

Component Versions

Highlights

• tokenless: Updated to v0.4.0, added Hermes plugin and Tool Ready environment mechanism, Agent tool execution failures due to missing dependencies are prevented before Token consumption
• agent-sec-core: Updated to v0.4.0, delivered PIIChecker and Skill Scanner first version, Agent output is scanned for sensitive information leakage

Updated

• tokenless: Updated to v0.4.0, developed Hermes Agent plugin with Tool Ready 4-stage env pre-check and history compression, Agent runtime dependencies are auto-verified before execution
• agent-sec-core: Updated to v0.4.0, added PIIChecker for output PII detection and Skill Scanner baseline capabilities, users are protected from unintentional sensitive data exposure
• agentsight: Updated to v0.4.0, added Skill-level metrics display, users can view Token consumption grouped by Skill
• os-skills: Updated to v0.4.0, added Nightly automated test coverage, skill quality is continuously validated

[0.4] - 2026-05-13

Component Versions

Highlights

• agent-sec-core: Updated to v0.4.1, established Skill security full lifecycle with Prompt Scanner ask policy, users receive confirmation prompts before Agent executes risky instructions
• tokenless: Updated to v0.3.0, built 4-suite Benchmark comparison baselines, developers can quantify Token savings across different Skill/OS environments
• ws-ckpt: Updated to v0.2.0, expanded snapshot management commands, users can auto-clean historical snapshots by count or age policy

Updated

• agent-sec-core: Updated to v0.4.1, integrated Prompt Scanner into cosh hook and OpenClaw plugin with ask strategy, users get interactive confirmation before dangerous operations
• tokenless: Updated to v0.3.0, built batch-concurrent Benchmark platform with comparison reports, developers can one-click benchmark and compare Token savings across configurations
• agentsight: Updated to v0.4.0, optimized resident process memory footprint, 2C2G small-spec instances can run observability stably
• copilot-shell: Updated to v2.3.0, adapted SWEBench evaluation framework, developers can execute code-fix tasks and verify pass rates via cosh
• ws-ckpt: Updated to v0.2.0, enriched snapshot CRUD capabilities, users can manage workspace checkpoints with flexible retention policies

[0.3] - 2026-04-30

Component Versions

Highlights

• tokenless: Updated to v0.2.0, delivered command rewriting and TOON context compression, CLI output Token consumption reduced by 60–90%
• agentsight: Updated to v0.3.1, added Token saving Dashboard and Agent anomaly diagnostics, users can visualize savings and detect Agent interruptions
• agent-sec-core: Updated to v0.3.0, added Skill Ledger integrity tracking and Prompt Scanner, every Skill's signature chain is auditable end-to-end

New Components

• ws-ckpt: First release v0.1.0, built btrfs-based workspace checkpoint daemon, Agent can create sub-millisecond snapshots and instantly rollback filesystem state

Updated

• tokenless: Updated to v0.2.0, added command rewriting via RTK and TOON context compression, Agent CLI interactions consume 60–90% fewer Tokens
• agentsight: Updated to v0.3.1, added Token saving Dashboard (session/time-range stats) and Agent interrupt detection with drain mechanism, users can monitor savings trends and get alerted on Agent failures
• agent-sec-core: Updated to v0.3.0, added Skill Ledger full lifecycle (check/certify/bypass/status/audit) and Prompt Scanner with jailbreak detection, users can track and enforce Skill integrity policies
• copilot-shell: Updated to v2.2.1, added extension architecture (command extension + system Hook + instant activation), Skill marketplace integration, and session export (Markdown/HTML/JSON), users can extend cosh capabilities via plugins and export conversation history
• os-skills: Updated to v0.3.0, added Skill marketplace listing, Hermes install skill, and utility skills (xlsx/pdf-reader/image-gen/humanizer), users can discover and install skills from a marketplace

[0.2] - 2026-04-15

Component Versions

Updated

• agentsight: Updated to v0.2.2, added Token consumption observability with precise Tokenizer counting, users can view per-message Token breakdown in real time
• copilot-shell: Updated to v2.0.4, added independent auth (STS/ECS RAM Role) and Skill marketplace browsing, users can authenticate without AK/SK and discover available skills
• os-skills: Updated to v0.2.2, added SysAdmin skills (Linux IO/network/load diagnostics), Agent can independently diagnose common OS performance issues
• tokenless: First release v0.1.0, built Skills-level benchmark test cases, developers can compare Token consumption across different Skills quantitatively

[0.1] - 2026-03-30

Component Versions

New Components

• copilot-shell: First release v2.0.1, built AI-powered terminal assistant with Tab completion, /bash mode, sudo support, and hook security, users get an AI-native CLI experience on first login
• agent-sec-core: First release v0.1, delivered Skill signature verification, security sandbox, and system hardening, Agent operations run in a controlled least-privilege environment
• agentsight: First release v0.1, built eBPF-based zero-intrusion observability probe, users can monitor LLM API calls and Token consumption without modifying Agent code
• os-skills: First release v0.1, curated system administration, SysOM, DevOps, and cloud skills, Agent can autonomously perform common OS operations

Security

• Skill full-link encryption with digital signatures
• Hardware-level security sandbox for risk isolation
• Identity authentication and integrity verification for Skill calls

For detailed changelogs of individual components, see:

User Entrypoint

• copilot-shell
• cosh-ng
• anolisa
• os-skills

Token Saving

• tokenless

Runtime

• agent-memory
• skillfs
• ws-ckpt

Agent Observability

• agentsight

Agent Security

• agent-sec-core

Changelog

All notable changes to ANOLISA will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[0.3.21] - 2026-11-02

Added

• Activate managed cosh extensions through cosh's native registry when running anolisa adapter enable <component> cosh. Status verifies the selected user source and enabled state; disable releases only the matching source selection and preserves system extensions and user-edited files. Use a cosh-ng build supporting conditional source cleanup and restart existing cosh sessions after enable or disable; resident-session loading remains unknown (#9352).

Changed

• Ship component discovery and integration contracts with ANOLISA in RPM, prebuilt archives, npm platform packages, and installer data bundles. RPM install and adopt retain these contracts for adapter management and recognize standalone core packages. Keep the CLI's bin/ and share/ directories together when moving an installation. For RPM upgrades, upgrade ANOLISA and all installed older component packages that own the registry files together in a single DNF/Yum transaction. The enabled repositories must provide the compatible CLI, component packages, and required subpackages at the same time. Rollback requires matching component packages and registry data (#9222).
• Render Agent Memory MCP command paths for the selected installation layout, including paths containing quotes or backslashes, while preserving other JSON fields. Agent Memory 0.2.13 raw packages require ANOLISA 0.3.21 or later (#9222).
• Update the component catalog to Agent Memory 0.2.13, AgentSight 0.15.1, cosh-ng 0.28.1, OS Skills 0.6.4, agent-sec-core 1.1.2, SkillFS 0.5.5, Tokenless 0.9.2, and ws-ckpt 0.6.1.

Fixed

• Preserve ANOLISA's component discovery files during raw installation, update, rollback, repair, and uninstall. Existing archives can install beside the registry, and obsolete ownership records no longer treat registry changes as component damage or delete the registry during cleanup. This also applies when recovering quarantined records. New raw packages that omit registry installation require ANOLISA 0.3.21 or later (#9351).

[0.3.20] - 2026-10-29

Added

• Add --no-deps to anolisa install for raw artifacts, including --all, so users who manage runtime dependencies separately can skip their checks and installation. Successful installs print a reminder to stderr unless --quiet is set; batch installs print it once when any component was installed. RPM rejects this option, and default dependency handling remains unchanged (#9126).

Changed

• Update the component catalog to Agent Memory 0.2.11, AgentSight 0.15.0, SkillFS 0.5.4, and Tokenless 0.9.0.

Fixed

• Explain how to recover when adapter status or disable, including dry-run, rejects a path outside the allowed framework directories. Human and JSON errors now advise checking framework directory configuration and ancestor symlinks, and restoring the original directory if it was redirected. Boundary checks, retained installation records, and exit codes are unchanged (#9220).

[0.3.19] - 2026-10-25

Changed

• Report container deployments as container in telemetry and anolisa register status instead of inheriting the host's cloud product. Consumers of product_type must accept the new value. An explicit PRODUCT_TYPE in /etc/anolisa-release still takes precedence; refresh or remove stale declarations when building container images (#8206).
• Update the component catalog to Agent Memory 0.2.10, AgentSight 0.14.3, cosh-ng 0.28.0, Copilot Shell 2.8.0, OS Skills 0.6.3, SkillFS 0.5.3, Tokenless 0.8.8, and ws-ckpt 0.6.0.

Fixed

• Preserve user-added and edited files when disabling OpenClaw and Hermes skills, and refuse activation into occupied directories that ANOLISA does not own. Redirected or dangling directory ancestors stop cleanup and retain the installation record for retry after the original path is restored. Older records without per-file ownership still use whole-directory cleanup after the same path checks (#6221).
• Keep the npm launcher working when the complete installation, including its platform dependency, is moved. Existing installations can obtain the relative launcher by rerunning postinstall (#8278).
• Honor --json for successful telemetry enable, disable, link, unlink, upload, and init operations, including --quiet --json. Return the standard response envelope with operation-specific state while keeping warnings on stderr (#8706).
• Warn when a Raw install or update declares a hook phase that the CLI cannot execute. A non-strict hook allows the operation to proceed; a strict = true hook refuses the operation before download or file replacement. Repair remains available for older installations with unsupported hook declarations (#6447).

[0.3.18] - 2026-10-15

Added

• Manage Tokenless plugins in QwenWorkCN macOS local mode with anolisa adapter enable tokenless qwenwork. Support QwenWorkCN 1.2.5, preserve ownership records for interrupted operations, and require existing script installations to be uninstalled before adoption. Restart the desktop application and check activation there; CLI status verifies files and reports loading and activation as unknown (#7368).

Changed

• Update the Tokenless version in the component catalog to 0.8.7.
• Update the Agent Memory version in the component catalog to 0.2.9.
• Update the SkillFS version in the component catalog to 0.5.2 and recognize Linux ARM64 releases when compatible artifacts are available.
• Recognize Linux ARM64 releases for ws-ckpt and resolve its OpenClaw and Hermes plugin bundles from the prebuilt package layout.

Fixed

• Reject Raw updates that introduce conflicts with installed components before replacing files, preserving the installed version and its management records (#7635).
• Keep payload-provided Raw post-uninstall hooks runnable after removing component files, preserve shared hooks at their original locations, and clean temporary hook copies after success or failure without following staging symlinks (#6450).
• Allow failed OpenClaw installations to be disabled and retried when installation was rejected before changing the host or the plugin is confirmed absent. Preserve cleanup records when host state cannot be verified, including interrupted retries (#7197).
• Create new installation directories with 0755 permissions even under umask 077, preserving permissions on existing directories and symlink targets.
• Reject unresolved variable references in --repo overrides before fetching repository metadata and explain that a resolved URL is required.
• Apply sandbox kernel requirements to dry-run previews as well as installation, retain explicit --force previews, and reject malformed requirements before reporting a successful plan (#7294).
• Reject unknown legacy registration-record versions, preserving existing records and consent state instead of attempting an unsupported migration.

[0.3.17] - 2026-10-11

Added

• Add --no-accept-capabilities to OpenClaw adapter activation to withhold automatic capability consent during both installation and activation. Existing authorization is unchanged; this does not enable an unsafe-install bypass (#3554).
• Add the sec-core raw backend to the component catalog, allowing raw installation when compatible artifacts are available in the release index (#6551).

Changed

• Update the SkillFS version in the component catalog to 0.5.1.
• Update repository URLs to agentic-os-org/ANOLISA and correct the clone directory in source-build instructions.
• Correct Intel Mac installation guidance: the website installer accepts both ARM Macs and Intel Macs running macOS 11 or later. Prebuilt and npm installation requires a release containing darwin-x64 artifacts.

Fixed

• Validate configured RPM backends before install and preview preflight checks, preserving explicit repository overrides and failing early on missing setup.
• Limit installer permission changes to files installed by the current operation, preserving existing shared files and directories. Newly created installation paths remain accessible under umask 077.
• Repair npm launchers whose previous targets are missing, restoring the anolisa command.
• Resolve explicit archive file paths accurately instead of choosing another file with the same name. Distinguish local file-write errors from network errors to avoid ineffective download retries.
• Revalidate repository URLs after variable expansion and use independent temporary files when updating repository configuration.
• Redact sensitive URL information from raw repository and self-update terminal errors.
• Correct upgrade suggestions to use anolisa update self for the CLI and valid anolisa update <component> commands for components.
• Give Codex components separate marketplace directories to avoid interference, and revoke the corresponding hook trust when disabling a plugin.
• Verify host state after a failed Hermes disable operation, retaining plugin files and management records when the plugin remains enabled so it can be retried.
• Recognize aliases of adapter parent directories while retaining checks on the final plugin link. Honor only absolute XDG_CONFIG_HOME values.
• Compare actual instants for anolisa logs --since <RFC3339>, handling time-zone offsets, fractional seconds, and inclusive boundaries correctly.
• Skip corrupt or truncated records during log queries and complete a torn trailing record's newline before appending, preserving subsequent records.
• Verify rotated log file identity before resuming telemetry reads. Retry HTTP 408/429 uploads without advancing read offsets for failed batches.
• Complete telemetry processing before exiting on SIGTERM, reducing the risk of losing the final batch. Reset retryable metadata acquisition each round and retry transient cloud-init failures in subsequent rounds.
• Count CPUs correctly in lists containing multiple ranges or individual IDs.
• Drain hook output while commands run to avoid pipe blockage causing false timeouts, and let the privileged helper exit promptly after replying to a shutdown request.
• Reject unparseable schema versions when modifying registration state, and preserve existing records and consent state when a record cannot be read.
• Reject malformed or overflowing kernel version requirements rather than treating them as satisfied.
• Clarify that cosh-ng bug-report diagnostics must run inside the affected cosh session.

[0.3.16] - 2026-09-23

Added

• Add prebuilt CLI archives and the @anolisa/cli-darwin-x64 npm package for Intel Macs running macOS 11 or later. The website installer remains ARM-only until Intel Mac installation is enabled separately (#3448).

Changed

• Recognize Intel macOS as a supported target for cosh-ng in the component catalog, allowing ANOLISA to resolve compatible releases when available (#3448).

[0.3.15] - 2026-09-22

Fixed

• RPM-installed adapters can now verify and use files split across declared subpackages, including adapter bundles and shared skills. Missing packages or unverifiable files still stop activation instead of accepting unverified inputs (#3417).
• RPM transaction and upgrade preflight errors now redact repository credentials, paths, and query strings from native package-manager diagnostics, including configured URLs containing whitespace. HTTP(S) origins remain visible for troubleshooting (#3431).

[0.3.14] - 2026-09-20

Added

• Manage OpenCode local plugins with anolisa adapter enable tokenless opencode, anolisa adapter status tokenless, and anolisa adapter disable tokenless opencode. Existing links to the same plugin can be adopted, conflicting user entries are preserved, and interrupted changes can be retried. Custom configuration directories are supported through OPENCODE_CONFIG_DIR. Restart OpenCode after enabling or disabling; runtime loading remains reported as unknown (#3346).
• anolisa bug --component cosh-ng now exports a local diagnostic bundle and includes its health findings and collection summary in Markdown and --json reports. COSH_SHELL_BIN can override the installed binary. Failed collection provides a reason and a manual retry command; --dry-run skips collection, and bundles are never uploaded automatically (#3317).

Fixed

• anolisa bug --component <name> now finds visible system installations from user mode and reads recent logs from the installation's scope. Unreadable cross-scope logs produce a warning without aborting the report (#3317).

[0.3.13] - 2026-09-20

Changed

• RPM installs, updates, removals, and dependency preflight checks now support Yum 3 and DNF 4. ANOLISA prefers yum and uses dnf only when yum is absent; requested versions remain exact, and system restrictions such as version locks cause a failure instead of silently selecting another version (#3318).
• RPM candidate queries now read and validate the configured repository metadata directly, without requiring dnf repoquery. Repository access honors proxy and private CA settings in /etc/yum.conf, or /etc/dnf/dnf.conf when the former is absent. Local package queries and Raw installs also work without a configured RPM repository; errors from a configured repository are still reported (#3318, #3353).
• Raw installs now name the requested platform and list published alternatives when the component has no installable artifact for the host OS and architecture, including in --json errors, making platform gaps distinguishable from unknown component names (#3326).

Fixed

• Runtime dependency checks, provisioning, and anolisa doctor now consistently recognize RPM and Debian derivative distributions through ID and ID_LIKE. Unsupported package families receive manual installation guidance instead of selecting an unrelated package manager from PATH (#3318).
• Cloud metadata collection now continues reading other fields after an HTTP error or empty response for one key, preserving available instance information in telemetry snapshots. Connection and transfer failures still stop subsequent queries to an unreachable endpoint (#3308).

[0.3.12] - 2026-09-16

Changed

• anolisa upgrade --dry-run now checks the combined set of new RPM installs with the native dependency solver when run as root. Conflicts appear as errors; non-root previews remain available with an explicit warning that install conflicts were not checked. Rerun with sudo and preserve any --target option to perform the check (#3294).
• The bundled ws-ckpt adapter metadata now requires OpenClaw >=2026.2.13, preventing adapter enablement on older hosts whose config writes can persist expanded environment values and runtime defaults (#3239).

Fixed

• anolisa adapter enable <component> openclaw now explicitly activates the plugin after installation, restoring plugins left disabled by a previous uninstall. Capability consent is detected separately for activation, and --dry-run includes the activation command (#3223).
• Sandbox install and uninstall now honor DNF's exit status even when its output contains phrases such as “already installed” or “No match”. Failed installs no longer continue to later setup phases or record success (#3226).
• RPM package and file-owner queries now distinguish clean absence from database and command failures, avoiding false “not installed” observations (#3230).
• Raw component service management now reports failed systemctl is-active queries instead of treating them as missing units; valid inactive and failed service states remain supported (#3240).
• Runtime dependency checks now stop automatic provisioning when RPM queries fail or system-package and language-runtime probes encounter permission, execution, or signal failures. anolisa doctor retains the diagnostic and recommends inspecting the probe instead of installing a supposedly missing dependency (#3280, #3285).
• Debian runtime dependency checks now distinguish usable packages, absent packages, incomplete package states, and query failures. Incomplete states require manual recovery before provisioning; doctor directs users to inspect the package state. Multi-Arch queries select the native architecture unless the dependency explicitly requests one (#3292).

[0.3.11] - 2026-09-09

Added

• Register ktuner in both component catalogs for Linux x86_64 RPM discovery and installation when the configured repository provides it (#2084).

Changed

• anolisa adapter enable <component> openclaw now accepts the plugin's declared capabilities when the host advertises --accept-capabilities. Unsafe-install bypass still requires separate explicit authorization (#3126).
• status and doctor now allow content edits to raw-installed type = "config" files, including directory-expanded files, while still checking presence, file type, path safety, permissions, and capabilities. Legacy state recovers config kinds where the installed manifest is unambiguous. Update and uninstall behavior is unchanged; back up edited configs before those operations. Older CLI versions cannot read the new kind = "config" state: before downgrading, back up state and change those owned-file entries to kind = "file", restoring content digest checks (#3142).

Fixed

• OpenClaw adapter cleanup can now finish when uninstall reports no tracked package and plugins list --json confirms the plugin is absent with clean diagnostics. Inconclusive results retain cleanup ownership for a retry (#3118).
• Component index reads now use a temporary private cache when the system cache is not writable, allowing ordinary users to resolve components for previews while retaining index validation. RPM install preflight still requires root with DNF 4 (#3127).
• Fresh raw installs now record file digests after post_install and post_enable hooks, avoiding false corruption reports for hook-written content while detecting subsequent changes to immutable files. Repair and update still restore the package payload without replaying install hooks (#3141).
• RPM installs, including --dry-run and merged install --all transactions, now check DNF conflicts before creating recovery journals, so solver refusals no longer leave false pending operations. Use sudo for RPM --dry-run with DNF 4; the check may refresh repository metadata (#3158).
• anolisa list now uses the same authoritative RPM package mapping as install, preventing legacy aliases or stale provider declarations from showing the wrong component as installed (#3158).
• anolisa forget now directs journal-only pending operations to anolisa repair <component> instead of reporting nothing to forget, preserving the recovery evidence (#3158).

[0.3.10] - 2026-09-06

Added

• QwenPaw plugin adapters can now be discovered, enabled, inspected, and disabled through anolisa adapter. For Tokenless packages that include the QwenPaw bundle, use anolisa adapter enable tokenless qwenpaw. Installation and removal use QwenPaw's CLI and verify the resulting plugin files; failed removal preserves the plugin directory and receipt for a retry, and cleanup uses the working directory recorded at enable time (#3075).

Fixed

• anolisa logs --limit N now returns the most recent N matching records in append order, with the oldest record in that window first, instead of returning the earliest matches. The default limit of 50 therefore shows recent activity as logs grow, and scanning existing logs no longer blocks new records from being appended (#2618).

[0.3.9] - 2026-09-02

Added

• Applied and failed anolisa update self operations now enter the central operation log with their version and apply-mode context. Administrators can audit them through anolisa logs, while generated bug reports include only failed records and redact credentials from handled update URLs; previews and already-current no-ops remain log-free (#2994).

Changed

• Newly shipped Raw repository configurations no longer advertise the unused cache_ttl_secs and offline_fallback settings. Existing configurations containing either field remain compatible, while Raw resolution continues to fetch the current distribution index and fail when it is unavailable (#3002).

Fixed

• Global and command-local sandbox uninstall dry-runs now show the planned package changes without applying them, while system-mode telemetry mutation previews return before privilege checks or side effects (#2922, #2926).
• Commands without a preview implementation now reject global --dry-run before dispatch. Sandbox remove plus kernel and security install reject both dry-run forms with INVALID_ARGUMENT and confirm that no action was taken, instead of reaching mutation, privilege, or not-implemented paths (#2952, #2957, #2961).
• The standalone installer now detects when PATH still resolves anolisa to another installation, reports both paths and versions, and provides a directly runnable PATH fix or matching npm/Homebrew removal command instead of printing an unqualified success message (#2944).

[0.3.8] - 2026-08-26

Added

• Tagged ANOLISA releases now include verified prebuilt CLI archives for Linux x64, Linux arm64, and macOS arm64. Users can download a standalone binary archive for each supported target directly from the GitHub Release (#2883).

Fixed

• Raw installs now preserve ${VAR} references in rendered file content for shell and systemd consumers, while continuing to expand nested ANOLISA layout placeholders and reject environment references in destination paths. anolisa install cosh-ng --backend raw can now install the gateway service template instead of rejecting its EnvironmentFile=-backed workspace reference as an unknown placeholder (#2903).

[0.3.7] - 2026-08-25

Changed

• Source and RPM builds now require Rust 1.93, with the rustup toolchain pinned to 1.93.1 and Cargo dependency resolution constrained by the declared MSRV. Builders can use the newest compiler packaged by Alibaba Cloud Linux 4 without Cargo selecting dependencies that exceed the supported compiler; older Rust toolchains must be upgraded (#2810).

Fixed

• anolisa --dry-run restart <component> now lists the units that would be restarted without invoking systemctl daemon-reload or systemctl restart. System-mode previews read recorded state without taking the exclusive install lock, so they no longer require write access to the state root (#2774).

[0.3.6] - 2026-08-22

Fixed

• anolisa --quiet adapter scan and anolisa --quiet adapter status now suppress all non-error human output, including empty-state messages and result tables, while --json continues to emit the standard envelope. Agents can rely on quiet adapter inspection producing no human output (#2752).
• anolisa --dry-run forget <component> now refuses a component that still has enabled adapters with the same INVALID_ARGUMENT, exit code 2, and adapter disable guidance as the real operation. Previews no longer report that an impossible forget would succeed, while unrelated adapter receipts remain ignored (#2762).

[0.3.5] - 2026-08-20

Fixed

• Uninstalling a component with a bare systemd service template now stops every loaded instance through name@*.service before disabling the declared name@.service template. Template-backed services no longer remain running after anolisa uninstall, while individual stop failures continue to surface as warnings without blocking cleanup (#2603).

[0.3.4] - 2026-08-19

Changed

• Component-targeting commands now use the repository component index as the sole authority for names absent from local state. Installed and recovery identities remain usable offline, while unsupported names return INVALID_ARGUMENT, an unavailable index returns EXECUTION_FAILED, and NOT_INSTALLED now reliably means a supported component is absent. A --repo override also governs identity and package selection for the whole invocation, so site-local package mappings and RPM Provides metadata can no longer establish unrecognized component names (#2637).

Fixed

• Missing local Raw repository index errors now identify whether the active repository came from the exact repo.toml path or a one-off --repo override and provide matching recovery guidance. Users no longer need to guess which source configured the missing repository (#2650).

[0.3.3] - 2026-08-18

Added

• Telemetry instance snapshots now include the detected container runtime as instance.container for Docker, Podman, containerd, Kubernetes cgroups, and LXC, while bare-metal hosts omit the field. This gives downstream deployment statistics and troubleshooting a container-aware signal without collecting container or pod identities (#2642).

Changed

• anolisa status <component> now validates new targets against the component index, resolves package aliases, rejects unsupported names with anolisa list guidance, and directs telemetry service targets to anolisa telemetry status. Exact installed identities remain inspectable when repository metadata is unavailable (#2626).

Fixed

• Raw adapter bundle installs now preserve each archive file's mode and record the effective mode for integrity checks. Framework hooks and scripts retain their executable bit instead of being installed uniformly as data files (#2619).

[0.3.2] - 2026-08-17

Added

• ANOLISA now provides a native DSH adapter driver for plugin bundles. anolisa adapter enable <component> dsh --profile <name> accepts repeatable profiles, validates the bundle identity, delegates profile changes to DSH, and remembers the enable-time DSH home so status, disable, and re-enable keep targeting the same profiles even if DSH_HOME or the working directory changes. Disable DSH adapters before downgrading to an earlier ANOLISA release (#2580).
• anolisa logs --level <LEVEL> is now a visible alias for the existing --severity option, with the same validation and filtering behavior while severity remains the canonical JSON field (#2558).

Changed

• anolisa list and anolisa install --all now evaluate component availability against an exact OS and architecture target from schema v2 components-v2.toml. JSON output replaces platforms and platform_available with targets and target_available; repository publishers must deploy the v2 index beside the unchanged v1 index (#2533).

Fixed

• anolisa --dry-run install now reads meta.toml beside the resolved Raw artifact before falling back to version-level metadata only when the sibling file is absent. Previews now validate the selected target's contract, reject corrupt published metadata instead of masking it, and still avoid downloading the artifact (#2551).
• System-helper status now reports unknown when systemctl cannot be started and reports failed only for a unit whose actual state is failed (#2604).

[0.3.1] - 2026-08-13

Fixed

• Adapter discovery now excludes undeclared shared resource directories unless a contract, receipt, or built-in framework driver identifies them as real adapters. Shared assets such as Tokenless common hooks no longer appear as unsupported frameworks in adapter scan and status output (#2502).

[0.3.0] - 2026-08-12

Fixed

• Adapter enable, status, and update now derive adapter revisions from ANOLISA-owned Raw files or native package metadata instead of hashing whole resource trees. Runtime caches and other unowned files no longer cause false drift or get copied into frameworks, while changed package-owned inputs block enable before framework mutation and unavailable metadata is reported with an unknown status (#2419).
• Re-enabling adapters now removes only stale materialized files recorded by the previous receipt, preserves runtime-created files, previews the cleanup with --dry-run, and retains the old receipt when a directory-to-file replacement would discard runtime data (#2438).

[0.2.20] - 2026-08-11

Changed

• anolisa list now announces the detected host platform and reports component availability instead of backend and ownership columns in human-readable output. Components unsupported on the host remain visible with their supported platform and no install action, while JSON adds platforms and platform_available without removing backend or ownership metadata (#2367).

Fixed

• npm installs now keep @anolisa/cli as the sole owner of the public anolisa executable. With npm 10, local installs reliably create node_modules/.bin/anolisa instead of losing the command when platform packages are linked (#2345).

[0.2.19] - 2026-08-10

Fixed

• Raw installs that provision system dependencies now map resolver-provided rpm and deb package-family hints directly to the matching package manager backend. Minimal supported hosts no longer report an unsupported package base merely because the optional which command is absent, while distro-specific hints remain compatible (#2314).
• anolisa --json osbase sandbox list and anolisa --json register status now use the standard success envelope with ok, schema_version, and command metadata and nest business fields under data. Scripts can parse these legacy commands the same way as other JSON surfaces (#2319).
• OpenClaw adapters now honor OPENCLAW_STATE_DIR with OpenClaw-compatible whitespace, tilde, and absolute-path handling, keeping plugins, skills, receipts, status, and disable operations on the configured state. Re-enabling safely migrates resources recorded under the legacy fallback, preserves the old receipt when cleanup must be retried, and previews the migration during --dry-run. If an older receipt used an OPENCLAW_HOME that is no longer present in the environment, temporarily restore it before migration or cleanup (#2337).

[0.2.18] - 2026-08-06

Changed

• Telemetry upload now treats SLS_PROJECT_PREFIX as an SLS project prefix and appends the detected region, for example anolisa-cn-hangzhou. Deployments that set the legacy SLS_PROJECT must migrate to SLS_PROJECT_PREFIX so uploads reach their region-specific project (#2260).

Fixed

• Raw installs now stream only selected archive payloads through private, disk-backed staging instead of retaining uncompressed contents in memory. Large packages can install with bounded payload memory while preserving atomic placement, rollback, cleanup, and digest verification (#2250).
• anolisa status and anolisa doctor now hash ANOLISA-owned files up to 2 GiB and treat larger files as unchecked and degraded instead of failed. Intact components with large artifacts no longer appear damaged or trigger spurious repair, while recovery still fails closed when verification is required (#2271).
• Enabling a Codex adapter that declares hooks now discovers the installed plugin's hook identities and atomically persists their trusted hashes, so non-interactive codex exec sessions can run them. Missing hooks or overridden trust settings stop enablement with actionable diagnostics (#2281).

[0.2.17] - 2026-08-05

Added

• Raw installs can now render layout placeholders such as {bindir} and {datadir} inside declared text files before placement, so shared package templates follow the selected install scope and prefix. Integrity checks and repair use the rendered bytes (#2222).

Changed

• Raw repository resolution now prefers the generation-2 index when published and enforces each component's minimum CLI version. Incompatible entries fail with an anolisa update self hint instead of silently installing an older or malformed result, while generation-1 repositories remain compatible (#2222).
• RPM-backed adapter scan, status, and enable operations now use a declared package-owned resource root and report a missing or invalid root instead of falling back to stale raw files. Codex adapters that target an external RPM root record a trust anchor; disable them before downgrading to 0.2.16 (#2222).

Fixed

• Qoder native plugin bundles now use Qoder's own plugin lifecycle instead of being copied or rewritten as legacy hook bundles. Existing same-ID plugins across user and project scopes are protected, and unverified installs or removals retain a retryable receipt rather than claiming or deleting user state (#2221).

[0.2.16] - 2026-08-03

Added

• Successful anolisa update <component> and anolisa update all operations now report adapters whose resource bundles changed, with the exact anolisa adapter enable ... or anolisa adapter status ... follow-up command. JSON responses expose the same information through stable adapter_actions arrays (#2018).

Fixed

• Raw system-scope installs on Debian-family hosts no longer fail with rpm not found on PATH when both RPM tooling and an RPM database are absent. An existing or newly appearing RPM database still stops the raw install before files change (#2061).

[0.2.15] - 2026-07-30

Added

• Interactive anolisa install, anolisa install --all, and anolisa uninstall now display phase-based activity during long-running planning and execution. ANSI-capable terminals animate the current phase, while limited interactive terminals print static phase lines (#2036).

Changed

• Human-readable failures now use conventional error: and hint: labels without exposing machine codes. --json retains structured error codes, and exit statuses remain unchanged.
• Update notifications now quote the recommended sudo anolisa upgrade and anolisa update --check commands so their boundaries are clear.

[0.2.14] - 2026-07-29

Fixed

• anolisa status and anolisa doctor now detect Unix mode and Linux file capability drift for raw-managed files, including installations recorded by earlier releases, and recommend anolisa repair for recovery.
• anolisa repair now replays raw-managed components when only file metadata has drifted, restoring declared modes and confirmed capabilities. Failed updates restore only capabilities known to have been active before the operation, avoiding optional grants that never applied (#1987).

[0.2.13] - 2026-07-28

Added

• The @anolisa/cli npm package now supports macOS arm64 and selects the matching native binary during installation.
• Tokenless adapters now support Qwencode while keeping the Cosh extension independent from shared hook assets.

Fixed

• Raw installs now refuse to provision a system package reserved by another pending RPM install and direct the user to anolisa repair, preventing components from claiming or later removing each other's dependencies.
• cosh-ng RPM installations now retain the cosh-ng component identity. Unambiguous legacy records and recovery journals stored as cosh are repaired so lifecycle commands target the correct component.
• Failed raw updates and repairs now restore file permissions and capabilities during rollback, keeping restored binaries executable.
• Enabling the Tokenless Qoder adapter now resolves shared hook paths in the cached plugin, preventing matching tool calls from failing because of broken hook commands.

[0.2.12] - 2026-07-27

Changed

• Commands that act on an installed component now report an absent target as NOT_INSTALLED instead of INVALID_ARGUMENT, so a caller can tell "there was nothing to act on" from "the invocation was wrong" without parsing the error message. The code reports state absence only, and does not indicate whether the name was valid. Affects uninstall, update, repair, forget, restart, and adapter; the exit code stays 2 (#1915).

Fixed

• Adapter status now ignores empty or incomplete stale source directories and reports missing bundles as degraded; raw uninstalls prune empty directories so another installation scope cannot be shadowed (#1850).
• Raw install dry-runs now validate component conflicts before execution, keeping preview results aligned with real installs. Repositories without lightweight sidecar metadata warn that conflict validation was skipped (#1898).

[0.2.11] - 2026-07-24

Added

• Raw anolisa install --version now installs the exact published component version.
• Raw anolisa install --version output now reports requested and resolved versions, artifact URL, and source repository.

Changed

• Raw anolisa install --version now lists published alternatives when the requested version is unavailable.

Fixed

• Raw anolisa install --version no longer installs another version when the requested version is unavailable.
• Raw component uninstalls with many files now complete faster and write substantially less data.
• Recovery now preserves installed state when operation recovery data is missing or corrupted.

[0.2.10] - 2026-07-23

Added

• anolisa telemetry now lets administrators enable or disable data collection.
• anolisa telemetry now lets administrators link or unlink named reporting.
• anolisa telemetry status now reports collection and named-reporting states in text or JSON.
• Adapter enable and disable commands now display component-provided follow-up notices.
• Adapter JSON output now includes structured component-provided notices.
• anolisa install --version JSON output now includes requested and resolved versions, source repository, and exact RPM.

Changed

• Fresh ANOLISA RPM installations now enable anonymous telemetry by default.
• RPM installation output now explains how to disable telemetry.
• Enabled telemetry now resumes automatically after restarts on supported hosts.
• anolisa register now warns that the command is deprecated.
• anolisa register now enables telemetry without prompting.
• anolisa register status now directs users to anolisa telemetry status.
• anolisa unregister now disables telemetry while preserving local logs.
• anolisa install --version now selects the exact host-compatible RPM matching the requested version.
• anolisa install --dry-run --version now validates availability and displays the resolved RPM details.
• Adapter dry-runs now preview component-provided notices without changing the host.
• Adapter quiet output now suppresses component-provided notices.

Fixed

• anolisa register now prevents duplicate uploads from earlier telemetry configurations.
• anolisa unregister no longer leaves earlier telemetry configurations reporting.
• anolisa install --version no longer changes the host when the requested RPM is unavailable or incompatible.
• anolisa install --version no longer records success when a different RPM version is installed.
• anolisa repair now rejects interrupted RPM installs whose installed version differs from the original request.
• anolisa repair now reports when an interrupted RPM install's architecture cannot be verified.
• anolisa adapter disable now shows saved follow-up notices even when component files are unavailable.
• Adapter notices can no longer inject terminal formatting into human-readable output.

[0.2.9] - 2026-07-22

Added

• anolisa update all now updates every tracked raw and RPM component while leaving the CLI unchanged.
• anolisa repair now restores damaged raw installations from their recorded versions.
• anolisa repair now supports user-scope installations without root privileges.
• anolisa repair now recovers interrupted install, update, adopt, uninstall, and batch operations.
• anolisa repair now reinstalls missing managed RPM packages.
• anolisa status now reports unclassified legacy records as needs-attention with scope-aware repair and forget guidance.
• anolisa status and anolisa doctor now run health checks from each installation's saved component manifest.
• User-mode adapter commands can now target visible system installations.
• anolisa repair can now restore unclassified legacy records from installed packages or intact files.
• anolisa forget can now remove unclassified legacy records without touching installed files or packages.

Changed

• anolisa install now refuses unmanaged system RPMs and directs users to anolisa adopt.
• anolisa install now succeeds without changes when the component is already tracked.
• anolisa adopt now makes existing RPMs updatable while keeping package removal opt-in.
• anolisa adopt now succeeds without changes for already adopted packages.
• anolisa update now requires observed-only RPMs to be adopted first.
• anolisa install --all now applies new RPM packages in one package transaction.
• anolisa upgrade now applies planned RPM updates in one package transaction.
• anolisa upgrade now applies planned RPM installs in one package transaction.
• anolisa list and anolisa status now show separate user and system rows for shadowed components.
• anolisa list now labels tracked installations as owned, managed, adopted, or observed.
• anolisa --install-mode user install can now create a user installation beside a visible system installation.
• Lifecycle mutations now remain within the selected scope, including package aliases.
• The first modifying command now upgrades legacy state and preserves installed.toml.v4.bak.
• Newer state formats now produce an error instead of appearing empty.
• install-anolisa.sh now leaves distribution index retrieval to the CLI, keeping mirror data current.
• install-anolisa.sh now stages only OS-base manifests because component manifests are fetched when needed.
• install-anolisa.sh --strict now validates only binary and manifest bundle checksums.
• ANOLISA_INDEX_URL and ANOLISA_INDEX_SHA256 no longer affect install-anolisa.sh.
• Lifecycle JSON output now includes explicit plans across install, adopt, update, repair, and uninstall.
• Uninstall JSON output now uses one schema for raw and RPM components, including package removal and plans.
• anolisa uninstall --dry-run now reports missing components as errors instead of empty successful plans.
• anolisa forget and anolisa restart now stop while an earlier component operation needs recovery.
• anolisa doctor now reports incomplete operations even without an active component record.

Fixed

• RPM-managed components no longer fail status or doctor because of raw-install health checks.
• RPM component updates now refresh saved component manifests before reporting success.
• Incomplete RPM manifest refreshes now appear in anolisa logs --severity warn.
• Interrupted RPM updates now remain repairable instead of appearing successful with stale settings.
• anolisa doctor no longer recommends lifecycle commands when recovery data is unreadable or ambiguous.
• anolisa doctor no longer duplicates recovery findings across components sharing one state location.
• anolisa doctor --help now states that --fix remains unavailable.
• Batch RPM failures now preserve repairable state for packages that changed.
• Component aliases no longer redirect lifecycle changes into a different installation scope.
• Health checks for user services now use the correct service manager across installation scopes.
• Failed batch RPM operations now retry unaffected components individually.

[0.2.8] - 2026-07-21

Added

• anolisa adapter enable now supports --allow-unsafe-plugin-install for explicitly authorized OpenClaw plugin installation.
• OpenClaw adapter settings can now target specific OpenClaw versions.

Changed

• anolisa adapter enable now checks OpenClaw compatibility before making changes.
• anolisa adapter enable now verifies OpenClaw plugins are loaded before reporting success.
• When OpenClaw blocks an unsafe plugin, ANOLISA now shows the reported findings.
• When supported, OpenClaw safety errors now suggest retrying with explicit unsafe authorization.

Fixed

• Failed OpenClaw setting updates can now be retried without losing track of affected settings.
• Re-enabling an OpenClaw adapter no longer loses track of settings applied by an earlier successful enable.
• anolisa adapter disable now warns when OpenClaw settings may remain after an uncertain update.

[0.2.7] - 2026-07-18

Added

• anolisa adapter now manages Qwen Code extensions through the qwen CLI for Qwen Code 0.17 and newer.

Changed

• anolisa upgrade and anolisa repair now explain component manifest reconciliation in human and JSON output.

Fixed

• anolisa upgrade now refreshes component manifests after RPM package upgrades.
• anolisa upgrade now reconciles same-version RPM component manifest changes.
• anolisa repair now refreshes stale component manifests from the installed RPM.
• Failed component manifest refreshes now keep RPM components repairable and report the affected component.

[0.2.6] - 2026-07-16

Fixed

• anolisa status no longer reports healthy RPM-managed components as failed.

[0.2.5] - 2026-07-14

Added

• anolisa repair now recovers interrupted fresh RPM installs after the package has been installed.
• anolisa update --check now reports RPM components whose saved state requires reconciliation.

Changed

• Install, adopt, and upgrade commands now require interrupted RPM installs to be repaired before continuing.

Fixed

• Concurrent RPM installs now fail safely instead of overwriting another operation's component state.
• Reinstalling a missing ANOLISA-managed RPM now preserves the component's settings and history.
• anolisa uninstall --dry-run --json now includes dry_run: true and omits removal phases for components that are not installed.
• anolisa upgrade now refreshes saved RPM versions and package details after upgrades.
• anolisa upgrade now reconciles older RPM records that lack package details.

[0.2.4] - 2026-07-13

Added

• anolisa update --check now shows progress while checking for updates in interactive terminals.
• anolisa upgrade now shows progress while planning and applying upgrades in interactive terminals.

Fixed

• Raw component installs and updates now choose installable archives even when binary releases are also listed.

[0.2.3] - 2026-07-12

Changed

• Package installation and removal progress now uses stderr, keeping command output safe for redirection.

Fixed

• ANOLISA commands now exit cleanly when a downstream pipeline closes standard output early.
• ANOLISA commands now report standard output write failures instead of silently succeeding.

[0.2.2] - 2026-07-09

Added

• anolisa update --check now reports RPM upgrade opportunities without changing state.
• anolisa update --check --motd now prints a short login-friendly upgrade summary.
• anolisa upgrade now applies RPM image upgrades for RPM-managed toolchains.
• anolisa upgrade now installs missing default components from the selected target profile.
• anolisa adapter scan now marks enabled receipts with missing sources as orphaned.
• anolisa adapter status now reports missing adapter sources as degraded receipts.

Changed

• anolisa list now shows component scope for visible user and system records.
• anolisa status now shows scope, mutability, shadowing, and state path metadata.
• anolisa doctor now includes readable system components in user-mode diagnostics.
• anolisa doctor now suggests system-mode commands for read-only system records.
• anolisa update --check now uses the latest target profile when --target is omitted.
• anolisa update --check --motd now points users to sudo anolisa upgrade when action is needed.

Fixed

• anolisa uninstall, forget, and update now reject read-only system targets with system-mode guidance.
• anolisa upgrade now reports unresolved target defaults as check errors.
• anolisa upgrade now warns when refreshed RPM details are unavailable after an upgrade.

[0.2.1] - 2026-07-08

Added

• anolisa adapter enable now supports Tokenless adapters for cosh, Codex, and Claude Code.
• anolisa adapter enable now supports Tokenless adapters for Qoder.

Changed

• Claude Code adapters now use per-component marketplaces to avoid affecting other ANOLISA plugins.
• anolisa adapter enable now rejects invalid framework and adapter_type combinations before changing settings.

Fixed

• Codex adapters now work when component resources come from packaged data directories.
• Qoder adapter enable now keeps malformed settings.json unchanged instead of replacing it.
• Qoder adapter disable now removes only hook entries previously added by ANOLISA.
• Qoder adapters now prefer stable qodercli releases over matching prereleases.

[0.2.0] - 2026-07-07

Added

• Raw components can now declare conflicts to block incompatible raw installs.

Fixed

• anolisa install now rejects raw component conflicts before changing the host.
• anolisa install --dry-run now reports raw component conflicts instead of showing an invalid plan.

[0.1.20] - 2026-07-03

Added

• ANOLISA can now be distributed as @anolisa/cli with Linux x64 and arm64 binaries.
• repo.toml now enables the npm backend for component distribution.

Changed

• anolisa list now shows local state, ownership, and next action for each component.
• anolisa list --json now includes RPM package, version, architecture, and source repository details.

Fixed

• RPM installs and updates now keep system repositories available for dependencies.
• Adapter commands now distinguish missing component manifests from invalid manifests.

[0.1.19] - 2026-07-02

Fixed

• anolisa adapter disable --dry-run now previews cleanup without removing adapter receipts or resources.
• Read-only commands now use downloaded repo config when saving repo.toml fails.
• Component commands now accept package aliases consistently when targeting installed components.
• Ambiguous package aliases no longer choose an arbitrary installed component.
• Unknown component names now report no match without querying packages.

[0.1.18] - 2026-07-01

Added

• anolisa install now auto-installs missing system packages for raw components in system mode.
• anolisa install --dry-run now labels unresolved dependencies as auto-install or manual.
• anolisa install now reports packages auto-installed during raw component installs.
• anolisa status --verbose now shows packages auto-installed for each component.

Changed

• Commands that need repo access now download and validate repo.toml on first use.
• Repo config dry-runs now fetch and validate without writing repo.toml.
• RPM install and update now use only the repo.toml RPM repository.
• User-mode raw installs now report missing dependencies with install commands before changing files.
• Failed raw installs now list any auto-installed packages left on the system.
• anolisa update self no longer fetches repo config before checking CLI updates.

Fixed

• anolisa list --installed now includes adopted RPM components.
• anolisa list now shows adopted, failed, and disabled component statuses.
• Adapter commands now prefer resources from the datadir that supplied the component contract.
• RPM installs now fail before dnf when [backends.rpm] is missing.
• RPM updates now explain missing [backends.rpm] instead of using host repositories.

[0.1.17] - 2026-06-30

Added

• Repository components.toml can now define component names, package aliases, and raw/RPM package mappings.
• anolisa list --installed now filters installed components.

Changed

• anolisa list and install --all now read components from components.toml instead of catalog.json.
• anolisa list now shows NAME, SUMMARY, BACKENDS, and STATUS.
• anolisa list --enabled is now a hidden alias for --installed.
• ANOLISA_CATALOG_URL no longer changes list sources; configure repo.toml instead.
• anolisa install, status, adopt, and repair now resolve RPM package aliases from components.toml.
• anolisa status now suggests sudo anolisa adopt <component> for untracked RPM components.

Fixed

• anolisa status <RPM package> now reports the canonical component row when an alias is installed.
• anolisa repair <RPM package> now refreshes the canonical component row when an alias is used.
• Non-root anolisa osbase mutations now reach the system helper instead of failing install-mode checks.
• Commands now reject root --install-mode user before writing ambiguous user-mode state.
• System-mode write commands now fail before changes when sudo is missing.
• Existing installs with managed symlinks no longer show false symlink integrity failures after upgrade.
• anolisa status now reports referent_mismatch when managed symlinks point elsewhere.

[0.1.16] - 2026-06-29

Added

• anolisa osbase sandbox install runc now installs runc, containerd, Docker, and Docker client.
• anolisa osbase sandbox install now enables services declared by sandbox scenarios.
• anolisa osbase sandbox install now runs scenario verification commands after installation.
• anolisa osbase sandbox install now records sandbox scenarios in installed.toml.
• anolisa osbase sandbox install now reports optional scenario packages as hints.
• rund, firecracker, and gvisor sandbox scenarios now define post-install checks.
• anolisa adapter enable now supports adapter_type = "skill_bundle" for OpenClaw and Hermes skills.
• The RPM package now installs default repo.toml to /etc/anolisa/repo.toml.
• ANOLISA telemetry setup now installs log rotation for ops .jsonl files.

Changed

• anolisa osbase sandbox install --dry-run now shows preflight, package, service, verify, and state phases.
• anolisa osbase sandbox install runc now requires Linux kernel 4.18 or newer.
• anolisa osbase sandbox install now reports verification failures as warnings when other phases succeed.
• repo.toml now points RPM installs to the agentic-os repository path.
• anolisa update self --json now reports apply mode, RPM package, and RPM version observations.
• anolisa adapter status now treats skill bundles as healthy without plugin registration.
• anolisa adapter enable now rejects skill bundles that declare framework config entries.

Fixed

• RPM-backed commands now use the component name as the default package name.
• anolisa update self now delegates RPM-owned CLI updates to dnf.
• Non-root sandbox installs now show package, service, verify, and state phases.
• Telemetry setup now runs the ilogtail installer with bash-compatible script handling.
• anolisa adapter disable now cleans skill bundles without plugin unregister errors.

[0.1.15] - 2026-06-25

Added

• anolisa doctor now reports component health, dependency status, and suggested fixes.
• Raw components can now declare runtime dependencies for install and update preflight checks.
• anolisa install --dry-run now previews runtime dependency status for raw components.

Changed

• anolisa install and update <component> now refuse raw components with missing runtime dependencies before changing files.
• anolisa restart <component> now restarts service units shipped by RPM-backed components.
• anolisa restart <component> now shows guidance for RPM-backed template services instead of failing.

Fixed

• anolisa adapter enable now expands {datadir} from the package that provided the adapter metadata.
• After anolisa uninstall or forget, adapter commands no longer see stale component metadata.

[0.1.14] - 2026-06-24

Added

• Raw components can now place systemd unit files with {unitdir}.
• Raw components can now place user service unit files with {userunitdir}.
• User-mode anolisa install now activates declared user-scope services.

Changed

• User-mode anolisa install now resolves %u service templates to the current user.
• System-mode anolisa install now preserves %u user service templates for later per-user activation.
• anolisa uninstall now reloads systemd after removing declared service unit files.
• anolisa restart <component> now restarts user-scope services from user-mode installs.

Fixed

• anolisa install now starts freshly installed service units without a manual systemd reload.
• anolisa uninstall now deactivates user-scope services from user-mode installs.
• anolisa adapter enable now finds {datadir} skills from the package directory that provides the adapter.

[0.1.13] - 2026-06-23

Added

• anolisa adapter enable now supports Hermes plugins.
• anolisa adapter enable now installs declared OpenClaw skills.
• anolisa adapter enable now applies declared OpenClaw config values.
• anolisa install now starts declared services for raw components.
• anolisa install now applies declared file capabilities for raw components.
• anolisa install now runs declared hooks for raw components.
• anolisa update <component> now restarts declared services for raw components.
• anolisa update <component> now reapplies declared file capabilities for raw components.
• anolisa uninstall now runs declared hooks for raw components.
• anolisa uninstall now disables declared services after stopping them.

Changed

• anolisa adapter scan now honors declared adapter resource locations.
• anolisa adapter enable now reads package-installed adapter resources.
• anolisa install --dry-run now previews declared capabilities for raw components.
• anolisa register status now reports the latest registration after repeated changes.
• Cancelled anolisa register and unregister prompts now exit successfully.

Fixed

• anolisa adapter status now detects OpenClaw plugins from wrapped table output.
• anolisa adapter status now ignores bundled Hermes plugins during checks.
• anolisa adapter commands now find metadata shipped by RPM-installed components.
• anolisa register status now reports sysom console registrations as active.

[0.1.12] - 2026-06-22

Added

• anolisa update <component> can update raw-managed components from the raw backend.
• anolisa osbase sandbox list shows scenarios from sandbox.toml.
• anolisa osbase sandbox uninstall <scenario> can remove packages for a sandbox scenario.
• anolisa system setup can install the helper service for non-root osbase commands.
• anolisa system status can show helper health, version, uptime, and last operation.
• anolisa system teardown can remove the helper service and sandbox config.
• anolisa env --json includes distro identity fields.

Changed

• anolisa osbase sandbox install <scenario> now installs scenarios defined in sandbox.toml.
• Omitting --install-mode now selects system for root and user otherwise.
• anolisa update <component> --dry-run now lists raw backend candidate versions.

Fixed

• Legacy yum backend names in repo.toml and --backend now resolve to rpm.
• Raw components installed with --package now update from the same package name.
• anolisa update <component> now refuses raw updates that would downgrade a component.
• anolisa update <component> now refuses raw updates when versions cannot be safely compared.

[0.1.11] - 2026-06-18

Added

• anolisa adopt <component> can track a pre-installed system RPM without installing it.
• anolisa repair <component> can refresh RPM component state after package details change.
• anolisa forget <component> can stop tracking a component without removing packages or files.

Changed

• anolisa status <component> now reports drifted RPM components when system package details change.
• anolisa uninstall now keeps observed system RPMs unless --remove-system-package is used.
• anolisa install now preserves adapter package resources when adopting RPM components.

[0.1.10] - 2026-06-17

Added

• anolisa install --backend rpm can install missing RPM components through dnf and track them as managed.
• anolisa install can adopt matching pre-installed system RPMs without downloading a raw package.
• anolisa update <component> can update RPM-managed and RPM-observed components through dnf.
• anolisa status now shows package, version, architecture, and source repo for RPM-backed components.
• anolisa status <component> now reports matching untracked system RPMs as observed.

Changed

• anolisa update runtime <component> is now anolisa update <component>; self and all stay subcommands.
• repo.toml now uses [backends.rpm] instead of [backends.yum].
• anolisa install --all now lists adopted RPM components in the batch summary.

Fixed

• anolisa install --all now prints the reason for each failed component in human output.
• anolisa install now refuses automatic RPM detection when rpm or dnf is missing, with a --backend raw hint.
• anolisa install no longer replaces a raw install if another install finishes first.

[0.1.9] - 2026-06-16

Added

• anolisa install --all can install every available component from the catalog.
• anolisa install --all --fail-fast can stop after the first failed component.
• anolisa install --all --json returns one batch summary with per-component results.
• anolisa status now shows adapter summaries for installed components.

Changed

• installed.toml now distinguishes ANOLISA-managed packages from observed system RPMs.

[0.1.8] - 2026-06-15

Added

• anolisa adapter enable can now register installed adapters with OpenClaw.
• anolisa adapter disable can now remove OpenClaw adapter registrations.
• anolisa adapter status can now report OpenClaw adapter health.
• anolisa adapter scan can now show installed adapter resources.

Changed

• anolisa install now places adapter resources needed by later enablement.
• anolisa uninstall now blocks components that still have enabled adapters.

[0.1.7] - 2026-06-13

Changed

• User-mode library paths now resolve to ~/.local/lib/anolisa; other directories continue to follow XDG_* overrides.

Fixed

• anolisa install no longer requires a local catalog entry before downloading from the remote repository.
• anolisa install --dry-run can preview files and services without downloading the full package.

[0.1.6] - 2026-06-12

Added

• anolisa osbase sandbox install gvisor now supports standalone, containerd, and substrate deployments. (#851)
• anolisa list can derive the component catalog from repo.toml configuration. (#854)

Changed

• Replaced the legacy "capability" model with a unified component lifecycle; old state auto-migrates on next write. (#876)

Fixed

• anolisa list --enabled now correctly shows installed components instead of an empty list. (#872)
• anolisa list no longer requires a separate local catalog file when repo.toml is configured. (#854)

[0.1.5] - 2026-06-11

Added

• anolisa list reads from a remote or local component catalog and returns structured JSON. (#850)
• anolisa install <component> downloads, verifies, and installs components from the remote repository. (#852)
• anolisa uninstall supports the new component model while preserving legacy fallback. (#852)

Changed

• Simplified CLI help around list, install, uninstall, status, doctor, logs, restart, update. (#850)

Fixed

• anolisa list returns an empty list with a config hint when no catalog is configured. (#850)
• Failed installs now automatically roll back partially-written files. (#852)

[0.1.4] - 2026-06-10

Added

• anolisa adapter scan detects available framework integrations. (#808)
• anolisa adapter install downloads verified packages and registers adapters with the target framework.
• anolisa adapter remove safely removes only ANOLISA-managed files, with dry-run and JSON preview support.
• anolisa adapter install tokenless openclaw wires up the tokenless adapter via the OpenClaw CLI.
• anolisa enable fetches component metadata from the remote repository, with offline fallback.
• anolisa status now includes component health check results.

Changed

• Renamed subscription commands to top-level anolisa register / unregister.

Fixed

• Adapter install/remove failures now roll back or preserve state for retry.

[0.1.3] - 2026-06-09

Added

• anolisa --help now groups commands by category (everyday vs. management).
• list command shows its ls alias in help output.
• anolisa update self prints a changelog link on success.

Changed

• Corrected package license metadata to Apache-2.0.

[0.1.2] - 2026-06-08

Added

• anolisa bug generates a local diagnostic report with environment info and recent error logs.
• anolisa self update added as an alias for anolisa update self.

Fixed

• Restored the bug report issue template.

[0.1.1] - 2026-06-07

Added

• anolisa osbase sandbox install provisions sandbox environments (firecracker and e2b backends).
• anolisa register / unregister manages data-upload consent with 30-day deferral.
• anolisa enable can configure log upload (ilogtail) with automatic region detection.
• anolisa update self downloads and applies CLI updates with integrity verification and rollback.
• Real dnf/apt package manager backends replacing placeholder stubs.
• GitHub Actions CI for the anolisa workspace.

Fixed

• Install script uses portable bash expansion instead of sed.

[0.1.0] - 2026-06-04

Initial alpha release of the ANOLISA CLI.

Added

• CLI commands: env, list, status, logs, enable, disable, uninstall, restart, update, info, doctor.
• Environment detection: OS, arch, kernel, distro, container runtime, user identity (graceful degradation).
• Component lifecycle engine with preview-then-execute, integrity checks, and audit logging.
• Configuration-driven feature gates for shipping new capabilities without code changes.
• Declarative TOML component manifests with multi-architecture support.
• install-anolisa.sh installer with three modes (local, checkout, URL), checksum verification, and --dry-run.
• End-to-end smoke tests for agent-observability and token-optimization.

Capabilities shipped

Known limitations

• Real-execute paths are Linux-only (darwin hosts can --dry-run only).
• No signature verification or rpm/deb backend yet.
• update command returns NOT_IMPLEMENTED.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[0.2.13] - Unreleased

Changed

• Choose the memory runtime and OpenClaw integration separately using the core and plugins RPMs.
• Raw installations render the MCP command for the selected binary directory.

Fixed

• Honor configured embedding provider environment fields when the provider is selected in TOML; changing embedding models can require rebuilding vectors.
• Prevent retired OpenClaw plugin instances from restarting their memory worker during reload or disposal.
• Avoid publishing vectors for files whose text indexing failed in the same pass; a later successful scan retries them.
• Reject overlapping ambiguous mem_edit matches before changing content.
• Report mem_export scan or read errors instead of silently producing an incomplete archive.
• Clean up incomplete destinations after failed mem_promote or create-only mem_write calls so they can be retried.
• Restore nonempty read-only snapshot directories with their permissions intact and clean up failed staging before retry.

[0.2.12] - 2026-10-28

Fixed

• agent-memory: Updated to v0.2.12, enforces persisted capture consent on each automatic OpenClaw observation through memory_capture, including changes made by another client; denied or failed captures remain retryable and successful captures appear in memory_auto_created. Upgrade the server and adapter together; an older server rejects the new hook call without falling back to manual observation. Manual writes remain available and existing observations are not relabeled (#8865)
• agent-memory: Attributes new observations to MCP_CLIENT_NAME immediately, so the observing agent can recall them under isolated scope and another agent's filtered search excludes them. Existing untagged index rows are not backfilled by restarting or running mem_index_refresh (#7776)
• agent-memory: Prepares complete replacements for mem_edit and mem_write overwrites before publishing them, preserving original content on preparation failures. Replacement requires readable/writable directories on one filesystem, Linux procfs and space for the new content; custom ownership and host security-label policies need validation, and other hard links retain old content. A reported post-publication sync failure means the new content is already visible; read it before retrying (#8982)
• agent-memory: Restores only the requested file with mem_revert, preserving Git HEAD, staged changes and other files' pending edits; its response now identifies the source commit. Stage the restored file explicitly before a manual commit if its previous contents remain staged (#9082)
• agent-memory: Validates gzip checksums and completion before publishing a restored snapshot, so damaged or truncated archives fail while the current memory files remain intact (#7631)
• agent-memory: Watches memory changes before startup indexing, refreshes resized files even when their timestamps are unchanged, and preserves newly indexed children when an old file becomes a directory, keeping keyword and vector results current across these startup cases. Rewrites retaining both timestamp and size remain outside the scan fingerprint's guarantee (#8880, #9127, #9089)
• agent-memory: Treats dotted filenames and AND, NOT, and OR as literal keyword-search text, so agents can recall terms such as config.toml without search-syntax errors; space-separated terms retain the existing all-term search and partial-match fallback (#8012)
• agent-memory: Reports unreadable search-index rows with recovery guidance instead of returning successful empty or partial results, making keyword, vector and hybrid search failures visible without creating spurious interests or lessons from failed searches (#8854)
• agent-memory: Preserves complete Unicode characters when shortening OpenClaw recall queries, preventing split emoji and malformed query prefixes (#4730)
• agent-memory: Bounds session-log tail reads to 1 MiB and preserves UTF-8 boundaries, so oversized recent entries no longer make log reads fail or falsely appear empty; an oversized entry may still be returned as a partial tail (#7896)
• agent-memory: Normalizes ASCII control characters in imported AMA frontmatter keys, values and list items to spaces, preventing injected metadata lines or premature frontmatter termination; these characters are intentionally not preserved during import (#4626)
• agent-memory: Preserves concept and file rankings in memory_summary after AMA export/import and keeps literal commas, quotes and backslashes within single-line list entries, so summary counts remain accurate without rewriting existing imported files (#8862)
• agent-memory: Preserves complete MEMORY.md link destinations when shortening long titles or descriptions, allowing agents to follow long paths while retaining the overall index size limit (#3621)
• agent-memory: Returns valid unified patches from mem_diff with one pair of file headers and correctly escaped control characters in filenames, so consumers can parse and apply the result (#3575)
• agent-memory: Keeps supersession markers inside valid leading frontmatter and logs failed index updates while retaining new facts, avoiding edits to ordinary note bodies and making repeated consolidation conflicts diagnosable (#3517, #3532)
• agent-memory: Leaves unrepresentable N days ago and N 天前 phrases unchanged during consolidation, preventing date overflow failures and accidental replacement with today's date (#9144)
• agent-memory: Honors ANOLISA_DRY_RUN=1 in OpenClaw install and uninstall scripts, previewing the applicable actions without installing, removing files or rewriting configuration; installation may still run the read-only CLI help probe (#7755)
• agent-memory: Lists all 38 runtime tools in the packaged MCP catalog, enabling descriptor-based clients to discover the previously omitted session, summary, context, profile and index-refresh tools (#9148)

[0.2.11] - 2026-10-25

Fixed

• agent-memory: Updated to v0.2.11, applies fact-category filtering before the keyword search result limit, so matching memories remain discoverable when other categories rank higher; this also covers short Chinese queries and fallback to keyword search, with case-sensitive category names. Vector/hybrid searches with an embedding provider still filter categories after truncation (#8721)
• agent-memory: Applies the configured cold-memory exclusion and filters superseded memories before vector ranking and result limits, so excluded memories no longer crowd eligible results out of vector and hybrid searches (#3805)
• agent-memory: Invalidates stale vectors after content edits and removes old search entries when files exceed the indexing size limit or stop being UTF-8, preventing keyword and vector results from serving obsolete content (#3803, #3820)
• agent-memory: Removes only the requested path and its literal descendants from the index, preserving unrelated memories with wildcard-like characters or different letter casing in their names (#3801)
• agent-memory: Skips redundant indexing and embedding calls for unchanged files after directory attribute updates, reducing embedding usage while preserving missing-vector recovery and files deleted and restored within one watcher batch (#8477)
• agent-memory: Serializes concurrent automatic incremental consolidation and releases its guard after an unwind, preventing duplicate facts and allowing later automatic consolidation to continue; episodes retaining identical tool calls are deduplicated before applying budgets, while distinct tasks and recovery episodes remain separate (#8303, #8305)
• agent-memory: Skips sanitized search-length markers when deriving interests and user profiles, preventing new len=N interests while preserving legacy recorded queries; previously generated junk facts remain and can be removed with memory_forget (#7928)
• agent-memory: Preserves frontmatter metadata when a closing fence has no trailing newline, so export/import retains IDs and categories and summaries and profiles do not treat metadata as body text (#8687)
• agent-memory: Preserves Chinese text, accents, and emoji when OpenClaw receives a reply split across pipe chunks, and releases the MCP worker after a failed initialization handshake before retrying, preventing corrupted tool results and orphaned processes (#8454, #8543)
• agent-memory: Rejects invalid time-decay settings before service startup and ignores non-finite environment overrides with a warning, preventing broken recency rankings. Before upgrading, correct file settings to finite time_decay_lambda >= 0 and time_decay_alpha in [0, 1]; invalid file settings now stop startup (#8701, #8699)
• agent-memory: Keeps namespace initialization failures fatal on retry when user/group mappings were not completed, preventing a retry from starting the service with an incomplete isolation setup (#8439)

[0.2.10] - 2026-10-15

Added

• agent-memory: Updated to v0.2.10, provides Linux x86_64 and ARM64 raw release packages with the memory server and bundled OpenClaw adapter, users can install verified archives without building from source (#7648, #7649)

Fixed

• agent-memory: Guides agents through the host's available Tool Search or direct tool calls, so deferred memory tools can be discovered and invoked with valid arguments (#7645)
• agent-memory: Waits for the MCP child process to exit and cleans it up when an OpenClaw plugin instance is disposed, preventing leftover memory processes during shutdown and reload (#7482, #7661)

[0.2.9] - 2026-10-11

Fixed

• agent-memory: Updated to v0.2.9, requires executable files when locating the OpenClaw adapter's binary, users receive a startup configuration error for directory-valued binaryPath settings and can use a valid executable or executable symlink later in PATH even when an earlier entry contains a directory named agent-memory (#4855)

[0.2.8] - 2026-09-20

Added

• agent-memory: Falls back to a private per-user runtime or temporary directory when the configured session directory is unusable, unprivileged installations can use session logs and mem_promote without creating a root-owned directory; fallback paths are checked for ownership, permissions, and symlink redirection (#3266)

Changed

• agent-memory: Breaking change: renames the OpenClaw tools to anolisa_memory_search and anolisa_memory_get, agents can access ANOLISA memories alongside OpenClaw's own memory tools without name conflicts; update prompts and tool allowlists, restart the gateway, and start a new conversation. Internal MCP names and stored memories are unchanged (#3347)
• agent-memory: Declares all four plugin tools in OpenClaw's coding profile, agents retain access to the plugin tools under that profile without disabling memory-core; custom policies still need explicit tool entries, and disable markers from intermediate installers require the manual recovery described in the user guide (#3347)

Fixed

• agent-memory: Accepts sessionId and sessionDir in the OpenClaw plugin schema and enforces the server's 128-byte UTF-8 identifier limit at plugin startup, users can pin session scratch across respawns and receive configuration errors before an invalid identifier changes their namespace (#3213)
• agent-memory: Ranks stronger BM25 matches first and aligns keyword scores with the higher-is-better convention, search, hybrid retrieval, and automatic recall prioritize the most relevant matching memories (#3296)
• agent-memory: Rejects the unsupported OpenClaw expert profile with guidance to use basic or advanced and stops the previous client before validating a reload, operators see actionable configuration errors without leaving the old memory process holding storage locks (#3238)
• agent-memory: Restores the required files in make dist source archives, source-package and RPM builders receive the example target, configuration, and adapter assets needed to build and install (#3231)

[0.2.7] - 2026-09-09

Fixed

• agent-memory: Negotiates OpenClaw installer flags from host help and grants declared capabilities by default, operators can install on hosts that require consent or withhold it with AGENT_MEMORY_ACCEPT_CAPABILITIES=0; deprecated no-op unsafe-install flags are omitted and failures distinguish consent rejection from unwritable destinations (#3149)
• agent-memory: Labels corpus hits as agent-memory and supplies read handles for memory_get corpus=all, agents can retrieve matching stored memories even when their paths overlap OpenClaw workspace memory and receive accurate fromLine / lineCount for windowed reads (#3177)
• agent-memory: Validates plugin configuration before locating the binary, operators see invalid userId / sessionId errors even when agent-memory is not installed (#3155)
• agent-memory: Declares its RPM component identity, ANOLISA can recognize the installed package as the agent-memory component (#2560)
• agent-memory: Declares Node.js >= 20 and npm as source-build dependencies in the unified build workflow, user-mode setup provisions the tools needed to bundle the OpenClaw adapter and system-mode preflight reports missing tools before building (#3187)

[0.2.6] - 2026-07-30

Fixed

• agent-memory: Updated to v0.2.6, retries short-token LIKE searches with OR matching when strict matching finds nothing and ranks stronger keyword matches first, agents can recall relevant memories from stopword-heavy prompts instead of receiving an empty result (#2040)

[0.2.5] - 2026-07-27

Fixed

• agent-memory: Updated to v0.2.5, derives focused recall queries from long English and CJK prompts and combines their results, agents can recall relevant memories from verbose prompts without silently dropping topics (#1574)

0.2.4

• fix(memory): auto-recall returns empty results after observe — synchronously reindex after memory_observe so before_prompt_build hook finds new content (#1520)
• fix(memory): install.sh sets allowConversationAccess for hooks (#1521)

0.2.3

• fix(memory): normalize OpenClaw content blocks from array of content blocks [{type:"text", text:"..."}] to string before trigger matching and hashing, so auto-capture actually fires instead of coercing to "[object Object]"
• fix(memory): add BM25 OR fallback — when implicit-AND FTS5 query returns 0 rows and there are multiple tokens, retry with '\"token1\" OR \"token2\" OR ...' so partial matches still surface instead of silent failures
• fix(memory): sanitize audit_log by replacing format!("{:.120}", query) with format!("bm25:len={}", query.len()) to prevent user query content from leaking into log paths

0.2.2

• fix memory_observe hint sanitization so YAML-escaped hints round-trip through the hand-rolled frontmatter reader (which does not interpret YAML escapes): replace yaml_escape_hint() with sanitize_hint() that only substitutes newlines and ASCII control chars with spaces; add 8 unit tests plus a real-parser round-trip test covering Windows paths with backslashes
• add max_hint_bytes (default 512) to MemoryConfig with MEMORY_MAX_HINT_BYTES env override; thread &MemoryConfig through memory_observe, the MemoryService facade, and the MCP server
• fix make install INSTALL_PROFILE=user PREFIX=$HOME/.local failing with Permission denied at install-adapter-resources: honor INSTALL_PROFILE and derive DATADIR/SHARE_DIR from $(PREFIX) so all writable paths follow the profile (system mode unchanged); aligns with the tokenless/ws-ckpt install contract
• add safe_fs security-boundary unit tests (path escape, symlink traversal, sandbox root violations) plus formatting/import-order fixes exposed by cargo fmt --all --check

0.2.1

• fix vector/hybrid search panic and empty index when an embedding provider is configured: the index worker ran on a std::thread with no tokio Handle so embeddings were never produced, and memory_search mode=vector|hybrid called Handle::block_on from a worker thread; the runtime handle is now captured at spawn and threaded through to the worker, and the search path uses block_in_place
• fix memory_get_context leaking .git internals (e.g. .git/logs/HEAD) into agent context by extending the reserved-path filter to cover .git/ via a shared is_under_git predicate in safe_fs
• fix full_scan (startup and inotify-overflow recovery) only building the BM25 index and never dense embeddings, so preexisting files were invisible to vector search until modified; a paths_without_vec query plus a backfill pass now embeds them, centralised in an embed_sync helper shared with flush
• fix memory_search returning zero hits for short CJK query terms (< 3 chars, e.g. "花名"/"小云"): the trigram tokenizer emits no tokens for terms shorter than 3 characters, so such queries now fall back to a body LIKE '%term%' substring scan that preserves recall, agent-scope filtering, and cold/superseded exclusion
• resolve embedding dimensions from the first real response instead of hardcoding 1536 (DashScope text-embedding-v3 is 1024): dimensionality is stored in an AtomicUsize seeded with the estimate and overwritten on first embed
• add anolisa-cli adapter contract via .anolisa/component.toml so the CLI adapter manager can discover the openclaw plugin bundle through the [[adapters]] TOML schema

0.2.0

• add prompt-injection safety module (looksLikePromptInjection + escapeMemoryForPrompt) mirrored between Rust core and TS adapter
• add secret detection and PII redaction to the safety module
• add auto-recall before_prompt_build hook injecting relevant memories each turn
• add auto-capture agent_end hook with trigger filtering, SHA256 dedup and injection rejection
• add dense-vector semantic search via pluggable EmbeddingProvider (OpenAI /v1/embeddings, Ollama /api/embed)
• add files_vec table (schema v2) for per-file dense embeddings alongside FTS5 BM25
• add hybrid search with reciprocal rank fusion (RRF, k=60) of BM25 + vector scores
• add memory_search mode parameter (bm25/vector/hybrid) with graceful fallback to BM25
• add per-agent memory isolation via [memory].agent_scope (shared/isolated/filter), schema v5
• add memory sovereignty tools (memory_about/forget/auto_created/consent) with consent.toml preferences
• add 4-type closed memory classification (user/feedback/project/reference) to memory_observe
• add mem_export and mem_import for cross-agent memory migration (AMA archive format)
• add memory_summary tool for memory overview and source tracking
• add memory_session_context tool
• add memory_sessions and memory_timeline session history query tools
• add MEMORY.md index file and mem_index_refresh tool
• add user profile synthesis (Dreaming V3 mem_dream)
• add memory consolidation: auto-extract L1 atomic facts from session audit logs on shutdown
• add episodic memory extraction from coherent tool-call chains
• add cross-session task persistence and incremental consolidation
• add consolidation quality filters (mutual exclusion, non-derivable, date normalization)
• add time-decay ranking (exp(-λ×age_days)) applied to BM25/vector/hybrid scores
• add cold archival of old never-accessed files with mem_compact tool
• add conflict detection via BM25 similarity before writing new facts
• add category subdirectories (facts/<category>/) with memory_search category filter
• add token tracking (tokens field in AuditEntry)
• add mem_consolidate tool for manual consolidation trigger
• add corpus supplement registration for memory_search corpus=all
• add EmbeddingConfig (None/OpenAI/Ollama) with TOML parsing and env overrides
• extend memory_search signature with optional mode and category parameters
• cap memory_search query at 1024 characters to prevent FTS5 resource exhaustion
• truncate embedding error response bodies to 200 chars to prevent API key leakage
• distinguish CJK vs ASCII token estimation in ConsolidatedFact
• hold FactWriter JSONL file handle under mutex to prevent line interleaving
• derive BM25Store mount root from db path with canonicalize + starts_with traversal guard
• compute Episode duration from entry timestamps instead of chain length
• propagate session_id to extracted episodic facts
• return fact count from consolidate() for mem_consolidate reporting
• fix effectiveMode in search response to reflect actual mode used
• fix embedding API empty-response handling to return zero vector of correct dimensionality

0.1.0

• introduce filesystem memory MCP server for AI agents (Linux only) with 21 tools over stdio JSON-RPC 2.0 in three tiers (Tier A file ops, Tier B BM25 search, Tier C governance)
• add per-namespace mount under ~/.anolisa/memory/<ns>/ with optional user-namespace + private tmpfs isolation (auto/userland/userns strategies)
• enforce path sandbox via openat2(RESOLVE_BENEATH | RESOLVE_NO_SYMLINKS) on every Tier A file open
• add SQLite FTS5 BM25 background index with transactional upsert, schema migrations, trigram CJK tokenizer and inotify-driven debounced flush
• add optional git versioning with auto-commit serialized under a per-handle mutex
• add tar.gz snapshots with strict id whitelist, atomic rename swap on restore and rollback entries under .anolisa/trash/
• add optional cgroup v2 memory.max self-limit applied before the tokio runtime starts
• add JSONL audit log (O_NOFOLLOW | O_CLOEXEC, Mutex<File>) with optional systemd-journald fan-out
• enforce profile gating (basic/advanced/expert) at both tools/list and tools/call with deny_unknown_fields on config structs
• add per-session scratch and log under /run/anolisa/sessions/<sid>/ (0700) with tmpfiles.d snippet
• add systemd user template anolisa-memory@.service with hardening (ProtectKernelTunables/Modules/Logs, SystemCallFilter, MemoryDenyWriteExecute, RestrictNamespaces, RestrictAddressFamilies=AF_UNIX)
• add RPM packaging with offline vendor tarball and single statically-linked binary (bundled SQLite + vendored libgit2)
• add OpenClaw plugin memory-anolisa with install/detect/uninstall lifecycle and 4 memory contract tools routed to the MCP server as a stdio child
• add single-source version sync from Cargo.toml into manifest/package/openclaw/mcp JSON and the bundle
• add mcp-harness example and 140 automated tests across 12 integration suites

Changelog

1.2.0

Breaking Changes

• Defaulted source installations to the shared anolisa namespace across the component installers; existing independent layouts are left in place and must be migrated with the original path overrides followed by make uninstall AWPRJ=, or kept on the previous layout by continuing to pass AWPRJ=. (#9462)

Cedar Policy Engine

• Added a Cedar policy frontend that validates source against the application schema and stores the original source through the policy create and update paths. (#9298)
• Deployed supported Cedar file-protection policies through the existing Scope, Binding and reconciliation lifecycle, rejecting translations that exceed the supported subset. (#9442)
• Added agent-sec-cli policy default, printing a restrictive baseline policy for Scopes without a bound policy. (#9522)
• Added agent-sec-cli intent propose to generate reviewable Cedar candidates from a task description through the optional intent.propose daemon method. (#9450)
• Added a self-contained policy-authoring skill with intent disambiguation, rule formalization, worked examples and a self-check checklist. (#9463)

Sandbox Authorization

• Added agent-sec-cli sandbox run to execute a command under an explicit OS permission set without a policy service. (#9311)
• Routed Cosh sandbox hooks through Cedar authorization, native approval and receipts, and showed only the resource operations that require confirmation. (#9379)
• Split OS permission, invocation and lifecycle contracts into dedicated sandbox contract crates shared by the standalone sandbox and policy paths. (#9456)

Credential Protection

• Added an opt-in secret gateway that replaces Scope-specific fake credentials with real values for authorized GitHub REST and HTTPS Git traffic. (#9265)

Scanner & Policy Engine

• Retained outer Bash findings when an inline interpreter payload is scanned, merging findings per rule and de-duplicating identical evidence. (#9418)
• Hardened prompt-scan and code-scan verdict parsing against echoed verdict lines and verdict words embedded in larger words. (#9446)
• Sped up PII boundary matching for near-limit scans while preserving exact spans and redacted output. (#9453)

Codex & OpenClaw Hook Integrations

• Blocked native OpenClaw plugin disable and uninstall of agent-sec through the Code Scanner hook, including in observe mode. (#9491)

Build & Packaging

• Preserved service enablement and activity state when rolling back split RPMs to the legacy package layout. (#9472)

Raw Packaging

• Preserved distribution-owned discovery contracts during ANOLISA raw install, repair, update, rollback and uninstall; new archives now require ANOLISA 0.3.21 or later. (#9351)

Testing & CI

• Measured the full V2 workspace in the incremental coverage gate instead of a fixed package allowlist. (#9502)
• Stabilized daemon startup and UDS admission tests across the SecCore E2E, Rust and packaging CI targets. (#9323)

[1.1.2] - Unreleased

Changed

• Install the security runtime, framework integrations and skills through separate RPMs.

1.1.1

Breaking Changes

• Removed the unsupported --cgroup-id flag from scope create; cgroup assignment was never accepted by PAP or the AgentSight Adapter, and the flag now fails locally with exit code 2. Select target processes with --pid, --process-name, or --executable instead. (#9134)

Code Scanning

• Evaluated command strings passed to Python process APIs (os.system, os.popen, subprocess) against the existing Shell rules, with native rule IDs, severity, and evidence retained; dynamically built commands and argv arrays remain uninferred. (#9128)

Skill Ledger Runtime

• Added skillsec as the primary agent-sec-cli command group name, retaining skill-ledger as a compatible alias with identical arguments, output, and exit codes. (#8907)
• Escaped the YAML-sensitive characters that JSON quoting leaves literal in a pending Skill placeholder, so accepted Skill names containing control characters or Unicode separators survive publication and frontmatter parsing unchanged. (#8948)

1.1.0

Breaking Changes

• Switched source builds and installs to the V2 Rust CLI and host-level systemd daemon, replacing the source-build Python runtime, user sandbox, and venv layout; source-install scripts must migrate to the V2 hook-facing command surface. (#3510)

V2 Policy & Daemon Runtime

• Rejected stale policy reconciliation results atomically, tracked real write-receipt versions, and let newer Delete intents supersede exhausted Apply retries, with deterministic crash-recovery coverage for SQLite persistence. (#6944)

Storage Safety

• Fell back to /var/lib/agent-sec/policy/policy-state.db for default Policy storage when the primary directory is unsafe, checking both candidates before initialization and rejecting conflicting databases with actionable diagnostics. (#8782)

Skill Ledger Runtime

• Raised a typed SkillLedgerError instead of a raw NotADirectoryError when skill export --output points to an existing file. (#6105)

Build & Packaging

• Updated rustls to 0.23.45 to address a Dependabot security advisory. (#7783)

Raw Packaging

• Added a Linux x86_64 sec-core prebuilt raw-archive release target with SHA-256 and CycloneDX SBOM sidecars. (#8461)

1.0.1

Breaking Changes

• Removed SkillSec key rotation: rotate-keys and init --force-keys are rejected before any write, and the current signing key is retained. Scanned and certified Skills are remembered as exact paths in the daemon's managedSkillDirs; remove an entry and restart the daemon to revoke it. (#7629)

Skill Ledger Runtime

• Authorized and scanned standard system and local-user Skill directories by default through enableDefaultSkillDirs, deriving user homes from local account records in the daemon. (#7419)
• Kept SkillFS notify acceptance within the 64 KiB session response frame so accepted notifies are no longer dropped and retried. (#7188)

V2 Policy & Daemon Runtime

• Verified that the connected daemon runs as root before V2 clients send requests, and replaced the legacy shell health check with the agent-sec-daemon-health probe. (#7122)
• Limited daemon connections per user, reserving connections for root so other users cannot starve it. (#7103)
• Retained CAP_SYS_PTRACE in agent-sec-core.service so Scope discovery can read protected process links. (#7404)
• Ran observability-store retention while the daemon is active, including startup catch-up. (#7099)
• Removed the process-local policy engine repository and prevented polling lock starvation. (#7111)

Storage Safety

• Rejected symlinked and non-regular read-only SQLite database paths instead of following them. (#7295)
• Rejected symlinked and non-regular writable SQLite database paths before opening them. (#7296)

V2 Security Operations

• Stripped information-separator characters from capabilities environment values and filters as V1 does. (#7194)

Build & Packaging

• Changed the default agent-sec-core RPM build target to V2 while keeping an explicit V1 target. (#7563)

Testing & CI

• Restored the V2 workspace clippy gate for prompt-scan crates. (#6680)

1.0.0

Breaking Changes

• Security operations require a running root daemon; the CLI does not start it or execute locally. Manage agent-sec-core.service with system systemctl; the default socket is /run/agent-sec-core/daemon.sock. (#3217)
• AGENT_SEC_DATA_DIR and AGENT_SEC_MODEL_SERVICE_* are now daemon-wide settings; CLI/hook exports no longer apply. Configure the daemon environment and restart. Storage defaults to /var/log/agent-sec, without per-user fallbacks; test isolation requires a separate test daemon, data directory, and socket. (#7283)
• Shared-store queries isolate by trusted OS UID, not account lifetime; root sees all UIDs. Reusing a UID exposes its retained records to the new account. Keep UIDs stable and have administrators handle old data and permissions before reassignment. (#7277)
• PII custom rules now use /etc/agent-sec/pii-checker/rules.yaml instead of the per-user default. Move custom rules there and restart the daemon to apply changes. (#3286)
• Skill Ledger uses a shared system signing key; V1 keys, keyrings and history are not imported. Rescan Skills to establish V2 trust; key rotation requires root. (#3295)
• Skill operations require administrator-configured managedSkillDirs or authenticated SkillFS mounts. All local users can operate managed Skills; no per-user Skill ACLs are provided. (#3295)
• V1 per-user Security Events and Observability history is not automatically imported into the V2 system store. No supported cross-store import tool is shipped; preserve V1 data. (#6605)
• Legacy harden, verify and log-sandbox commands are unavailable in the V2 CLI. Update dependent scripts before switching to V2.

V2 Security Operations

• Added native V2 PII scanning with V1-compatible CLI and Hook contracts. (#3286)
• Added V2 prompt scanning through the daemon and CLI, including loopback-only model classification. (#3384)
• Added local-model LLM mode for V2 code scanning. (#6596)
• Restored owner-scoped V2 security-event queries and the events CLI command. (#6745)
• Added V2 observability recording through the CLI and daemon. (#3397)
• Added V2 observability queries, reports, reviews, and owner-scoped correlation through the daemon. (#6826)
• Reported the V2 prompt-scan L2 default and unsupported model overrides through agent-sec-cli capabilities. (#6595)
• Corrected PII card and email detection boundaries to reduce false warnings and preserve sentence punctuation. (#6597)
• Added CI/CD and cloud token-prefix detection to V2 PII scans. (#6219)
• Added compound credential field-name detection to V2 PII scans. (#6234)

Skill Ledger Runtime

• Migrated Skill Ledger scanning, signing, activation, and recovery to the V2 daemon. (#3295)
• Migrated Agent hooks to V2 daemon-owned Skill Ledger trust and command handling. (#3505)
• Cleaned failed Skill Ledger export artifacts so callers can retry the same output directory. (#4004)
• Retained all Skill Ledger rollback backups for later recovery and inspection. (#3989)
• Reclaimed stale private-key temporary files after interrupted Skill Ledger initialization or rotation. (#4430)
• Reported signed-but-unscanned directories as Skill Ledger warnings. (#4447)
• Detected credential material outside hidden directories in Skill Ledger scans. (#6201)
• Reported FIFOs, sockets, and device nodes in Skill Ledger scans. (#6211)
• Rejected oversized Skill Ledger worker frames before spawning a worker. (#5671)

V2 Policy & Daemon Runtime

• Added persisted V2 policy assignments and AgentSight reconciliation. (#6931)
• Started the V2 daemon automatically after installation. (#6846)
• Ran V2 security-event retention while the daemon is active, including startup catch-up and failure retries. (#6679)
• Preserved daemon cancellation behavior during V2 worker shutdown. (#3470)

Build & Packaging

• Added reproducible offline V2 RPM builds and installed-artifact validation. (#3257)
• Changed the raw package to install V2 CLI and daemon binaries with the system service. (#6551)

Agent Hook Integrations

• Updated OpenClaw plugin deployment and runtime compatibility for OpenClaw 2.0. (#3408)
• Moved OpenClaw PII scanning to the supported model-entry gate while retaining legacy-host compatibility. (#3503)
• Moved OpenClaw prompt scanning to the supported model-entry gate. (#6571)
• Kept Codex PII and Code Scanner Hooks fail-open for non-object input payloads. (#6341)
• Kept the Codex PII Hook fail-open for non-object scan results. (#6654)
• Aligned V2 Code Scanner contracts across CLI, daemon, and installed RPM behavior. (#6822)
• Restricted PII scanning to the current model prompt. (#6970)
• Bounded approval descriptions before they reach the security decision flow. (#6972)
• Preserved native device identity checks for V2 storage and export operations. (#6955)

0.13.2

Build & Packaging

• Enabled ANOLISA RPM adapter installation to discover hook and skill payloads split across agent-sec-core subpackages. (#3480)

0.13.1

OpenClaw Hook Integration

• Updated OpenClaw plugin deployment and runtime compatibility for OpenClaw 2.0, including capability consent and SQLite-backed session evidence. (#3440)

0.13.0

V2 Policy & Daemon Runtime

• Added V2 daemon Policy, Scope, and Binding CRUD APIs with root-only authorization. (#3062)
• Added V2 CLI commands for Policy, Scope, and Binding management through the daemon. (#3097)
• Added AgentSight policy adapters, client integration, and binding reconciliation. (#3103)
• Added bounded concurrent reconciliation workers so one binding failure cannot block the daemon. (#3194)

V2 Security Operations

• Added the V2 daemon-backed Bash and Python regex Code Scanner with compatible structured results. (#3203)
• Added the V2 capabilities command with V1-compatible environment capability reporting. (#3243)
• Added V1-shaped JSONL and SQLite persistence for accepted V2 code-scan events. (#3246)
• Added shared scan lifecycle recording and allowlisted telemetry sinks for V2 security operations. (#3300)

Skill Ledger Runtime

• Skipped unmanaged read-only raw user Skills during default batch initialization and scanning. (#3183)
• Unified Skill Ledger CLI and configuration inputs around supported names, initialization, and policies. (#3253)

Build & Packaging

• Delivered the V2 daemon as a hardened systemd system service. (#3217)

Skills

• Added the bundled pii-checker Skill for PII and credential scans with optional redaction. (#3241)

Testing & CI

• Added installed V2 RPM end-to-end coverage for CLI, daemon, plugins, and service contracts. (#3162)

Documentation

• Added AARM registry and OWASP Agentic Top 10 security-control mappings. (#3227)

Maintenance

• Flattened the V2 crate layout and updated internal references. (#3319)

0.12.0

cosh & Cosh-NG Hook Integration

• Normalized legacy cosh and Cosh-NG Skill invocation payloads in the cosh Skill Ledger hook so Cosh-NG invocations follow the configured policy instead of bypassing the check. (#2871)

Skill Ledger Runtime

• Tightened six Skill scanner detector patterns to remove deterministic false positives and bumped the static scanner identifier to cisco-static-only-0.1.1. (#2928)
• Completed the skill-ledger and check help output with all eight integrity statuses and their production conditions. (#2707)

Daemon Runtime

• Added a POSIX shell daemon.health probe that avoids Python cold start for container health checks. (#2879)

Rust v2 Framework

• Added the v2 foundation and policy type crates as the base for the Rust security core migration. (#3007)
• Added the v2 daemon service framework with UDS server, request dispatch, and shutdown handling. (#3040)
• Added the v2 PAP service with Policy, Scope, and Binding CRUD over a repository abstraction. (#3027)

Build & Packaging

• Raised the cryptography runtime floor to 50.0.1 and refreshed the lock and exported requirements. (#3015)

Documentation

• Added design docs for the current daemon protocols and the v2 framework requirements. (#2881)

0.11.1

Prompt Scanner

• Restricted the invisible-character injection rule so emoji ZWJ sequences, Persian ZWNJ, and leading BOM no longer score as critical injections. (#2900)
• Refused non-loopback model service base URLs derived from the environment in both the Rust and Python model service paths. (#2893)
• Reported daemon.health prompt_scan state as untracked instead of unconditionally ready now that scanning runs in-process. (#2892)
• Dropped the dead prompt model preload environment flag and the obsolete scan-prompt protocol document. (#2886)

Skill Ledger Runtime

• Skipped host-backed read-only system Skills in batch scan --all and default init instead of failing them. (#2906)
• Rejected the placeholder set-policy and rotate-keys commands so they no longer report false success. (#2876)

Asset Verification

• Reported explicit CHECKED / PASSED / FAILED counters and a distinct zero-candidate outcome for agent-sec-cli verify. (#2875)

Security Events & CLI

• Enforced owner-only permissions on files created by the CLI. (#2873)

Documentation

• Documented the five hidden agent-sec-cli integration commands and their contract caveats. (#2887)
• Documented the rule-only L1 detection boundary and how to read pass together with degraded fields. (#2895)

0.11.0

Prompt Scanner

• Rewrote prompt scanner core in Rust for native performance. (#2409)
• Added ATR (Agent Threat Rules) rule packs and reduced compile time. (#2531)
• Added Warden-Gen L2 backend option for prompt scanning. (#2699)
• Routed Rust native extension logs to Python logging framework. (#2640)
• Corrected warmup documentation to describe model availability checks and silenced per-invocation scan mode logging in the Codex, cosh, and Qwen Code prompt scanner hooks. (#2745)

Hermes Hook Integration

• Dropped Hermes synthetic warning injection; PII and Skill Ledger policies now use native observe/block boundaries. (#2712)

PII Checker

• Refined PII detection to reduce JWT and Email false positives and aligned user notices across all host adapters. (#2443)

Skill Ledger Runtime

• Added SkillFS HMAC peer authentication for cross-container Skill Ledger deployments. (#2493)

Security Events & CLI

• Added agent-sec-cli capabilities subcommand for environment-based hook configuration inspection. (#2356)
• Set observability hook timeout to 10s and CLI default timeout to 5s. (#2346)
• Added security observability skill for structured event and session report queries. (#2245)

Documentation

• Corrected and restructured user docs to align with 0.10.x shipped behavior. (#2456)

0.10.1

OpenClaw & cosh Hook Integrations

• Piped prompt text through stdin instead of command-line arguments in the OpenClaw and cosh prompt scanner hooks. (#2445)

Security Events & CLI

• Validated events query parameters in the CLI and the daemon security query handlers. (#2451)

0.10.0

Agent Hook Policy Controls

• Added code scanner enable flags for agent hooks. (#2001)
• Unified hook policy controls across agent integrations. (#2141)
• Added an observability hook environment toggle. (#2199)
• Restored scanner mode environment variable names. (#2212)
• Aligned code scanner hook flags across supported agent integrations. (#2229)
• Added environment-based prompt scanner gating. (#2239)

OpenClaw Hook Integration

• Added block mode support for the OpenClaw code scanner hook. (#2242)

Prompt Scanner

• Widened prompt scan inbound text field coverage. (#2277)

Skill Ledger Runtime

• Added read-only skill analysis. (#2044)
• Included raw skill directories in skill ledger checks. (#2201)
• Authenticated manifests before loading skill package contents. (#2185)

Security Events & CLI

• Added session and run filters to agent-sec-cli events queries. (#2132)

Raw Packaging

• Added component-owned raw package build targets and archive validation. (#2133)
• Updated raw hooks to use the bundled Python launcher. (#2255)

0.9.0

Qoder CLI & Qwen Code Hook Capability Expansion

• Added Qwen plugin and observability hooks. (#1473)
• Added Qoder CLI hook framework support. (#1480)
• Added Qoder prompt injection scanner hook integration. (#1529)
• Added Qwen prompt scanner hook integration. (#1538)
• Added code scanner hook integration for Qoder CLI and Qwen Code. (#1535)
• Added Qoder CLI Skill PreToolUse skill ledger checks for user and project skills. (#1552)
• Added Qwen PII hooks. (#1559)
• Added Qwen skill ledger hook integration. (#1561)
• Added Qoder CLI observability hook integration. (#1580)
• Unified Qwen Code hook trace context handling. (#1738)

Codex & OpenClaw Hook Integrations

• Added observability capability in the Codex plugin. (#1495)
• Added Codex PreToolUse PII checker hook integration. (#1501)
• Showed OpenClaw policy hints in hook responses. (#1525)

Scanner & Policy Engine

• Skipped prompt model downloads when the model cache already exists. (#1467)
• Added custom PII regex rules. (#1522)
• Satisfied L1-L3 telemetry requirements. (#1527)
• Added Chinese prompt-injection and jailbreak rules covering instruction override, authority escalation, encoding evasion, and role-play framing. (#1554)
• Unified model resources into handles to make prompt scanning resource lifecycle more consistent. (#1553)
• Made prompt scan mode configurable through environment variables. (#1620)
• Hardened audit, PII, and notify hook behavior. (#1649)

Skill Ledger Runtime

• Isolated the skill ledger worker for more reliable hook execution. (#1492)
• Resolved canonical skill roots for skill ledger checks. (#1558)
• Exposed skill ledger verdicts to hook callers. (#1577)

Build & Packaging

• Moved prompt-scan benchmarks to a standalone repository to keep the CLI package lean. (#1557)
• Rejected stale CLI wheels during packaging and runtime validation. (#1651)
• Replaced and restarted the daemon service when upgrading RPM packages. (#1681)

Testing & CI

• Fixed OpenClaw E2E test dependencies by excluding ML packages. (#1631)
• Fixed skill-ledger E2E test execution on macOS. (#1643)

Documentation

• Centralized user guides and added documentation lint CI. (#1586)

0.8.0

Build & Packaging

• Installed the Codex plugin during source builds so source deployments include the same Codex integration as packaged installs. (#1302)
• Updated source build scripts for the sec-core install flow. (#1348)
• Fixed system-mode source builds by placing uv-managed Python under the shared sec-core library directory and adding a system install smoke check. (#1400)

Code Scanner

• Added sensitive file path rules for common agent credentials to block API key exposure. (#1401)

OpenClaw Plugin

• Hardened OpenClaw deploy compatibility handling and covered deployment edge cases with unit tests. (#1358)
• Added an OpenClaw plugin cross-version E2E matrix that validates packaged plugin loading, Gateway flows, policy behavior, and observability across supported OpenClaw hosts. (#1372)

Documentation

• Added bilingual agent-sec-core user guide documentation and documentation maintenance rules. (#1311)
• Documented OpenClaw plugin deployment, compatibility, and upgrade guidance. (#1370)

0.7.1

Prompt Scanner

• Degraded scan-prompt to fast mode when model unready; rewrote DENY to WARN and enriched degraded reason with diagnostics. (#1258)

Skill Ledger

• Clarified skill ledger fallback warnings and sanitized finding summaries. (#1240)
• Tamed ledger reconcile noise and typed live-root skip errors. (#1232)

Security Observability

• Added observability mapping for new pii_scan at before_tool_call & after_tool_call. (#1229)

0.7.0

Codex Plugin — Full security integration for OpenAI Codex

• Added codex-plugin with code scanning, prompt scanning, skill ledger, and PII checking hooks. (#1074)
• Supported packaging codex-plugin into RPM. (#1138)
• Fixed codex-plugin paths in Makefile and CI for correct RPM install verification. (#1165)

Code Scanner

• Added code-scanner LLM mode for AI-assisted security analysis. (#1108)
• Added code-scanner static rules for expanded coverage. (#1033)

Prompt Scanner

• Added L4 multi-turn intent detection with ollama model service. (#1060)
• Routed prompt scan to daemon and added prompt model preload for reduced latency. (#786)
• Controlled prompt scan call to use daemon by env variable. (#933)

Skill Ledger — Activation daemon and policy engine

• Added Skill Ledger activation daemon for background integrity monitoring. (#857)
• Added runtime activation resolver for skill trust decisions. (#826)
• Added skill ledger activation policy for configurable enforcement. (#944)
• Updated skill ledger activation and event contracts. (#983)
• Updated Skill Ledger hook defaults and reconcile notify behavior. (#1086)
• Aligned skill ledger hooks across all agent platforms. (#1135)
• Resolved Skill Ledger FUSE and unmanaged roots handling. (#1141)
• Fail-open unsupported Hermes skill ledger scenarios. (#1155)

Daemon & Telemetry

• Added daemon service with systemd integration and RPM build support. (#1090)
• Exposed SQL query endpoint at daemon for observability queries. (#1042)
• Enhanced daemon logging including requests and jobs. (#871)
• Added telemetry schema definition and SLS JSONL writer. (#977, #1008)
• Passed agent_name to telemetry data for multi-agent identification. (#1032)
• Added logging system for structured agent-sec-cli output. (#651)
• Added security daemon socket fallback under /run/user/<uid> for user-scoped deployments. (#1129)

PII Scanner

• Extended PII scanning coverage with additional pattern detectors. (#925)

Security Observability

• Added session report command for post-session security summaries. (#703)

Sandbox

• Converged sandbox trigger rules for consistent enforcement. (#979)

Adapter & Build

• Added ANOLISA CLI component.toml for adapter manifest integration. (#1067)
• Added systemd-rpm-macros as RPM build dependency. (#1156)

0.6.0

Self-Protection — Tamper-resistance for agent-sec-core itself

• Added self-protect code-scan rules that block disabling/uninstalling agent-sec plugins on OpenClaw and Hermes. (#692)
• Optimized self-protect rules in code-scan to eliminate false positives on prefix-matched plugin names and cover Hermes uninstall/rm patterns. (#710)

Prompt Scanner

• Unified prompt-scan warning format across cosh-extension, hermes-plugin, and openclaw-plugin with structured fields (threat type, risk level, interception stage, model confidence). (#709)

Agent-Sec-CLI

• Added daemon process for agent-sec-cli to amortize startup latency across hook invocations. (#677)

Adapter & Manifest

• Added standalone ANOLISA adapter entry anolisa-for-openclaw to package sec-core OpenClaw adapter scripts and drive install/detect/uninstall via the adapter manifest. (#549)
• Added Hermes adapter runner: refactored the OpenClaw entry into a target-agnostic anolisa-adapter-runner and added anolisa-for-hermes wrapper, with per-agent adapter directory layout under sec-core. (#617)
• Centralized sec-core adapter manifest parsing across adapter scripts and moved the manifest under the cli package. (#617)

OpenClaw Integration

• Normalized OpenClaw state directory handling: use OPENCLAW_STATE_DIR for adapter filesystem state, unset OPENCLAW_HOME when invoking the OpenClaw CLI, and aligned plugin install/list/uninstall handling. (#641)

0.5.0

PII Scanner — Personal information leak detection

• Added PIIChecker scan CLI with text/file input, regex/validator-based detection, redaction, and security middleware integration. (#525)
• Added PIIChecker hooks for cosh and OpenClaw with stdin-based input passing. (#539)
• Added Hermes PII checker hook. (#556)
• Fixed scan-pii module mode detection via subprocess. (#540)

Security Observability — Agent run metrics & posture insights

• Added security observability schema, metrics definition, and CLI with jsonl writer for agent runs. (#488)
• Added openclaw plugin for security observability. (#515)
• Added cosh hook for security observability. (#528)
• Persisted observability records to sqldb with CLI review command. (#544)
• Added observability plugin for hermes. (#553)
• Correlated security events with observability events and supported batch query. (#578)
• Respected trace-id filter in count queries. (#595)

Hermes Plugin — AI Agent integration framework

• Added hermes-plugin framework with abstract hook class and code scan capability. (#536)
• Added Hermes prompt-scan capability. (#579)
• Added Hermes PII checker hook. (#556)
• Added Hermes skill ledger hook. (#565)
• Added observability plugin for hermes. (#553)
• Supported correlation context in hermes agent plugin. (#590)
• Added hermes plugin install for rpmbuild and build from scratch. (#577)
• Stabilized Hermes skill-ledger warning delivery for non-pass skill checks. (#600)

Correlation & Tracing Context

• Unified caller tracing context across CLI, OpenClaw, and cosh with --trace-context JSON and SQLite schema v2. (#569)
• Supported correlation context in hermes agent plugin. (#590)
• Correlated security events with observability events. (#578)

Skill Ledger

• Integrated code-scanner with skill-ledger for unified security assessment. (#505)
• Updated skill ledger security interactions. (#529)
• Made openclaw skill ledger approval configurable. (#575)
• Added Hermes skill ledger hook. (#565)
• Refined skill ledger scan workflow and aligned documentation. (#529)
• Included skill-ledger e2e in install flows. (#573)
• Fixed skill-ledger hook scope limitation. (#497)
• Fixed managed skill dirs for discovery. (#510)
• Expanded home paths for skill-ledger. (#596)
• Hardened skill ledger recovery and key UX. (#575)

Code Scanner

• Added code-scan requireApproval config for openclaw. (#560)
• Added OpenClaw enableBlock hook policies. (#586)

Security Middleware & Event System

• Fixed TOCTOU race condition at sqldb read path. (#546)
• Made SQLAlchemy lazy import for non-DB subcommands. (#581)
• Lowered frequency for SQL maintenance operations. (#546)

Prompt Scanner

• Added Hermes prompt-scan capability via hermes plugin. (#579)
• Fixed warmup detection from error-string matching to file-based check. (#500)
• Fixed prompt text passing via stdin instead of argv. (#579)

Toolchain & CI

• Added build-all support with local space install for sec-core. (#527)
• Added hermes plugin install for rpmbuild and from-scratch build. (#577)
• Included skill-ledger e2e in install flows. (#573)
• Added adapter manifest for capability discovery. (#577)

0.4.0

Prompt Scanner

• Prompt scanner hook now asks user on missing model instead of fail-open. (#463)
• Added prompt injection detection benchmark dataset and evaluation toolkit. (#464)

Security Middleware & Event System

• Refactored security_events SQLite storage to SQLAlchemy ORM with multi-table extensibility and typed repositories. (#459)

Skill Ledger

• Fixed sign-skill auto-register config (exact awk match) and parse openclaw stdout unconditionally. (#445)
• Unified XDG paths under agent-sec/skill-ledger vendor namespace. (#445)
• Unified single-skill verify into structured result for consistent output. (#445)
• Converted integration tests from subprocess to Typer CliRunner. (#445)

OpenClaw Integration

• Registered plugin at openclaw gateway explicitly to support Gateway startup planning. (#446)

Refactoring

• Removed deprecated agent-sec-core skill directory; aligned README and spec with agent-sec-cli workflow. (#454)

Toolchain & CI

• Added coverage report for sec-core CI. (#431)
• Enabled rpmbuild and e2e test CI for main branch. (#432)

0.3.0

Prompt Scanner — Multi-layer prompt injection & jailbreak detection

• Added prompt injection/jailbreak detection scanner architecture with L1 rule engine (YAML-based) and L2 ML classifier (Prompt Guard 2). (#253)
• Integrated prompt scanner into cosh hook and openclaw plugin with security middleware lifecycle. (#261, #294)
• Added list-scanners command, improved CLI help, and made --scanner-version optional. (#284)
• Added prompt scan summary and backend tests. (#294)
• Added prompt-scanner skill definition. (#256)
• Added model warmup, audit logging, and comprehensive documentation. (#253)
• Stabilized batch scanning and verdict logic with thread-safe model loading. (#253)
• Unified prompt scanner response to use "ask" instead of "block". (#341)
• Added prompt-scanner e2e test suite and Makefile target. (#352)

Code Scanner — Static code security analysis

• Added code scanner component with rule-based detection for obfuscation, permission abuse, and more. (#234)
• Integrated code scanner into cosh hook (with ask decision support) and openclaw plugin adapter. (#234)
• Added code scanner CLI entry, error codes, and unit tests. (#234)
• Fixed code scan bugs and added e2e test. (#342)

Skill Ledger — Skill integrity tracking and signing

• Added skill-ledger CLI with middleware integration for skill integrity verification. (#252)
• Added skill-ledger skill definition. (#266)
• Added skill-ledger cosh hook for PreToolUse and openclaw-plugin capability. (#292, #281)
• Improved skill-ledger CLI and cleaned up imports. (#284)
• Restructured skill-ledger config defaults and documentation. (#296)
• Aligned skill-ledger tool name and added path validation. (#317)
• Reworked skill-ledger status, output, and check signing. (#335)
• Skill-ledger hook hardening, e2e suite, and posture integration. (#339)
• Known limitation: skill directory resolution assumes dir name matches SKILL.md name field; see #381.

Security Middleware & Event System

• Added security middleware framework with unified CLI entry point and metrics integration. (#121, #220)
• Added sqldb writer & reader with query command at CLI interface for security event persistence. (#254)
• Fixed cross-process event loss in SecurityEventWriter. (#226)
• Applied corruption whitelist to stop false-positive DB rebuilds. (#338)
• Added e2e test and fixed bugs revealed during testing. (#330)

Linux Sandbox

• Added sandbox guard and failure handler hooks. (#362)

OpenClaw Integration

• Added hook plugin for openclaw with integrated security scanning capabilities. (#242)
• Added jq requires for openclaw hook package. (#370)

Cosh Extension Integration

• Integrated with new cosh extension API and added builtin commands. (#302)

Performance

• Lazy-load ML dependencies to speed up non-ML subcommands. (#318)

Toolchain & CI

• Migrated Python toolchain to uv package manager and pinned Python 3.11.6. (#227)
• Added sec-core RPM build CI and adapted nightly build pipeline. (#295)
• Initialized code format check CI with python-code-pretty. (#229)
• Added e2e test in RPM build CI. (#369)

Bug Fixes

• Preserved seharden wrapper defaults. (#236)
• Removed dynamic import at middleware router. (#277)
• Improved missing loongshield guidance. (#289)
• Fixed build errors. (#288)
• Removed openclaw hook examples and fixed documentation. (#282)

0.2.0

• Added Hardened skill signing pipeline and added .skill-meta layout. (#129)
• Added Cargo.lock to version control. (#149)
• Added make install-sandbox target. (#68)
• Fixed bubblewrap version compatibility for --argv0 option. (#112)
• Changed Refactor SKILL.md to executable protocol and align sub-skills. (#130)

Changelog

0.16.0

Breaking changes

• Model aliases that resolve to the same tokenizer share one cache slot; automatic aliases no longer appear as separate low-level registrations.

Features

• Add secret-file read protection: an enforce-only template stops a selected agent process tree from reading explicitly configured secret files, exposed through a dedicated HTTP route.
• Observe Qoder CLI gateway calls and record prompts, tools, session IDs and token usage; the schema 6 default configuration adds Qoder discovery and gateway rules for new installations (upgrades need a manual step, see Upgrade notes).
• Add a Cline session parser to the trajectory collector.
• Sort token savings sessions by the displayed metrics; CSV export follows the visible order.

Fixes

• Keep Codex shell calls in requests, answers and streams, retain Codex result ownership, and include last-only Codex usage tails.
• Open listed Gemini sessions, isolate Gemini tool responses, count Gemini reasoning tokens, read the generation config, classify the remaining stop reasons, and clear rewound Gemini snapshots.
• Read null Anthropic usage, SysOM response envelopes and tool_use snapshots, DeepSeek resource stops, and skip Responses sub-endpoint usage while labelling Responses and native operations.
• Flatten null tool outputs and results to empty, decode block arrays encoded as strings, and preserve string assistant replies, native stop strings and unknown risk reason text.
• Retain unmatched batch results, batch tool completion times, recorded identity in batch exports, and local session usage.
• Isolate concurrent storage writes and write agent configuration atomically.
• Bound LLM HTTP request attempts with per-attempt timeouts, gate the LLM preferences query, guard optimize endpoint retargeting, and serve non-object trajectories intact.
• Merge overlapping inference windows, measure structured triage messages, require complete RSS evidence, correct signed RSS trend claims, reject nonfinite capture timings, and guard the token-limit ratio against a zero cap.
• Report process termination status, replay interrupted recovery phases, canonicalize exported result IDs, and share tool-failure precedence.
• Keep a tool result the provider declared successful instead of re-judging it from the result text.
• Keep the parsed file path in the post-edit format hook when the payload carries non-list edits, so formatting is no longer silently skipped.
• Reduce the recvfrom SCM_RIGHTS eBPF stack usage below the verifier's 512-byte limit in the x86_64 and aarch64 enforcer objects.
• Make the endpoint match-nothing sentinel unreachable in the policy compiler.
• Reset the causal panel when the identity changes.
• Harden benchmark campaigns: tolerate partial artifacts, count only usable checks, skip recovery records that cannot be grouped, treat a null evaluation block as a failed gate, stop tracer and server process groups, and make test.sh exit non-zero on failures.

Docs

• Document LLM query authentication in the dashboard guide.

Upgrade notes

• Configuration moves from schema 5 to 6. The upgrade merges top-level sections only: sections already present, such as cmdline and https, are kept as they are and do not receive new default entries. A configuration carried over from 0.15.3 therefore lacks the Qoder CLI rules; to observe Qoder CLI, add cmdline.allow entries with agent_name QoderCLI for qodercli*, */qodercli* and *qodercli*, and add *.qoder.sh to the https rules, as in the shipped default src/agentsight/agentsight.json.
• The pre-upgrade file is saved beside the active configuration as <file>.bak.<timestamp>, for example /etc/agentsight/config.json.bak.<timestamp> for RPM installations.
• The enforcer map layout changed, so stale pinned engines are reinstalled on upgrade rather than reusing incompatible pins.

0.15.3

Fixes

• Preserve final token usage in cost analysis and scope final answers to the latest turn.
• Preserve ATIF developer instructions and recorded tool completion times.
• Decode stacked HTTP content codings and keep missing throughput measurements unknown.
• Preserve Hermes fallback call identity and clear empty Hermes histories.
• Cover legacy guards in write-access preflight and close file-guard content-loss entries.
• Validate resource capture quality before accepting benchmark results.

Changed

• Keep ANOLISA discovery contract ownership in the distribution.

0.15.2

Features

• Enforce structured file-protection policies: classify policy paths, lower them into map entries, apply them, and enforce structured kernel deletion, rename/exchange, and ordinary file writes.
• Advertise structured file protection as a capability.

Changed

• Choose the runtime and DSH integration separately using the core and plugins RPMs: agentsight-core owns programs, configuration and services; agentsight-plugins holds the DSH integration; agentsight remains as a compatibility package that depends on the exact-version core.
• Programs install to the system binary directory, and make install consumes prebuilt files without activating services. (BREAKING)

Tests

• Cover structured policies end to end and assert matched file guard audit rules.

0.15.1

Breaking changes

• Unify file installation: make install now installs prebuilt files without activation, make install-core and make install-plugins select programs, configuration and services or native host integration resources, local installation defaults to PREFIX=/usr/local with an empty AWPRJ, and DESTDIR only prepends the packaging root. make build still compiles components through the root Makefile.

Features

• Enforce structured file protection: activated policies deny unlink, rmdir, boundary-crossing rename and exchange, and ordinary write/pwrite on protected regular files, with denial events naming the operation. Truncate, O_TRUNC, shared writable mmap and dynamic mounts stay out of scope, and no content-immutability guarantee is claimed.
• Accept structured policies through ActPlane in enforce mode and report four supported structured capabilities in the health response; the integration guide now documents ordinary-write and Apply stability limits instead of blanket rejection.
• Add the structured file-protection policy contract behind the above: normalized protections, static and re-resolved protected topology, race-safe path resolution, legacy path_rename hook support, self-owned policy activation and detach, transactional policy map staging, policy generations in pinned maps, and a structured policy map ABI.
• Add resource limit checks.

Changed

• Choose the runtime and DSH integration separately using the core and plugins RPMs.
• Split RPM file ownership into agentsight-core and agentsight-plugins; core owns service resources and installs independently.

Performance

• Cache GenAI identifier hashes, vectorize SSL executable scans, and stream capture database queries.

Fixes

• Explain file guard activation, report file guard capability, and validate file protection boundaries.
• Ship per-architecture BPF objects so the enforcer payload follows the build target.
• Attach SSL uprobes earlier to catch the first TLS connections, add verified Codex TLS offsets, and bound unknown process registration.
• Preserve partial Qoder batch usage, usage-only batch records, bare JSON SSE usage, and the last usable batch usage.
• Honor successful Gemini tool calls, retain Gemini function responses, and replay Gemini session previews.
• Retain local session identity, attach local replies to their calls, disambiguate echoed tool call IDs, and compare complete repeated turns.
• Preserve user config on schema migration and make session controls accessible.
• Report cleanup errors from a failed activation without losing the original compile or kernel failure classification.
• Keep partial campaign reports and worker results, lock resource build publication, reject impossible benchmark metrics, preserve missing drop counters, bound recovery evidence by phase, and verify executed regression commands.

Upgrade notes

• The enforcer control protocol moves from v4 to v5 and is not backward compatible: a 0.15.0 client paired with a 0.15.1 enforcer has every request rejected as UnsupportedVersion, including health checks. Upgrade the client and the enforcer together.
• Full and agent-file-guard upgrades replace stale v4 hook layouts instead of silently accepting unenforced ordinary-write policies.
• Review the installation targets above before rollout: make install no longer activates what it installs, and deployments relying on the previous single-target behavior must call make install-core and make install-plugins explicitly.

0.15.0

Features

• Discover Gemini CLI JSONL chats under ~/.gemini/tmp/<project>/chats/ in the trajectory collector and local viewer, including sub-agent transcripts and project names; the viewer also opens legacy whole-file chats. Sub-agent composite IDs do not link back to the parent row.
• Add --stats-only to the standalone analyze CLI and batch-analysis wrapper for local perf/cost statistics without API credentials or LLM requests; accuracy --stats-only is rejected, and omitting the option retains model-backed analysis.
• Expose the probe-independent PipelineCore Rust library API for parsing, correlating and analyzing events without attaching probes, and re-export HttpContext as agentsight::analyzer::HttpContext so library callers can name the HTTP data carried by AnalysisResult::HttpContext; existing command syntax and capture behavior are preserved.

Fixes

• Bound the Tokenless savings numerator by the request window when timestamps are available, excluding older optimizations when the Dashboard range narrows. Legacy local stats.db tables without timestamp retain all matching records, so their savings can still include out-of-window optimizations.
• Count Tokenless records with a missing, null or upper-case mode as applied savings; only dry-run records are excluded.
• Keep Anthropic server-tool and MCP tool calls, including their arguments, when a stream is reconstructed after the connection drains.
• Treat a tool result that opens with a JVM or SQL exception as a tool failure in conversation grading and interruption detection, matching the grounding classifier.
• Preserve non-streaming Anthropic, Responses, Gemini and legacy-completion answers and tool calls in token breakdowns instead of reporting zero output.
• Preserve Gemini prompts, answers, tools and finish reasons when building calls from parsed messages without raw HTTP bodies.
• Render the DeepSeek Harness agentsight_status tool result through text content blocks so the host and model receive the validated status.
• Detect SSL symbols in Python executables and shared libpython images for the existing TLS capture path; retain retryable image reads and startup error causes.
• Reject fault attempts that were not fully delivered instead of reporting a passing benchmark campaign. (#8890)
• Recover interrupted benchmark campaigns by validating resume checkpoints, archiving unusable results and atomically replacing checkpoints. (#8857)
• Reject invalid benchmark time controls before network/file operations and prevent PID reuse from corrupting process-survival and resource evidence. (#8889, #8856)
• Preserve literal capture-database paths containing URI punctuation and valid JSONL records around damaged lines, with warnings for discarded records.
• Treat missing or invalid recovery observations as gaps, reject invalid final drop counters, and report unproven recovery gates instead of claiming an improvement.
• Read modern h2load request-latency summaries correctly, preserving mean, median, p95 and p99 without borrowing fields from adjacent rows.
• Restore the macOS release builds so the published 0.15.0 artifacts include the macOS package.
• Publish benchmark campaign artifacts atomically so an interrupted run cannot leave a partially written manifest.

Performance

• Compute benchmark latency percentiles from one sorted snapshot and release unused fallback samples to reduce long-run work and memory use. (#8888)

Docs

• Flatten the user manual layout.
• Move the integrated ANOLISA container image sources from docker/ to distribution/docker/ and update the AgentSight deployment guide's entrypoint path; CLI syntax, image tags and container behavior are unchanged.

0.14.3

Combined release notes for the 0.14.2 and 0.14.3 release work. Previously shipped fixes recorded in 0.14.2 are identified separately below.

Features

• Add read-only Hermes state.db trajectory collection and Claude SDK session discovery, including tool-result matching by call ID. (#8713)
• Add Gemini CLI chat-file conversion to ATIF, including legacy JSON files and replay of conversation corrections; automatic discovery of ~/.gemini chat files is not included. (#8801)
• Add type, state and agent filters to interruption queries where applicable, agent-scoped summary totals, and JSON output for interruption resolution.
• Add batch ATIF export without analysis and configurable parallel batch analysis.
• Add token --db, summary --tokenless-db, and per-agent metrics in JSON for offline queries and scripts.
• Add remote Tokenless statistics, refresh savings before queries, and count only savings from applied transformations.
• Add daily skill-hotness reporting and RSS/CPU benchmark metrics.

Performance

• Reduce capture overhead and database work, stream batch JSONL conversion, and reuse benchmark metric snapshots.
• Add cooperative CPU pacing through runtime_limits.cpu_budget_percent (default 25% of one logical CPU; 0 disables pacing) and increase the default connection capacity from 32 to 128.

Fixes

• Resolve gateway prefixes, vendor names and dated model aliases to usable tokenizers, including Gemini 2.5/latest/preview, GLM 4.5, Qwen 3.6, Kimi K2, GPT-5, and OpenAI audio/realtime families.
• Preserve response text, reasoning, refusals, server-tool blocks and stop reasons across Anthropic, Gemini, Responses, OpenAI-compatible, GLM, Codex and DashScope providers, including incomplete, filtered and non-streaming responses.
• Count streamed, cached and replayed token usage without duplication; retain complete token observations and fall back to raw-token counting when template rendering fails.
• Keep parallel tool calls and results associated by choice and call ID, preserve partial tool inputs, and report tool outcomes and first-output timing accurately.
• Preserve pending SysOM metadata and session attribution; retain main sessions, reasoning-only steps and parallel tool results during batch conversion, and isolate individual analysis failures.
• Keep slow TLS handshakes from blocking new connections, isolate cancelled HTTP/2 streams, preserve final headers after interim HTTP responses, and report HTTP/2 first-token latency.
• Include custom serve --db files in the storage budget and support BOM-prefixed storage, optimization and Tokenless configs.
• Require credentials for storage settings and LLM-spending endpoints, use the Agent Security V2 socket, handle IPv4-mapped rule addresses, and bound Agent Security response lines.
• Keep collected trajectories inspectable without GenAI records, refresh audit filters and trajectory savings, preserve UTF-8 previews, and retire stale model labels when content changes.
• Improve session search, preference counting and causal evidence matching; distinguish handled tool failures from unresolved failures and require continuous evidence for recovery claims.
• Record idle-agent OOM interruptions without duplicate kill reports, preserve truncated-turn state, and handle malformed counters, missing CPU measurements and failed reads explicitly.
• Reuse the global Prometheus recorder and initialize metrics before workers; skip Python executables during static-SSL probing.

Previously shipped fixes recorded in 0.14.2

• Preserve calls with no response body when an agent exits, and keep recap-only sessions inspectable with correct analyzer-row classification and per-session aggregates. These fixes were already present in 0.14.1 and are included here for the combined release summary, not as new 0.14.3 behavior. (#7271)

Upgrade notes

• Review CPU pacing and connection limits before rollout; explicit existing connection limits are preserved, and CPU pacing is a cooperative target rather than a hard quota.
• Scripts changing storage settings or invoking LLM-spending endpoints must supply credentials. Trajectory collection remains opt-in; Hermes collection requires access to its database and WAL files.

0.14.2

Fixes

• Record previously shipped fixes for calls with no response body at agent exit and recap-only session inspection, analyzer-row classification and per-session aggregates; the code was already included in 0.14.1. (#7271)

0.14.1

Features

• Accept --db in the query commands. (#7478)
• Content-probe unknown executables for static BoringSSL, with negative caching of misses.
• Support explicit prebuilt targets and build prebuilt agentsight artifacts in CI.

Fixes

• Map OpenAI, Claude, Qwen3, InternLM, Baichuan, phi-3-small and yi-9b-chat model names to real, loadable tokenizers.
• Parse Gemini streaming responses, honor final Anthropic usage, fold whole-message chat SSE snapshots, and parse CR-ended SSE lines. (#7329, #7193, #7398)
• Aggregate HTTP/2 responses that finish before the request, cut chunked terminators only at line boundaries, and honor previously inert HTTP config options. (#6562)
• Keep unindexed and nameless tool calls apart, match late results by tool call, and retain mixed tool results. (#7385)
• Exempt trusted sinks by address, let exec wildcard basenames match any command, and map every legacy rule verb to an enforcement mode.
• Preserve numeric JSON keys, null payload members, evidence numbers, and full cost signatures; keep every skill in reports and tolerate null agent names in CSV export. (#7451, #7032, #7403, #7413)
• Treat CJK punctuation and pipes as literal delimiters, and keep health reporting working with a pre-epoch clock. (#7488, #7479, #7239)
• Merge case-variant agents and models across filters, token breakdowns and model series. (#7456, #7184)
• Isolate SQLite maintenance, serialize opt-store migration, and warn when purge stalls within the size limit.
• Bound payload memory lifetimes and the protection scan directory. (#6781)
• Harden audit windows, ATIF token totals and session ids, containment snapshots, and grounding evidence matching. (#7326, #7467)
• Fix dashboard pagination, ranking refresh, cached-only step metrics, idle gaps, and timestamp precision. (#7183, #7093, #7091, #7089, #7095)
• Let recap-only sessions materialize, retain captured session children, and split analyzer call kinds.
• Gate server-only modules behind the server feature.

0.14.0

Features

• Unify SQLite storage under one configurable total cap (default 2200 MB); the largest databases are trimmed first and the cap is re-read without a restart.

Fixes

• Preserve and correctly count streamed content, reasoning, tool calls, response IDs, finish reasons, and token usage across Anthropic, Gemini, Codex, and Responses providers.
• Make agent discovery, trajectory filtering, reuse labels, semantic search, dashboard metrics, savings, and interruption aggregates more accurate and robust.
• Harden enforcement, credential discovery, IMDSv2 access, BPF polling, process restart, OOM detection, and audit/event validation paths.
• Make SQLite maintenance, storage budgeting, UTF-8 handling, SSE/HPACK parsing, and time handling resilient to malformed or edge-case input.
• Support legacy kernel enforcement, wrapped inode guard labels, legacy function-call tool requests, and additional process/file reference formats.

Tests

• Expand provider, SLS, trajectory, dashboard filter, storage-budget, and enforcement regression coverage.

0.13.1

Features

• Add JSON output and graceful CLI errors.

Fixes

• Resolve namespace PIDs to host PIDs with an init-namespace self-check. (#3041)
• Honor the RUST_LOG regex in the main logger. (#3186)
• Add inode guard support for file-delete-guard on 5.10/6.6 kernels.
• Drop the trace_id alias in the traces list. (#3261)
• Fix a stale file descriptor in the enforcer ringbuf consumer after mmap advance.
• Harden credential discovery.
• Pin the drain trigger to membarrier.
• Add a token-plan provider preset.
• Recover empty tool_call names from request tool definitions.
• Log semantic-search degradation causes. (#3443)
• Harden the SQLite lifecycle.
• Map qwen3.8-max to its tokenizer. (#3409)
• Restore agentsight-enforcer automatically when an upgrade leaves a stale enforcement layout, so file-delete guard and enforcement health do not require manual cleanup. (#3445)
• Keep an application's process tree under policy when its binding is recreated. (#3370)
• Reject unsupported event filters on audit cases instead of silently ignoring them.

0.13.0

Features

• Add GET /api/preferences and GET /api/preferences/export to surface the working habits inferred from recent conversations (language, plan-first workflow, test expectations, correction patterns, tool leanings), with /api/preferences/turns exposing the user turns an analysis was based on. Analysis runs per request over genai_events on Linux or collected trajectories elsewhere, so there is no derived state to migrate or go stale.
• Add GET /api/trajectories/steps to find ATIF steps by derived category (user_input, system, agent_message, thinking, tool_call, tool_result), returning each hit with its neighbouring steps. Categories are multi-label because a single agent step can carry a message, reasoning, tool calls and observations at once.
• Label trajectories for reuse triage, let a person settle a trajectory's label, add the reuse-label review page, and gate search to serve labelled trajectory history.
• Add an inode guard for file-delete-guard on 5.10/6.6 kernels, with domain isolation, violation events, and startup cleanup.

Fixes

• Initialize logging in the macOS trace path so trajectory collection failures surface instead of being silently dropped.
• Add a token-plan provider preset.
• Fix a stale fd in the enforcer ringbuf consumer after an mmap advance.
• Drop the trace_id alias in the traces list. (#3261)
• Honor the RUST_LOG regex in the main logger. (#3186)
• Resolve namespace PID to host PID with an init-ns self-check. (#3041)
• Add the conversation_id column before its index. (#3378)

0.12.1

Breaking

• Align kernel event timestamps by calibrating BPF monotonic clocks against realtime instead of container uptime. Historical wall-clock steps for events queued at the time cannot be reconstructed; already persisted records are unchanged.

Features

• Capture rustls plaintext for cosh-ng and attach the cosh plaintext tap by name. (#3191)

Fixes

• Stop counting cached tokens twice in token totals. (#3081)
• Stream the static SSL pattern scan. (#3087)
• Shorten the SSL uprobe re-attach TTL to 30s.
• Assemble fragmented HTTP responses.
• Complete HTTP/2 streams when SSE ends, and record streaming calls that signal via request headers instead of a body flag. (#3147)
• Merge duplicate records when a long-running call completes after an idle snapshot.
• Retry startup database cleanup when the database is locked, and recognise structured oom-kill records during startup recovery. (#3135)
• Match the OpenClaw gateway launched with the --max-old-space-size V8 flag.
• Add agentsight-enforcer logging.

0.12.0

Features

• Add --no-ebpf trajectory-only trace mode for environments where eBPF is unavailable.
• Support the DashScope/Bailian native protocol. (#2954)
• Add Kubernetes DaemonSet packaging. (#2976)
• Monitor agent resource usage. (#3005)
• Ground causal attribution in deterministic, re-checkable evidence. (#3011)
• Add an LSM-only agent file-delete guard profile and report its capability. (#2979)
• Add a vendored ABI guard, one-click audit protection, and Dashboard linkage. (#2775)

Fixes

• Avoid cgroup OOM during database purge by skipping VACUUM. (#2916)
• Merge Anthropic SSE token usage across events. (#2920)
• Warn when the data directory is on overlay storage. (#2977)
• Resolve PID lookups through a configurable procfs root.
• Keep conversation counts scoped by session. (#3014)
• Preserve tool results for causal attribution.
• Synchronize ActPlane policy deltas and prevent fail-open enforcement. (#2979, #3016)
• Reject oversized enforcement file paths instead of truncating them.
• Extract container IDs from systemd cgroup driver layouts. (#2997)
• Recognize modern OOM-kill dmesg format. (#3001)
• Resolve the PID namespace before seeding BPF cap_task state. (#3022)
• Pin Dockerfile RPM package selection to TARGETARCH. (#3025)

Docs

• Document --no-ebpf trace mode.

0.11.2

Features

• Show historical agent activity. (#2817)

Fixes

• Re-attach stale SSL uprobes after kernel-side consumer deregistration so capture self-heals without a restart. (#2792)
• Restart agentsight after an OOM kill. (#2925)
• Bound probe event channel by bytes to cap memory under event bursts. (#2925)
• Align CLI and dashboard with docs and de-duplicate the guide sidebar. (#2899)
• Trim oversized db by row fraction. (#2872)
• Trim interruption db to size limit. (#2823)
• Keep binding API state consistent. (#2794)

Docs

• Expand the AgentSight user guide into task pages. (#2825)

0.11.1

Fixes

• Keep null-session interruptions in breakdowns so per-session and per-conversation counts always sum to the total. (#2796)
• Add Bun SSL_do_handshake prologue pattern so Claude Code (Bun builds >= 2.1.113) LLM traffic is captured. (#2782)

0.11.0

Changes

• Version bump for RPM packaging; no functional changes since 0.10.3.

0.10.3

Features

• Add semantic search to the sessions list. (#2733)
• Add dsh plugin for DeepSeek Harness.
• Group agents by type in discovery.
• Add filtered_count to agent-health.
• Add /api/docs route inventory.
• Show LLM latency metrics in agent health cards. (#2586)

Fixes

• Drop hardcoded minus on savings. (#2754)
• Classify analyzer calls as internal. (#2755)
• Return savings rates as fractions. (#2732)
• Match tool args in loop detection. (#2719)
• Probe companion components for dashboard capabilities. (#2696)
• Scope graceful reap to worker agents.
• Count no_port gateways as healthy in dashboard. (#2694)
• Print deadloop hint on fresh install.
• Reload config on SIGHUP.
• Fill provider and session_id in audit events.
• Demote decompress fallback to debug level.
• Exclude sftp-server from agent discovery.
• Correct copilot cmdline rule typo.

0.10.2

Features

• Enforce size limits on sqlite stores. (#2644)
• Make dashboard UI bilingual (en/zh). (#2612)
• Add raw packaging for immutable release artifacts. (#2550)
• Add LLM latency metrics API. (#2578)

Fixes

• Match latency agents case-insensitively. (#2590)
• Address latency metrics CI follow-ups. (#2583)

0.10.1

Features

• Bootstrap dashboard i18n with preferred browser locale matching.
• Add agentscope framework to agent discovery rules.
• Streamline component onboarding docs and clarify service startup.

Fixes

• Treat pause_turn as a normal SSE finish. (#2320)
• Keep tool_call name across SSE continuation deltas.
• Report pids in the observer namespace. (#2360)
• Validate enforcer RPM payload, preserve RPM staging targets, and suppress repeated enforcer errors.
• Wrap extractor errors in JSON envelope and classify store errors by variant. (#2417, #2418)
• Dedupe unavailable state and refine dashboard metadata sync.

0.10.0

Features

• Add case containment lifecycle with policy handoff, no-gap replacement, dedicated API, and dashboard views.
• Add system audit protocol, event storage, dashboard, and extract audit service into a dedicated crate.
• Add ActPlane risk enforcement with enforcer service, hardened file controls, secure lifecycle, and risk enforcement dashboard.
• Convert Codex rollout JSONL to ATIF and cover Codex routing and tool calls with tests.
• Report process metadata on raw HTTPS events and carry it in the generic envelope.

Fixes

• Keep turn open on tool-call stop and add user_message_count to turn.id bucket key.
• Stream-decode fragmented zstd SSE responses.
• Improve QwenCode trace data accuracy and add QwenCode allow rules to agentsight config.
• Keep session across cosh restarts.
• Map cosh session temporary file writes. (#2080)

0.9.1

Features

• Rework optimization dashboard views and add detour-based cost waste analysis.
• Move agent health and interruptions to a dedicated dashboard page.

Fixes

• Extract cache tokens for OpenAI (prompt_tokens_details.cached_tokens) and DashScope (top-level cached_tokens) responses, and extract real user query from cosh-ng adapter prompt template.
• Capture Claude Code launched via absolute path or node wrapper.
• Skip agent_crash detection on clean exit and flush deferred GenAI events on agent exit.
• Skip message parse for non-LLM paths.
• Encrypt optimization config API key.
• Show known agent rules.

CI

• Pin eBPF build to clang 15 and use dedicated runner pools.

0.9.0

Features

• Add optimization analysis workspace, APIs, persistent analysis history, and dashboard pages for accuracy, performance, and cost reviews.
• Add Qoder trajectory collection, ATIF v1.7 export, batch analysis tooling, and subagent trajectory navigation with topology-style views.
• Add command-line discovery rules for CoshNG and normalize LLM event attribution with command-line context.
• Add six new interruption types and fallback capture for unparsable LLM HTTPS traffic.

Fixes

• Fix Anthropic SSE parsing, system prompt injection, and cache token accounting.
• Fix ATIF batch output to use the shared ATIF v1.7 schema and drop stale v1.6 paths.
• Fix optimization and trajectory collection edge cases, including stale conversation anchors and syscall tracepoint probe attach.
• Fix dashboard empty states, error banner wording, auth loopback handling, and session navigation behavior.
• Make raw HTTPS FFI output opt-in and skip duplicate SSE message parsing for OpenAI and Anthropic streams.

Changed

• Group optimization dimension analyses under per-target run roots and represent parallel LLM calls as ATIF subagent trajectories.
• Slim and gate default SLS output so trace content is not uploaded unless explicitly enabled.

0.8.1

Fixes

• Replace lock().unwrap() with poison-safe unwrap_or_else for mutex recovery.
• Correct SSL library attribution from aws-lc/BoringSSL to OpenSSL 3.x.
• Add Claude process name to BoringSSL classification.
• Preserve user config on schema migration instead of overwriting.
• Don't auto-overwrite invalid JSON configs; record process pid not thread tid in ns pid helper.
• Downgrade high-frequency event logs from debug to trace to reduce noise.

Tests

• Expand unit tests for handlers, interruption store, and token store.
• Add poison-recovery tests for mutex unwrap_or_else changes.

0.8.0

Features

• Add dashboard token-based authentication with file-only auth config.
• Add LAN/public IP address display and Chinese output in dashboard CLI.
• Add ECS security group guide and metadata integration to dashboard.
• Add conversation grader API and dashboard controls.
• Add COSH_SESSION_ID export for per-run session correlation.
• Auto-upgrade stale configs via schema_version.

Fixes

• Fix Codex SSL capture and SSE token extraction.
• Fix false interruption signals.
• Persist idle streams and tool results to avoid snapshot loss.
• Detect SSE stream errors explicitly.
• Restrict /health, /metrics, and server auth to localhost/file-only config.
• Remove hf-hub git fork from default build dependency.
• Fix IMDSv2 token fetching, probe deadlines, and ECS metadata deduplication.
• Fix RPM build to copy agentsight.json into source tarball.
• Address clippy single_match, nested if-let, and architecture boundary issues.

Tests

• Add dashboard mock HTTP and unit tests for coverage gate.
• Add build_output and public_address tests.
• Mark probe tests as #[ignore] for CI ECS runners.

0.7.1

Fixes

• Improve severity labels and agent sidebar UX.
• Show all verdicts in the summary command.
• Sync component.toml version with package version.

0.7.0

Features

• Add Codex CLI adaptation with three-tier SSL probe attach (symbol table → byte pattern → offset table) and cross-chunk SSE continuation buffer.
• Add security observability dashboard and server proxy for agent threat visibility.
• Add memory optimization with bounded event buffers, feature flags (features.*) and configurable runtime limits (runtime_limits.*).
• Add container_id to AgentsightLLMData for container-level attribution.
• Derive session_id from process environment variables and request metadata instead of message content.
• Add call_kind classification (chat / completion / embedding / tool_use) to GenAI semantic events.
• Add --exclude filter to agentsight audit CLI for noise reduction, and show non-streaming LLM calls in audit output.
• Add unified agentsight summary command for one-shot status overview.
• Enhance token savings page with baseline comparison, strategy breakdown, line-level diff highlighting and optimization tips.
• Upload skill metrics via SLS Logtail exporter.
• Improve agent health UX: role badges (P1/P2), TTL-based cleanup, process-ancestry grouping, and Session ID help tooltip.
• Filter client processes from health API to reduce dashboard noise.
• Add anolisa component contract for RPM lifecycle integration.

Fixes

• Fix sslsniff BPF verifier rejection on kernel 5.15 and add BPF load tests.
• Fix traced_processes BPF map leak causing uprobe attach failure after long runtime.
• Prevent duplicate uprobe Links by retaining inodes in traced_files on detach.
• Decode compressed (zstd/brotli) SSE streams so Claude Code and similar agents are fully captured.
• Harden compressed SSE decode against partial chunk boundaries.
• Extract token usage from non-streaming and HTTP/2 responses.
• Fix namespace PID usage in udpdns and tcpsniff probes.
• Strip /proc/{pid}/root prefix for uprobe attach in containerized environments.
• Implement tiered SSL and tcpsniff ring buffer reservations to reduce dropped events.
• Clamp before mask in filewrite/udpdns BPF probes; cap stdout payload to MAX-1.
• Change cgroup gate to OR semantics and add trace_cgroup FFI interface.
• Tighten SSE truncation detection and write pending row for deferred GenAI calls.
• Respect dynamic sysom path in SLS exporter mode selection; replace removed sysom_logtail_path with logtail_path filter.
• Validate ring buffer size is power-of-two at startup.
• Wire feature flags and runtime limits to actual runtime code paths.

Refactoring

• Split genai/builder.rs into 4 focused modules and genai.rs into 5 submodules.
• Bundle shared BPF maps into SharedMaps for reduced duplication.
• Extract background threads module with stop-signal support.
• Replace remaining unwrap() calls with if-let / ? patterns.

CI & Quality

• Add fmt, clippy, unit test coverage, and architecture boundary check CI gates.
• Add clippy.toml + cargo-deny for lint and supply-chain auditing.
• Add architecture boundary check script (check-arch-boundary.py).
• Add scoped AGENTS.md for FFI, unified orchestrator, and storage modules.
• Define Footprint Ladder for code surface growth control.
• Add agentsight-code-review and pr-body develop-skills.

0.6.1

• Add real-time agent_crash detection in trace mode.
• Add OOM crash detection.
• Add cgroup-level event filtering with v1/v2 compatibility.
• Support QwenCode skill discovery via per-user home scanning.
• Support SLS Logtail activation reversible via dynamic path.
• Support bridging ilogtail SLS_LOG_PATH into config via token-collector switch.
• Default traceEnabled to false to drop conversation content from SLS by default.
• Drop gen_ai.system_instructions from SLS uploads when traceEnabled=false.
• Refactor session_id and conversation_id derivation from response_id instead of message content.
• Fix CJK deadloop detection, kill() error check, and SIGKILL escalation.
• Fix SQLite read/write contention via VACUUM optimization.
• Fix rpm-build.sh agentsight build failures.
• Fix allow log path re-init on repeated new+start.

0.6.0

• Add deadloop detection and auto-kill mechanism for runaway agent processes.
• Add retry storm detection and /metrics interruption counters.
• Add BPF-layer HTTP protocol filter and wildcard capture (*) for unknown IP/port targets.
• Add client-side hybrid encryption for sensitive message fields.
• Add traceEnabled configuration toggle with SLS upload layer enforcement.
• Add HTTP domain rules resolved to tcpsniff BPF map via DNS.
• Add default DashScope HTTPS rule and anolisa_release module.
• Add FFI interface for tcp_targets and input_delta config.
• Add CO-RE compatibility to UDP DNS probe for kernel 6.0+.
• Support runtime SLS logtail path via config hot-reload.
• Expand interruption types and add logtail export.
• Restructure config to https/http rules.
• Refactor query stats.db by tool_use_id and unify savings display.
• Refactor load encryption public key from agentsight.json.
• Fix decode HPACK Huffman headers.
• Fix BoringSSL probe attachment, FFI event delivery, and chunked-body panic.
• Fix preserve initial SSE chunk in event-stream responses.
• Fix c_char / BPF comm portability (i8 vs u8).
• Remove dead code and deprecated APIs.

0.5.0

• Add Claude Code support including SSL probe attach for BoringSSL, Anthropic SSE thinking/tool_use content blocks, and message.id-based session correlation.
• Add tcpsniff probe for plain HTTP traffic capture with configurable IP/port filtering (disabled by default with empty tcp_targets).
• Add User-Agent based agent detection with comm fallback for simplified agent matching.
• Add UDP DNS probe for agent discovery (replacing TLS SNI probe) with QNAME parsing moved to userspace.
• Add TLS SNI probe module and refactor discovery to config-driven rules.
• Add connection scanner for pre-established LLM API connections.
• Add tools field to AgentsightLLMData FFI struct, passed through as raw JSON.
• Add container PID namespace support in BPF traced process filtering and event emission.
• Add agent matching rules and reduce BPF ring buffer to 32MB.
• Add uid field to SLS logs with OnceLock cache and startup validation.
• Support profile-based installs.
• Fix duration_ns calculation in LLM data.
• Fix SSL probe cleanup of stale inodes on process exit.
• Fix BPF verifier -E2BIG issues by removing nested #pragma unroll in udpdns.bpf.c and masking payload_len on older kernels.
• Fix skill extraction for Hermes agent architecture.
• Fix Node.js process.title change handling in OpenClaw matcher.

0.4.0

• Add HTTP/1.1 request body reassembly for fragmented SSL writes.
• Add skill metrics analysis with cosh filesystem-based discovery.
• Add SLS upload and Logtail file exporter for GenAI events.
• Add hermes agent matcher for LLM process discovery.
• Detect uv Python static OpenSSL in SSL sniffer.
• Remove AK/SK-based SLS direct upload, keep Logtail file export.

0.3.1

• Fix simplify agent_crash detection and fix multi-process dedup. (#411)
• Fix use SqliteConfig for audit CLI db path. (#399)
• Fix hide Cosh from agent health UI and remove keepalive support. (#401)
• Fix API endpoint table in AGENTS.md. (#397)

0.3.0

• Add interruption detection system with drain mechanism and dashboard integration. (#315)
• Add token savings page and API endpoint for optimization visualization. (#310)
• Add compounded token savings and request count tracking. (#320)
• Add C FFI API with cbindgen header generation. (#306)
• Add filewatch and filewrite eBPF probes for file access monitoring. (#308, #309)
• Support SysOM AK/SK GenAI capture for cosh. (#305)
• Use LLM API response_id as trace_id and add conversation_id field. (#304)
• Resolve session_id from agent's own session via ResponseSessionMapper. (#303)
• Fix interruption CLI and align conversation_id naming. (#318)
• Fix cosh session_id recognition by supporting snake_case response_id. (#307)
• Fix wrong tool call id in token savings compounding. (#316, #317)
• Fix standardize call_id, add tool_call_ids column. (#319)
• Fix session_id and response_id mapping in genai builder and storage. (#321)
• Fix token savings display in conversation list. (#322)
• Fix cache agent name by pid for dead process resolution. (#358)
• Fix remove custom db path and use default paths. (#359)
• Support nightly docker image build in CI. (#302)

0.2.2

• Support starting backend-server for dashboard with AgentSight service.
• Fix dashboard frontend dynamic width for multiple display-size.

0.2.1

• Add /usr/lib/copilot-shell path to CoshMatcher for agent discovery. (#190)
• Add 200MB size limit for genai_events.db to prevent unbounded growth. (#211)
• Remove /api/stats endpoint returning incorrect data. (#197)
• Extract audit from HttpRecord and filter non-LLM calls. (#196)
• Always show comparison data when --compare flag is used in token queries. (#194)
• Fix incorrect discover command in README documentation. (#191)
• Remove breakdown command and keep token consumption commented. (#193)
• Replace deprecated MemoryLimit with MemoryMax in systemd service file. (#181)

0.2.0

• AgentSight Dashboard web UI with real-time monitoring interface. (#74)
• Agent health monitoring with offline alerting and hung process dashboard restart. (#158)
• One-click navigation from dashboard to ATIF trace analysis page. (#116)
• /metrics endpoint to expose standard Prometheus-format data. (#134)
• Support for HTTP 2.0 protocol. (#147)
• Support to build RPM package. (#166)

Changelog

All notable changes to the cosh-ng project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[0.29.0] - 2026-11-08

Added

• Alibaba Cloud ECS instances can now answer questions without /auth: eligible requests use the OS Console model access automatically, defaulting to qwen3.7-plus, while an already configured provider stays selected; /auth gains an identity entry to switch back to the saved identity or to another provider, n disables automatic access for the current or future sessions, and Esc cancels the activation wait without replaying the question (#9449)
• skills.system_paths registers additional skill directories at System priority, so a skill collection installed outside the cosh package is discovered without a custom install prefix (#9460)

Changed

• BREAKING: make install installs into the shared anolisa namespace by default, placing skills and extensions under /usr/local/share/anolisa as RPM and the ANOLISA installer already do; pass AWPRJ= to keep the previous independent layout, and make layout prints the resolved directories (#9462)
• Cosh now finds skills and extensions installed under a custom prefix or a custom XDG data directory, and both RPM and the ANOLISA installer record the directories they used so the runtime follows them (#9460)
• A directory whose root holds SKILL.md is loaded as one skill, so its reference documents are no longer mistaken for separate skills (#9460)
• COSH_HOME relocates the user extension and state directories; COSH_STATES_DIR still takes precedence for state (#9352)
• Installation through the ANOLISA installer now requires ANOLISA 0.3.21 or later, which supplies the component discovery data (#9351)

Fixed

• cosh-cli checkpoint status names the workspaces whose change detection is not running and reports how many change events the shared watcher had to drop, so a workspace that silently stopped recording changes is visible (#7592)

[0.28.1] - 2026-11-03

Changed

• Install prebuilt binaries and the bundled workflow skill with the component Makefile.

[0.28.0] — 2026-10-25

Added

• Persisted session data is now bounded by a per-user budget (100 MiB / 7 days across configured roots): the oldest eligible sessions are cleaned up automatically, active sessions hold leases that keep them safe, and corrupted or incompatible data is never deleted (#7157)
• New /bug <description> command builds a pre-filled ANOLISA GitHub issue from an allowlisted runtime snapshot (version, provider/model, session ID, OS, shell identity, install package), prints the URL for review, and best-effort opens it in a browser on graphical Linux or macOS; opening or clicking the link sends the pre-filled fields to GitHub when the form loads, and the issue is only created when the user submits the form (#7258)
• Standalone SLS telemetry now reports the OS distribution (e.g. alinux 23, ubuntu 24.04) through a new os.distro field, so environment breakdowns match the anolisa unified uploader (#8565)

Fixed

• A checked-out project can no longer weaken agent security: the agent core ignores project-level config hooks, approval_mode, and allowed_tools, while system/user settings and shell-side project hooks (with their own content consent) keep working (#7244)
• Shell command trust is now bound to the exact approved command bytes: commands differing in whitespace, quoting, or newlines require their own approval instead of silently sharing one, and commands that failed, were interrupted, or timed out lose their trusted status, so a rerun asks again; a structured {"cmd": ...} request can no longer borrow the approval of a configured plain-command key (#6787, #6788)
• Project shell-hook consent now binds to the exact reviewed file content: consent records carry a digest, so changed hook files require re-consent before their hooks run again, and records in the earlier unversioned format need a one-time re-consent; hook loading is bounded (64 entries / 4 MiB per project, oversized trees rejected as a whole), and provider-owned request fields can no longer be overridden (#7158)
• COSH_SHELL_AI=off now stops every remaining path that could start an agent request: prompt insights are no longer rendered, auto-started, or accepted, and hook-consultation approvals and /hint <id> analyze no longer dispatch requests; local shell suggestions keep working (#6892, #7256)
• Quoted secret fragments — including bare access keys and PEM private keys — are now redacted from persisted and resumed conversations and from shell provider evidence, extending the existing cookie/token rules (#7396)
• Checkpoint commands no longer pre-reserve memory from an untrusted response-length prefix (a hostile daemon could previously force a 64 MiB reservation); memory now grows only as real data arrives (#7102)
• Manually configured AK/SK + security-token credentials are never silently replaced by the ECS instance role when a token expires; only providers configured as ECS RAM Role refresh from instance metadata (#6591)
• Re-authenticating an existing aliyun provider no longer loops on invalid base_url when the stored base_url is blank: the blank value is treated as absent and the template's builtin endpoint applies (#8505)
• [logging] level now configures the log level for both the agent core and the shell (the shell previously read only [ui] log_level); the old key remains as a fallback and the user guide documents the full resolution order (#8529)
• Diagnostic log files now respect the per-user budget (3 days / 20 MiB) even when the core and the shell write concurrently, and hard-linked or externally archived copies are never truncated (#7159)
• Natural-language prompts typed in a login session are routed to the agent again on distributions whose system profile ships a command_not_found_handle (Ubuntu/Debian with command-not-found installed); they were previously executed as missing commands with a command not found error. Handlers defined in the user's own login files keep running and stay delegated (#6999)
• After routing is turned off in an enhanced-native session, /mode routing assisted restores assisted routing locally whether it is typed directly, recalled from history, or edited at the prompt — it no longer falls through to Bash as a command (#7350)
• Deferred timeout notices finish by restoring the editable shell line instead of leaving the cursor on a blank line, and restoring an idle native prompt no longer swallows the failed-command insight (#7489)
• Approval cards no longer leak state between replacements: composer selections reset on each new card and captured command output stays synchronized, while approval prompts keep rendering inline in the shell (#7333, #8042)
• The audit log keeps its exactly-once guarantee when the shell event buffer shrinks or is rebuilt upstream: already-recorded events are not duplicated, and a typed audit.truncated marker records the gap (#2408)
• Checkpoint diff previews keep escaped and spaced filenames distinct and no longer reject valid diffs over non-UTF-8 bytes in ignored metadata; unsupported filename encodings now fail closed with a clear, non-retryable error instead of corrupting the diff digest (#3558)
• Checkpoint creation and rollback are refused while the btrfs filesystem is above its safe usage threshold, with a clear retryable message; deletion stays available so space can still be reclaimed (#7888)
• Legacy headless sessions now start on Linux kernels without openat2 (e.g. 4.19-era servers): the workspace file tools are disabled with a warning, and the model is told to use shell commands such as cat under the existing approval policy instead of the backend exiting before the first reply (#8769)
• The agent core no longer exits at startup in restricted environments where Ctrl-C (SIGINT) handler registration fails: it warns once and keeps running, and Ctrl-C still terminates the process through the kernel default (#2648)
• Removing or replacing the RPM no longer leaves stray /etc/shells temporary files behind when the transaction is interrupted, and the rewrite refuses unsafe symlinked /etc/shells targets instead of following them (#6581)

[0.27.0] — 2026-10-11

Added

• Managed installations now show an available-update notice at a safe idle prompt with the matching update command; unmanaged binaries remain silent (#3465)
• SLS telemetry now detects IMDSv2-only instances and uses their regional endpoint, while retaining compatibility with older metadata services (#3406)

Fixed

• Fresh login sessions now fall back to the native shell only when the enhanced runtime fails before producing side effects, preventing lockout without creating duplicate login sessions (#3395)

[0.26.0] — 2026-09-23

Added

• Login sessions started by the Enhanced Bash host now carry a real login identity on Bash 4+: shopt -q login_shell reports yes, $0 is -bash, and /etc/profile plus ~/.bash_profile are read, matching a native bash -l session; set shell.login_identity = false to opt out, and the previous behavior is restored automatically on Bash 3.2 or when the capability probe fails (#3358)
• cosh-ng can now be installed on Intel Macs: the raw backend ships an x86_64 macOS archive with a minimum of macOS 11.0, and the public installer recognizes Intel Macs instead of failing or falling back to the ARM package (#3448, #3449)
• cosh-cli checkpoint recover can recover an interrupted initialization even when the original workspace path no longer exists, reporting the notices through meta.warning (#3356)

Changed

• Diagnostic logging now defaults to the info level, so ~/.copilot-shell/logs/cosh-{shell,core}.log.<date> records shell/core startup, core spawn, and error choke-points that previously surfaced only in the UI; explicit COSH_LOG, RUST_LOG, or [logging] level settings still win, and debug: true raises the effective level to debug (#3331)

Fixed

• rtk-wrapped readonly commands whose only redirection suppresses stderr to /dev/null (e.g. find /tmp -name '*x*' 2>/dev/null wrapped as env TOKENLESS_* /usr/bin/rtk …) are auto-approved again in auto mode: the wrapper is peeled for classification while the wrapped form still executes, keeping RTK output compression active, and any deviation falls back to the approval card (#3436)
• When a Task created with checkpoint = on in an empty workspace fails against an older daemon, the Task now states why no snapshot was taken and offers clear next steps (upgrade ws-ckpt, add a file and resubmit, or select checkpoint = off) instead of failing without explanation (#3437)
• After a successful Task snapshot switch, new Core and Codex Tasks use the rebuilt workspace without a Gateway restart; if the workspace refresh cannot be established, new Runtime launches fail closed instead of using a stale view (#3438)

[0.25.0] — 2026-09-20

Added

• Managed Tasks are now end-to-end: submit persistent Core or Codex Tasks from the guided /task form, choose a checkpoint policy, reconnect to inspect progress, and safely preview, diff, and switch Task-owned snapshots through a Gateway-backed recovery flow (#2911)
• Slash command discovery inside /agent: typing / in the Composer offers prefix-filtered candidates with browsing and Tab completion, and submitted commands run through the normal handlers with confirmation cards (#3224)
• First-time provider setup is now automated: a conflict-free default name is derived from the template type and existing configs, and ECS RAM Role credentials are detected and submitted without manual confirmation through a bounded, cancellable probe (#3298)
• Readonly commands whose only redirection suppresses stderr to /dev/null (e.g. find /tmp -name '*x*' 2>/dev/null) no longer require approval in auto mode (#3208)

Changed

• Declared [[hooks.PreToolUse]] config hooks now run by default without requiring hooks.enabled; explicitly disabled hooks warn and are removed before extension registration, and empty hook output still blocks the tool call by default (#3330)
• Enhanced sessions no longer print the ownership status line (◇/◌) above the prompt by default, keeping the shell's native prompt appearance; set shell.status_symbols = true or COSH_SHELL_STATUS_SYMBOLS=1 to opt back in — when enabled, the symbol is published on its own line so narrow-terminal editing no longer loses CJK characters or misplaces the cursor (#3345, #3254)

Fixed

• Lexical path-traversal spellings that resolve into /proc, /dev, or /sys are now blocked by the readonly safety check, closing a bypass where variants like /../proc/version slipped through (#2708)
• Quoted /dev/null redirection targets such as 2>"/dev/null" are now classified as null redirections instead of redirection-write, so the approval card shows the correct reason (#2710)
• SysOM endpoint resolution now prefers a reachable in-VPC proxy, so ECS instances without public egress can reach SysOM; explicit overrides via COSH_SYSOM_ENDPOINT or the sysom_endpoint config keep the system proxy (#3188)
• Medium-risk tool requests whose names merely contain HOOK: as a substring are no longer misclassified as Hook requests, so the approval card offers the standard actions instead of the Hook action set (#3248)
• Valid token-plan credentials can again be saved through /auth when the gateway answers HTTP 400 on the model-retrieve route, while list-only providers still reject unverifiable credentials (#3276)
• zh-CN /help panel: the Registry group title is localized and the /agent summary wording corrected; en-US output is unchanged (#3363)
• RPM install/erase scriptlets now manage the /etc/shells entry safely: swapping between cosh-ng and copilot-shell no longer drops the login-shell registration the replacement still needs, updates are atomic and preserve file metadata, and install-time failures are reported instead of silent (#3367)

[0.24.1] — 2026-09-09

Fixed

• LLM token recording via agentsight broke silently when the Rust compiler version changed after the TLS library switch: cosh-core now exports a named probe symbol that agentsight attaches to by name, so capture stays stable across compiler upgrades (#3156)

[0.24.0] — 2026-09-08

Added

• In Enhanced Assisted Zsh sessions, slash-bearing, space-prefixed, and Han-leading path prompts are now routed to the Agent instead of falling through to the Zsh line editor, while ordinary shell input returns to Zsh unchanged once routing has been decided (#3004)
• The Tab key is handed back to the Zsh line editor before later typed input is processed, so custom Tab widgets keep working; retained input is replayed automatically without requiring another keypress, and user traps, key bindings, history, and prompt status are preserved (#3004)
• Default Bash Cosh sessions now include PATH additions from login profiles, so commands installed there are available in a new terminal; set COSH_SHELL_BOOTSTRAP_PATH=0 to disable this startup check (#3050)

Fixed

• Cookie headers assembled through braced shell parameter expansions (such as ${parameter#pattern}) are now recognized as sensitive data and kept out of native shell history; ambiguous nested syntax is redacted as a whole command (#3004)
• Zsh aliases and functions whose names contain slashes no longer get mistaken for missing filesystem paths and routed to the Agent; they continue to run in the shell (#3058)

[0.23.0] — 2026-09-02

Added

• The /hooks slash panel now lists individual shell hooks with their source and trust state, matching how agent hooks are displayed (#2999)

Changed

• cosh-ng no longer depends on the system OpenSSL runtime: HTTPS now runs on a pure-Rust TLS stack that still trusts the host OS certificate store, so Linux installs no longer require the openssl-libs / openssl1.1 system packages and source builds succeed on macOS without OpenSSL headers (#3030)

Fixed

• Secret redaction now respects word boundaries: ordinary text such as sk-hynix or npm_package_version stays visible in local evidence, while short credentials next to CJK text and structured Cookie/Bearer/JWT forms are consistently kept out of native shell history and redacted from journals, no matter which shell or entry path produced the output (#2996)

[0.22.3] — 2026-08-31

Fixed

• A damaged or unterminated terminal control sequence no longer hides subsequent terminal output or blocks command-boundary detection: oversized fragments are discarded and parsing resumes at the next valid marker (#2967)
• Installing the prebuilt cosh-ng package now works on newer distributions such as Ubuntu 24.04: the portable artifact bundles its own OpenSSL instead of requiring the OpenSSL 1.1 runtime that newer systems no longer ship (#2982)
• Natural-language prompts that are deliberately kept out of Bash history are now recalled and re-submitted with their exact original text instead of falling through to the shell or disappearing from history recall; leftover fragments from wrapped hint lines no longer linger on the next prompt (#2983)
• An unknown command entered right after a successful one still shows its failure insight: the command-not-found event is now attributed to the current input instead of being dropped (#2983)
• Prompt lines keep exactly one assisted marker after redraws caused by agent interactions, cancellations, or terminal width changes, instead of duplicating or dropping it (#2983)

[0.22.2] — 2026-08-28

Fixed

• Approved Bash tool commands handed off to the native shell now display the approved command itself instead of the internal wrapper line, including on Bash 4.4 terminals where fragmented redraws previously leaked that wrapper; execution, approval, history, and exit status are unchanged (#2949)
• Slash commands entered directly, recalled with Up-arrow, or typed on narrow terminals now appear exactly once in the terminal before their result panel again, while the internal guard line stays absent from terminal output, history, and logs; sensitive slash input is no longer expanded into Bash xtrace output (#2955)
• Natural-language prompts containing file paths that are routed to the Agent remain visible as a request notice even when the model's first response event is a tool call, so the original request no longer disappears from the screen; sensitive input is redacted as a whole field (#2953)
• An external interrupt signal sent to the shell process no longer leaves the parent terminal in raw mode: terminal settings are restored while the signal exit status is still reported to callers (#2968)

[0.22.1] — 2026-08-28

Fixed

• The internal builtin true __cosh_slash_guard__ sentinel line no longer appears in the terminal after an exact slash command in native Bash, including with verbose echo (set -v) enabled; slash routing, command execution, and history recall behave as before (#2943)
• Input that arrives pasted or piped in one batch together with a running command is no longer misrouted: slash-looking lines inside such a batch are delivered to the shell byte-for-byte instead of being intercepted as slash commands, keeping scripted pipelines intact (#2938)
• Command tracking and working-directory reporting keep working in directories whose names contain control characters, instead of dropping shell events (#2938)
• Headless one-shot runs with a prompt argument no longer hang for hours when an approval request goes unanswered: the request times out after 30 seconds and the run exits with a clear timeout error and a non-zero exit code (#2941)

[0.22.0] — 2026-08-27

Added

• Enhanced Assisted mode no longer relies on a global Bash DEBUG trap or forced tracing options; user-defined traps, shell options, and prompt hooks are preserved, and slash-command handoffs keep normal interactive shell semantics (#2832)
• System extensions installed outside the package-managed root (e.g. under /usr/local/share/anolisa/extensions) are now discovered automatically, so raw-installed sec-core and tokenless extensions load without a separate enable step; conflicting duplicate system installs stay disabled unless an exact source selection is persisted (#2909)

Fixed

• With xtrace enabled, cosh's internal hook activity no longer appears in the trace, so dynamic marker, working-directory, and environment data are not exposed; user commands and user-defined hooks keep producing trace output as before (#2914)
• Slash-bearing Han prompts such as 打开./missing/SKILL.md are routed to the Agent again instead of failing as a shell path, and the Agent now receives the correct prompt-time working directory, including after cd (#2918)
• Slash commands entered in the interactive shell are now persisted in Bash history so Up-arrow recall retrieves them correctly instead of an older command (#2917)

[0.21.1] — 2026-08-26

Fixed

• Registry slash commands such as /skills list, /hooks, and /extensions now discover project-level resources when no Agent turn has run yet and the process working directory differs from the shell cwd, e.g. after cd or daemon-style startup (#2686)
• Shell commands that produce very large output no longer exhaust memory: output is capped at 32 MB, oversized commands are stopped automatically, and the Agent sees a truncation notice with the start of the output instead of a bare error; when a hook's output exceeds the cap, the affected command stays blocked (safe side) instead of the hook's decision being silently ignored (#2880)
• Gateway tasks now start correctly on hosts running systemd 255, where the packaged service previously failed at startup because one of its security hardening settings is incompatible with that systemd version; workspace isolation is unchanged: task files stay confined to the workspace, host files remain read-only, and daemon state stays private to the service (#2843)

[0.21.0] — 2026-08-25

Added

• Add Native shell integration (shell.integration = "native") for a hook-free shell and Enhanced Shell-only mode toggled with Shift+Tab, while keeping Enhanced Assisted as the default with visible prompt markers; slash commands, tool calls, permissions, and system notices now use distinct /, *, !, and · card prefixes so output ownership is visible at a glance (#2759)

[0.20.0] — 2026-08-24

Added

• Report anonymous operational telemetry directly to SLS when cosh-ng runs without the anolisa unified uploader; no user prompts, code, or conversation content is collected; opt out at any time by creating ~/.copilot-shell/telemetry_disabled (per-user) or /etc/anolisa/.telemetry_disabled (system-wide) (#2715)
• Bind the local Gateway task profile to a closed task-only-v1 manifest so mismatched Core/Gateway pairs are rejected before task input or side effects (#2728)

Fixed

• Restore /usr/bin/cosh raw <adapter> to launch the TUI instead of failing with exit 127 after the transparency classifier misrouted the raw subcommand to bash (#2743)
• Route Han-leading natural-language prompts containing simple parameter references such as $HOME to the Agent, while keeping executable shell structures native so an intercept cannot alter adjacent command execution (#2746)
• Preserve the DEBUG trap across prompts on bash 4.2.x so command audit markers keep emitting after the first command (#2757)

[0.19.0] — 2026-08-21

Added

• Add a local gateway control plane with durable Task scheduling, runtime leases, and crash recovery, exposed through cosh agent task ... commands (#2603)
• Add direct ACP entrypoints cosh agent doctor and cosh agent run to verify and drive locally installed ACP adapters from outside the interactive Shell, with a once-only permission flow that prompts only on the local controlling terminal and records redacted evidence (#2603)

Fixed

• Detect system() calls in awk programs even when whitespace or line continuations appear before the opening parenthesis (#2655)
• Map missing precmd status markers to -1 instead of fabricating exit 0, preserving ledger integrity for interrupted or forged markers (#2709)

[0.18.0] — 2026-08-20

Added

• Cap in-memory transcript growth in long-running interactive sessions by keeping bounded working windows while spooling full terminal output to session files (#2682)
• Enable MCP tools that require long-running task augmentation, returning actionable errors when tasks fail or time out (#2645)

Changed

• BREAKING: /usr/bin/cosh now forwards non-TUI invocations directly to the configured shell; cosh --version, cosh --help, and cosh <script> outside an interactive terminal behave like the shell rather than opening the cosh TUI (#2625)

Fixed

• In trust approval mode under the cosh-core driver, hook-blocked shell commands can no longer execute through the staging grace window (#2125)
• Approval decisions are now resolved correctly when an external component has already logged the initial request (#2402)
• Approving a hook-rewritten shell command no longer fails with "could not route this approval" when another request in the same batch was refused (#2667)
• Audit logs now include a paired cancellation resolution when a pending turn extension is superseded, instead of leaving an orphaned request entry (#2695)

[0.17.2] — 2026-08-19

Fixed

• Cap run_command output at 32 MB to prevent out-of-memory kills from runaway commands such as dd if=/dev/zero or yes; when stdout or stderr exceeds the limit, the process group is killed and an OutputTooLarge error is returned instead of growing unbounded (#2405)
• Make RPM %post /etc/shells registration idempotent by normalizing content and probing before appending, and add a %preun scriptlet that fails closed when users still reference /usr/bin/cosh as their login shell, preventing dangling shells after rpm -e cosh-ng (#2599)

[0.17.1] — 2026-08-18

Fixed

• Reduce interactive echo latency from p50 20 ms to sub-millisecond and eliminate high-frequency idle CPU polling in long-running sessions by making the raw relay and SIGINT paths event-driven (#2622)
• Keep allowed commands executing when best-effort audit storage writes fail (#2631)
• Allow approved pipelines whose single-quoted arguments contain quoted newlines, such as multi-line jq or awk scripts (#2638)

[0.17.0] — 2026-08-17

Added

• Interactive disambiguation panel for /hooks enable|disable <id> when the hook id exists in both shell and agent layers, letting users choose to toggle the shell hook, the agent hook, or both (#2400)

Changed

• Skip redundant history processing during idle polling so long-running interactive sessions no longer repeat history-sized work while idle (#2546)

Fixed

• Reject hook output with an explicit "decision": null as invalid hook output: the tool call is blocked by default, or passes through with a recorded hook_failure notice when the hook sets fail_open = true; emitting {} remains valid pass-through (#2529)
• Report cosh pkg install/remove --dry-run success on dnf-based systems instead of returning a backend error for installable or removable packages (#2605)

[0.16.1] — 2026-08-14

Fixed

• Improve CJK text wrapping so East Asian characters fill the full terminal line width and punctuation stays attached to adjacent text (#2446)
• Validate credentials, endpoints, and models before persisting /auth changes, keeping the auth panel open on failure (#2458)
• Treat empty successful output from extension hooks as valid instead of fail-closed (#2506)

[0.16.0] — 2026-08-13

Added

• Raw packaging interface for deterministic cosh-ng archives with cross-target build validation and portable macOS launchers (#2411)

Changed

• Converge cosh-core and cosh-shell runtime paths, unify Claude and Qwen provider drivers, and add explicit shell/core protocol v1 negotiation with legacy fallback (#2403)
• Remove deprecated /draft slash command alias in favor of /agent (#2441)

Fixed

• Use monotonic clock for input-wait timing to avoid clock-skew stalls (#2176)
• Fix panel-family hint card rendering (#2196)
• Decode SSE events per spec and fail loud on malformed input (#2209)
• Confine and guard sensitive file writes across core (#2211, #2378)
• Pass raw prompt text through core and shell without normalization (#2256)
• Fix review marker activation on Enter key (#2274)
• Narrow interactive-cancel detection and pair ledger finish after correlated intercept (#2352, #2353)
• Send raw-mode disable to stdout on drop to prevent terminal state leaks (#2357)
• Harden hooks across core and shell (#2359)
• Avoid predictable temporary file paths (#2361)
• Enforce byte cap in line truncation branch (#2370)
• List all slash hint matches instead of first-only (#2410)
• Map missing failed exit code to -1 sentinel for consistent error reporting (#2412)
• Expose runtime context in core for consistent state access (#2428)

[0.15.0] — 2026-08-09

Fixed

• Restore hint cursor after inline hints in shell (#2172)
• Support ID_LIKE fallback for OS distribution detection (#2200)
• List hook commands in /help output (#2208)
• Skip audit logs for service lifecycle actions (#2213)
• Support macOS-specific file reads in core (#2220)
• Serialize handoff state to prevent race conditions (#2226)
• Normalize apt search glob patterns (#2227)
• Recover context budget after compaction in core (#2244)
• Deduplicate hook notices in shell (#2259)

[0.14.0] — 2026-08-04

Added

• /status, /about, and /stats slash commands for runtime introspection (#1778)
• /mcp slash command for MCP server management (#1949)
• /session list --all to enumerate sessions across workspaces (#2139)
• DashScope prompt cache support to reduce token cost (#2046)
• cached_tokens observability for cache-hit diagnostics (#2075)
• Dynamic max_tokens by model in the OpenAI provider (#2165)
• Advertise roots capability in MCP client initialization (#2007)
• Hook tools and environment support in core (#1894)
• Surface tool-argument status and cap retries across core and shell (#1925)
• Auto-execute fully readonly compound commands in shell (#1959)
• Extend capped runs across core and shell (#2035)
• Improved auth menu across core and shell (#2062)
• Bound agent handoff input-waits in shell (#2168)

Changed

• Terminal-agnostic multi-line prompt entry in shell (#1947)

Fixed

• Shell handoff and hooks: preserve LLM input, drop stale handoff text, resume handoff fallback within a provider session, redact handoff evidence, close secret-redacted handoffs via one-time claim token, converge Han NL input ownership, route sensitive NL to agent, and run project hooks for send-to-shell (#1955, #2010, #2055, #2074, #2130, #2137, #2151, #2154)
• Approval lifecycle: guarantee terminal state with lifecycle ledger and last-resort timeout, rearm auth input, surface sandbox-bypass approval in trust mode, and reject zero idle timeout (#1934, #1939, #1968, #2116)
• Auth flows: step /auth back on ESC, list /auth in /help, and hint /auth on noauth startup (#1891, #1906, #2166)
• Slash command and prompt input: prevent slash echo duplication on intercept, let Up recall slash commands, intercept slash-bearing NL prompts, support soft newline in NL prompts, keep card submit type-ahead, normalize CSI-u backspace, and key ghost ownership by route (#1868, #1899, #1911, #1922, #1942, #1993, #2167)
• Shell rendering: stop extdebug leak into prompt hooks, highlight code-block syntax, reply in user language, compact skills list, and disable implicit pagers (#1849, #1904, #1910, #1921, #1998)
• Command risk and safety: assess all compound-command segments for risk, gate irrecoverable system-control commands, and classify interpreter risk (#1905, #2081, #2119)
• File IO hardening: reject placeholder writes, make file writes atomic, bound and confine read tools, restore blocking before drop-write, and treat fd-dup redirect as non-write (#1918, #2069, #2120, #2121, #2124, #2127)
• Shell recovery and drift: prevent recovery storms and use zsh preexec $3 for drift (#2072, #2073)
• Audit logging: show hook context (#2082)
• Core runtime: preserve tool arguments, align compaction, show real session prompt, fail closed on emit error, and make truncation UTF-8-safe (#1844, #1847, #2003, #2005, #2118)
• Types, wire, and packaging: fix wire errors, drop cross-workspace dev-dep, align RPM identity, align bundle health checks, and add base-dir hint in skill tool (#1514, #1933, #1937, #1984, #2140)

[0.13.0] — 2026-07-26

Added

• Interactive session recovery via /session, /resume, and the --resume launch option (#1546, #1592)
• Workspace-scoped session persistence with schema versioning and legacy-session migration (#1546, #1592)
• MCP tool support for extensible agent capabilities (#1530)
• Contextual shell insight interactions (#1537)
• Secret redaction across core and shell layers (#1555)
• Diagnostic bundle export via cosh doctor (#1576, #1597)
• Extension platform in core and shell (#1583)
• Personalized prompt recommendations (#1606)
• Session compaction to manage persistence growth (#1668)
• PostToolUse response replacement and hook adaptation (#1669)
• Gated startup suggestions (#1671)
• Audit logging across core and shell (#1679)
• Improved session UX with slash command refinements and sysom /auth shortcut (#1726, #1813)
• Route unresolved natural-language input to Agent (#1742)
• Cancel active agent runs with ESC (#1761)
• Turn-scope batch approval consent (#1825)

Changed

• Revert persisted credential encryption (#1748)
• Align task scope documentation (#1445)
• Stabilize core and shell test gates (#1699)
• Speed up raw CLI tests and fake stream pacing (#1797)
• Track cosh-shell test inventory at 2469 (#1827)

Fixed

• Session command parsing, signal exits, slash argument handling, and prompt ghost ESC (#1632, #1634, #1636, #1663, #1724, #1843)
• Agent question interaction, suggestion controls, recommendation scopes, and tab redraw (#1725, #1741, #1749, #1758, #1821)
• Approval card layout, blocked-title alignment, and empty enter handling (#1786, #1788, #1838)
• Auth and trust hardening: validate providers, harden auth, preserve trust blocks, encrypt credentials, and expand paths (#1627, #1673, #1701, #1722, #1777, #1784, #1791, #1809, #1816, #1841)
• Audit logging fixes: kill trees, split compound commands, redact secrets, scope claims, and preserve export path (#1611, #1613, #1635, #1765, #1772, #1840, #1842)
• Core runtime stability: JSONL validation, tool selection errors, streamed state, ai-like tables, revision clock, free-text clearing, layout gates, and SysOM terminator (#1599, #1661, #1689, #1730, #1731, #1799, #1800, #1803, #1839)
• Platform and CLI correctness: honor dry-run, handle skipped checkpoints, allow search patterns, fix package dry-run/search results, respect cargo config, sync Bash HISTFILE, validate workspace paths, route --help to stdout, add skill arg checks, warn on redacted writes, skip DEBUG trap, restore utility tools, stop BASHOPTS extdebug leak, handle null redirection, keep provider handoffs alive, update DashScope URL, raw action relay watchdog, restore startup health row, hide receipt audit ref, and update test inventory baseline (#1426, #1440, #1633, #1637, #1642, #1646, #1672, #1675, #1676, #1710, #1719, #1733, #1783, #1787, #1790, #1795, #1808, #1812, #1818, #1820, #1845)

[0.12.0] — 2026-07-12

Added

• Move authentication ownership into cosh-core with isolated config layers (f028ad90)

Changed

• Consolidate logging under a unified runtime module (db86b3dd)
• Migrate component docs into user-guide/developer-guide and add cosh-ng docs (317d3f26, adf63ac2)
• Rename *_CN.md docs to *_zh.md and fix cross-references (82f8dab4)

Fixed

• Honor svc dry-run across platform and cli (4c593050)
• Preserve manual aliyun fallback and legacy STS auth (924dd76b, ee1dd179)
• Protect auth provider edits; prioritize aliyun auth option (f0c97efa, 904655fb)
• Bound host-executed shell preview (a6da7301)
• Route noninteractive cosh launcher calls; support raw command passthrough (ecb56739, 1490eb3c)
• Bind startup prompt and agent request context (14d6336f, 25d9d28f)
• Own prompt boundary in shell (#1310)
• Avoid UTF-8 split in loop detection (ef7f5147)
• Remove provider-visible skill hints; guide diagnostic skill use (a6024873, 7f695178)
• Drop redundant format borrow; satisfy clippy diagnostics (5e14a686, 063217f1)
• Stabilize CI, raw-cli, PTY, and service tests (d573796d, 3563a5ab, 0fb34ea6, fc28da5f, ad138d45, 65421d25, 5b17b892, 3e43ba6e, 707bc3c0)

[0.11.0] — 2026-06-28

Added

• Aliyun authentication provider with ECS auto-detection, STS credentials, and QR code flow
• SysOM Aliyun provider with ACS3 signing for LLM API access
• Per-turn SLS JSONL logging for observability
• SysOM request source identification headers
• Structured tracing logging system across all crates
• Sandbox bypass approval flow on PostToolUseFailure hook events
• Startup health scan for environment diagnostics
• Extension/hook/skill enable/disable commands (/extensions, /hooks, /skills)
• Unified component state management module
• Dedicated HOOK approval panel with simplified UI
• UserPromptSubmit hook with Ask approval enforcement
• Shell evidence read admission control in cosh-core
• Tool activity rendering in cosh-shell
• cosh-switch hint in startup banner for toggling between cosh-ng and copilot-shell

Changed

• BREAKING: Rename CLI binary from cosh to cosh-cli; remove dispatch_core
• RPM spec: install cosh-cli binary, /usr/bin/cosh launcher, cosh-switch script, Conflicts: copilot-shell
• Replace eprintln with structured tracing macros
• Unify hook decision aggregation with fold_decision
• Update workspace repository URL to github.com/alibaba/anolisa

Fixed

• Auth ECS flow and panel overlap on phase transitions
• Auth QR code rendered without ANSI escape codes
• Use SysomProvider for aliyun after auth success
• Align hook input fields and AfterModel/wrap_tool_response with copilot-shell protocol
• tool_result dedup guard and visibility
• Restore prompt before shell handoff
• Suppress duplicate evidence reads
• Reduce failed-command auto analysis noise
• Skill existence check and harden approval matching
• Resolve clippy warnings across cosh-core and cosh-shell

[0.10.0] — 2026-06-23

Added

• Shell evidence protocol for capturing and replaying command execution context
• Shell evidence control tool in cosh-core for evidence lifecycle management
• Hook protocol aligned with copilot-shell for zero-change extension support
• Per-hook decision propagation through notification protocol
• Hook warnings rendered with per-hook decision color-coding in cosh-shell

Changed

• Share agent error display text across cosh-shell modules

Tests

• Cover shell evidence raw CLI flows

[0.9.0] — 2026-06-22

Added

• Hook notifications integrated into approval panel with ⚠ warning display
• Hook ask decisions enforce user approval even in Trust/Auto modes
• Extended hook system with tool_use_id association and new event types
• Registry protocol for /extensions /skills /hooks slash commands

Fixed

• Show Registry group in /help output

Changed

• Remove dead skill management code

[0.8.0] — 2026-06-18

Changed

• Rename cosh-tui crate and binary to cosh-core across the entire workspace
• Update adapter system: CoshTuiAdapter → CoshCoreAdapter, AdapterKind::CoshTui → CoshCore
• Update environment variable COSH_TUI_PATH → COSH_CORE_PATH
• Update RPM spec, documentation, and all test fixtures

Fixed

• Neutralize agent status text in streaming cards
• Align streaming card widths in cosh-shell

[0.7.0] — 2026-06-17

Added

• Extension discovery and loading module with cosh-extension.json manifest support
• Extension hooks integrated into startup lifecycle
• Skill module with multi-level loading (built-in, user, project) and hot-reload
• SkillManager integrated into tool registry and startup
• Available skills injected into system prompt for LLM discovery

Fixed

• Infinite loop in expand_env_vars when environment variable is undefined
• Warn on unsupported extension hook events (PostToolUseFailure, BeforeModel, AfterModel) instead of silently discarding
• Align extension hooks format with copilot-shell nested group structure
• Remove unused args parameter from skill tool schema to avoid misleading LLM
• Show question free text answers in cosh-shell
• Harden foreground shell handoffs
• Share copilot shell config path and keep legacy config fallback

Changed

• Normalize cosh-shell config keys
• Standardize cosh-shell code and test organization
• Move user state under copilot shell scope

[0.6.0] — 2026-06-16

Added

• P0 hook system with 5 lifecycle events (on_session_start, on_turn_start, on_turn_end, on_tool_call, on_session_end) in cosh-tui
• Shell approval classification and hook origin tracking in cosh-shell
• Migrate current cosh shell into monorepo workspace

Fixed

• Address approval review findings in cosh-shell
• Harden shell evidence continuation to prevent dropped context
• Normalize tool call streaming protocol in cosh-tui
• Fix passthrough for subcommands in cosh-shell

[0.5.0] — 2026-06-15

Added

• CoshTuiAdapter persistent process mode (spawn once, reuse across agent runs, auto-restart on death)
• ask_user round-trip through control protocol (agent can ask inline questions routed to TUI)

Changed

• Split cosh-tui main into cli/headless/interactive modules
• Rename binary from cosh-tui-core back to cosh-tui

[0.4.1] — 2026-06-15

Added

• settings.json → config.toml auto-migration with AES-256-GCM encrypted API key decryption
• JSONL protocol and tool approval integration tests

Fixed

• Prepend precmd in PROMPT_COMMAND to capture real exit code (Alibaba Cloud Linux /etc/bashrc issue)

[0.4.0] — 2026-06-15

Added

• JSONL wire protocol (InputMessage / OutputMessage) for cosh-shell ↔ cosh-tui communication
• Provider abstraction with OpenAI-compatible streaming (DashScope, OpenAI, DeepSeek, Generic profiles)
• Tool execution framework with 7 built-in tools (shell, read_file, write_file, edit, grep, todo, skill) and approval control
• Context window management, message truncation, loop detection, conversation compression
• Lifecycle hooks framework
• CoshCore agent loop engine
• TOML-based multi-provider config with environment variable expansion

Changed

• BREAKING: Binary interface from ratatui interactive TUI to JSONL stdin/stdout backend
• BREAKING: Config format from settings.json to config.toml
• Rewrite session store with single-file JSON persistence

Removed

• Legacy ratatui-based TUI code (app, commands, llm, logger, theme, tools, ui modules)

[0.3.0] — 2026-06-15

Added

• cosh-shell crate — PTY-based AI-augmented shell host with OSC marker protocol
• Claude, Qwen, Fake AI adapters with streaming support
• Inline rendering engine (approval, question, recommendation, activity panels)
• Governance layer with approval modes
• Terminal recovery via signal handlers (SIGTERM/SIGHUP/SIGQUIT) and panic hook
• Exit code classification with 8 categories (Smart/Auto/Manual analysis modes)
• Tool display engine with per-tool-type parsing and ANSI color categories
• Hook engine with built-in hooks (FailedCommandHook, TestFailureHook) and skill routing
• External hook loading from ~/.config/cosh/hooks/ with subprocess execution
• Native shell compatibility (rcfile loading, PS1, history, login shell detection)
• Context window with sliding window (max commands, max age, token budget)
• Prompt intent optimization (do → Bash tool, know → prose)
• Natural language intercept with visual feedback
• InputClassifier conservative mode for native mode
• Analysis throttle (30s cooldown, max 3 consecutive)
• Consultation card rendering with keyboard capture
• Control protocol for tool approval round-trips
• Startup banner with gradient ASCII art logo
• /mode and /hooks slash commands
• Architecture documentation

Fixed

• Native mode input rendering with powerlevel10k dual-line prompts
• Slash/NL intercept via buffered-then-judge strategy in native mode
• Zsh preexec intercept for command_not_found
• CandidateRedraw line clearing for CJK input and backspace
• Suppress cosh-osc$ prompt leak in native mode
• Tool display label matching in bash tool executor
• Wide character placeholder cell handling in buffer extraction

Changed

• Unified workspace version (0.3.0) for all crates (cosh-types, cosh-platform, cosh-cli, cosh-shell, cosh-tui)

[0.2.0] - 2026-05-16

Hardening + audit-subsystem release. Workspace versions bumped to 0.2.0 together with the release profile and lockfile commit.

Added

• audit subsystem with PEP/PDP/log split: cosh audit check / cosh audit log for command-safety gating and per-session retrieval.
• Workspace release profile (opt-level = 3, lto = true, strip = true, codegen-units = 1), committed Cargo.lock, workspace-level dependency pinning, and native CA cert support.
• Command timeouts, input validation, and panic-safe JSON output across cosh-cli and cosh-platform so a panic still emits a CoshResponse envelope on stderr instead of an empty exit.
• forbid(unsafe_code) on cosh-cli / cosh-platform, plus svc list --state filter validation against an allow-list.
• pkg search cross-references installed status so results show which matches are already installed.
• ResponseMeta.warning field for non-fatal warnings; audit responses are explicitly marked as stub via this field.
• LLM tool surface expansion in cosh-tui: pkg / svc / checkpoint wrapper tools, plus svc enable / svc disable --dry-run.
• Timeouts + exponential-backoff retries on LLM and external command tools in cosh-tui; 60 s shell-tool timeout.

Changed

• TUI /help aligned with the full command set; title bar version and markdown prefix stripping corrected.
• Clippy warnings resolved across the workspace; dead-code allowances dropped; test code aligned with production lint level.
• Build warnings eliminated and version detection improved across cosh-tui / cosh-platform.

Fixed

• Shell safety check tokenized to close tab / newline / redirect / chain bypasses; substring matching on raw command strings replaced with whitespace (incl. \t / \n / \r) tokenization and metacharacter rejection (; | & > < $ ` ( ) { }) — is_safe_command in crates/cosh-tui/src/tools/shell.rs.
• Forbidden tool calls are now blocked even under Yolo approval mode.
• cosh-cli wrapper tool output is bounded so a chatty subcommand cannot blow the LLM context window.
• Tool-call IDs synthesized via a process-wide counter to guarantee uniqueness across the agentic loop.
• settings.json and session files written atomically with 0600 permissions.
• Runtime bounds enforced for the agentic loop, history, config, and tool messages; scrollback bounded with UTF-8-safe truncation.
• Panic hook installed in the TUI; history navigation recovered after panic.
• ws-ckpt IPC response size bounded to 64 MiB.
• Nonexistent systemd services detected via LoadState=not-found instead of misclassifying them as "inactive".

Security

• Audit-stub recoverable / hint semantics surface clearly to agents via the standard CoshError envelope.
• Atomic-rename + 0600 perms on credential-bearing files.

[0.1.0] - 2026-05-10

Initial public-shaped release after renaming the workspace from agos-core to cosh-ng and adding the interactive TUI crate.

Added

• 4-crate workspace: cosh-types, cosh-platform, cosh-cli, cosh-tui with strict dependency direction cosh-cli / cosh-tui → cosh-platform → cosh-types.
• cosh CLI binary with dual-mode dispatch: cosh (no args) execs into cosh-tui, cosh <subsystem> <action> returns structured JSON.
• Cross-distro pkg subsystem: install / remove / search / list routed across dnf / apt-get (apt-cache for search) / zypper based on Distro::detect() reading /etc/os-release.
• svc subsystem over systemctl: status / start / stop / restart / enable / disable / list, with uptime and corrected column mapping in list.
• checkpoint subsystem talking to the ws-ckpt daemon over Unix-socket IPC; bincode wire format with 4-byte LE length prefix and explicit protocol versioning + error handling. Commands: init / create / list / restore / recover / delete / diff / cleanup / status.
• cosh-tui interactive TUI on ratatui + crossterm: slash-command system with auto-complete, session management, theming, custom border set, echo-on-submit.
• Agentic loop with cosh-cli wrapper tools in cosh-tui, bringing pkg / svc / checkpoint tooling to the LLM (initially shipped as cosh-tui v0.4.0).
• LLM chat integration with config-driven providers and UI surfacing.
• Unified settings.json V2 config consolidating prior scattered config files.
• AES-256-GCM decryption for encrypted credentials.
• macOS detection + Homebrew backend in cosh-platform, with unit tests.
• Unified JSON envelope CoshResponse<T> with ok / data / error / meta, classified CoshError carrying recoverable and hint for agent retry decisions.
• Integration tests for pkg and checkpoint CLI commands.

Changed

• Workspace renamed from agos-core (with agos-types / agos-platform / agos-cli) to cosh-ng (with cosh-* crates); agos-cli and agos-platform removed in the same commit.
• cosh-tui checkpoint tooling adapted to the new daemon protocol.

Fixed

• cosh-cli stdout validated as JSON before forwarding to the LLM, preventing parser confusion on malformed bytes.

[pre-0.1.0] - 2026-05-03 → 2026-05-08

Pre-rename agos-core foundation.

Added

• Initial 2-crate workspace agos-types + agos-platform.
• agos-cli cross-distro CLI prototype with pkg, svc, checkpoint, audit command shapes.
• MVP v2 CLI Gateway architecture document and bilingual (English / Chinese) usage guide.

Changelog

All notable changes to ktuner are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Added

• Initial kernel-tuning engine: check/tune/fix/why/rollback commands evaluate 207 rules and output structured JSON tuning recommendations.

Changelog

All notable changes to OS Skills are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[0.6.4] - Unreleased

Fixed

• Correct the ws-ckpt skill and adapter script paths in the local fallback documentation.

[0.6.3] - 2026-08-21

Fixed

• The RPM now provides anolisa-component(os-skills), allowing anolisa upgrade to resolve the OS Skills package from RPM metadata for an existing component when the repository-side component index is unavailable (#2576).

[0.6.2] - 2026-08-07

• Added the ktuner skill for deterministic kernel diagnosis, tuning, and rollback. (#1278)
• Removed legacy OpenClaw and Hermes adapter scripts from source and RPM installs. (#1172)
• Updated anolisa-guide with authenticated Skill Ledger recovery and tamper detection. (#2185)

[0.6.1] - 2026-07-03

• Rewrote sysom-diagnosis skill and removed legacy CLI. (#1241)
• Fixed OpenClaw gateway write scope verification in install-openclaw skill. (#1205)

[0.6.0] - 2026-06-29

• Added anolisa component contract (component.toml, Makefile, RPM spec). (#1159)
• Added OpenClaw bootstrap guidance to install-openclaw skill. (#1051)
• Added model endpoint preflight before gateway startup in install-openclaw skill. (#1031)
• Added static knowledge base update script for anolisa-guide skill. (#1010)
• Added anolisa-guide skill. (#849)
• Fixed Aliyun mirror fallback for uv and qwenpaw install. (#968)
• Fixed dashscope proxy URL to new Anthropic endpoint in install-claude-code skill. (#858)
• Renamed copaw to qwenpaw across os-skills. (#968)

[0.5.0] - 2026-06-11

• Added anolisa-register skill. (#829)

[0.4.0] - 2026-06-08

• Added auto-install tokenless plugin support for agent install skills. (#731)
• Added OpenClaw dependency precheck. (#719)
• Improved OpenClaw non-interactive setup. (#687)
• Added Hermes adapter runner. (#617)
• Added standalone ANOLISA adapter entry. (#549)
• Fixed OpenClaw state dir handling normalization. (#641)
• Improved Makefile install paths and contract. (#541)

[0.3.0] - 2026-04-26

• Added hermes-agent-install skill. (#353)
• Added clawhub-skill-mng skill with npm install support and YAML description matching. (#315)
• Fixed AgentSight custom db path issue, using default paths instead. (#366)
• Fixed AgentSight token savings query support. (#355)
• Fixed AgentSight interruption CLI and aligned conversation_id naming. (#334)

[0.2.2] - 2026-04-15

• Support enable AgentSight dashboard in agentsight skill. (#222)

[0.2.1] - 2026-04-14

• Upgraded xlsx skill with MiniMax open-source implementation. (#218)
• Updated skill descriptions from "suitable for alinux4" to "rpm-base linux". (#182)

[0.2] - 2026-04-12

• Added humanizer, image-gen, pdf-reader, and xlsx skills. (#178)
• Added cosh-guide skill. (#23)
• Support net/io/load diagnostic capabilities to sysom-diagnosis skill. (#163)

Changelog

All notable changes to SkillFS are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[0.5.6] - 2026-11-06

Changed

• RPM delivery splits into skillfs-core and skillfs-skills, selected by skillfs. The CLI moves to /usr/bin/skillfs and the bundled skill to /usr/share/anolisa/skills/skillfs-mount/ (#9222).
• ANOLISA owns component discovery contracts. Upgrade installed SkillFS RPM roles together; hosts with ANOLISA and raw installs require ANOLISA 0.3.21 or later (#9351).
• make install defaults to the shared ANOLISA skill namespace; use AWPRJ= for an independent layout (#9462).

Fixed

• Managed stop and orphan cleanup preserve unrelated processes after PID reuse; malformed mount-table escapes no longer produce false target matches (#9242).
• Renaming files, symlinks or special files onto virtual directory slots is rejected, while supported directory moves remain available (#5375).
• pip user installs retain their original commands, and command detection works without which (#9300, #9276).
• Skill parsing recognizes indented and tab-separated section headings; enabled-only lists report empty results without empty source headings.
• Session-log usage distinguishes skills with shared name prefixes and counts paths next to shell operators (#8694).

[0.5.5] - Unreleased

Changed

• Install the runtime and bundled skill through separate RPMs.
• Place the bundled skill in the shared ANOLISA skills directory.

[0.5.4] - 2026-10-28

Fixed

• Moving a skill into another skill directory removes its stale top-level entries from /skills and skill-discover, keeping live discovery consistent with a fresh scan (#9124).
• When Yarn is selected, npm install commands with packages, options or ambiguous shell syntax retain their original form instead of becoming invalid commands (#9003).
• Chat usage statistics treat --logs-dir as a literal path, including brackets, and avoid counting logs from similarly named sibling directories (#9180).

[0.5.3] - 2026-10-23

Added

• skillfs mount --config mount.toml --managed supports automatic recovery, preserving startup configuration while reading current source contents. Configuration changes take effect after a successful stop/start (#8883).

Fixed

• Managed mounts start reliably on dot-prefixed mountpoints and slow hosts, and report worker startup failures promptly (#8080).
• Flat and Hermes installs keep staging directories hidden and maintain consistent metadata reads and directory listings after publication (#7767).
• Creates, renames and nested manifest edits keep skill-name ownership and discovery consistent; installation and renames honor configured size limits (#7742).
• Skill parsing and CLI output handle whitespace-only frontmatter, character-based name-length diagnostics and control-character escaping.

[0.5.2] - 2026-10-15

Fixed

• Managed stop, supervisor shutdown and orphan replacement now retain the live Ledger backing alias and its directory when the FUSE mount remains busy. If the mount becomes idle within the shared 10-second shutdown deadline, cleanup releases both mounts and removes the SkillFS-created backing directory while preserving source contents (#7297).
• Large authenticated change notifications now request a whole-skill rescan instead of exceeding the daemon's 64 KiB frame limit. Requests at the limit retain their path hints, and the original event log remains unchanged (#7189).

[0.5.1] - 2026-10-10

This patch release consolidates filesystem boundary fixes and usability improvements merged since 0.5.0.

Changed

• Authenticated notifications and live-source resolution now work with the Rust sec-core SkillSec daemon. With a compatible daemon, startup and skill mutations drive scanning and activation updates; notifications remain best-effort, not an exactly-once delivery guarantee (#3295).

Fixed

• Hidden skills now reject writes through already-open handles as well as nested file creation, links, metadata and xattr changes. Snapshot reads of symlink targets and xattrs follow the active view, while source metadata changes no longer follow symlinks (#5382).
• Flat and Hermes directory operations now keep skill listings and inode identities consistent after moves, replacement and unlink. Reserved paths, staging directories and hidden dot-directories stay out of ordinary listings; Hermes top-level files remain readable.
• Watchers now retain mutation events when reads happen nearby and track categorized manifests, directory moves and removals. Pending-install checks and activation decision waits are bounded (#4530).
• Mounting preserves existing views, including unparseable configuration; generated views and managed state use distinct staging files. Views and discovery no longer duplicate skills, and classification/listing report skipped skills, name collisions and load failures (#6202).
• Managed mounts reject source changes during reuse, retain backing roots when unmount fails, and handle escaped or non-UTF-8 paths correctly. Control socket parent directories and activation log paths are checked before use; reconciliation retries temporarily unavailable daemon endpoints.
• Skill parsing now handles UTF-8 BOMs, CRLF, fenced sections, empty frontmatter, duplicate sections and parameter names without losing content. Oversized skill and category metadata reads are bounded, and unbalanced directives preserve their original text.
• OS command adaptation targets invoked commands without rewriting incidental text or Python pip module calls, including commands behind timeout, nice and run labels. CLI status names match their documented values, control characters are escaped in listings, and raw filesystem paths are preserved.

[0.5.0] - 2026-09-20

Added

• skillfs mount --config mount.toml now combines ordered skill sources in one mount. Earlier sources win whole skill directories; multi-source mounts are read-only and require remounting after configuration changes or adding or removing skills (#3200).
• An optional Kubernetes deployment seeds read-only skill packages into a private writable source for Ledger scanning and activation. The new --read-only option prevents writes through the agent-visible mount; missing or invalid activation keeps skills hidden (#3182).

Changed

• Both Debian and Alibaba Cloud Linux 4 sidecar images now supervise real FUSE reads and attempt remounts after repeated failures, with bounded retries. Workloads must reopen failed handles after recovery (#2701).
• Read-only transformed SKILL.md handles now retain their captured content across source edits, while new opens read the updated content. A bounded cache reuses transformation results across attribute queries and opens. Separately, new captured handles that would exceed the mount-wide 64 MiB or 1,024-handle budget fail to open with ENOMEM; closing captured handles frees capacity (#3202).

[0.4.2] - 2026-08-27

Added

• An optional Alibaba Cloud Linux 4 sidecar image now provides a reproducible alternative to the existing Debian image, with bilingual guidance for building and operating both variants (#2777, #2787).

Fixed

• Startup reconciliation now retries transient notify-daemon endpoint failures with bounded backoff, allowing hidden skills to converge automatically when the daemon starts late or restarts (#2790).
• Flat normal-mode mounts now resolve categorized skills through their stored physical directories, so writes, truncation, renames, and synchronization no longer fail with ENOENT (#2901).

[0.4.1] - 2026-08-21

Added

• A Kubernetes sidecar deployment now lets a privileged SkillFS container expose its FUSE view to a non-privileged workload, including readable paths advertised by skill-discover (#2057).
• Optional mutual HMAC-SHA256 authentication now protects control and notify sockets across container namespaces through --trusted-peer-key-file and --notify-auth-key-file, while existing host authentication remains unchanged (#2449).

Changed

• The reference Kubernetes deployment now marks the Pod unready after one failed FUSE read and restarts only the SkillFS sidecar after two liveness failures, allowing workloads to recover without restarting (#2705).

Fixed

• Nested Hermes skills can now update activation state through the control socket with layout-relative identifiers such as category/skill (#2407).
• Activation metadata permissions, in-place backing aliases, and control listener startup now fail closed instead of exposing metadata, accepting an unsafe source, or leaving an unusable endpoint (#2407).
• The bundled skillfs-mount skill now names the shipped analysis scripts and accurately describes managed mounts and writable source behavior (#1798).

[0.4.0] - 2026-07-24

Added

• Configurable read-time transforms now keep directive compilation enabled by default and add an opt-in OS adapter with bundled Ubuntu/Alinux rules and external catalog overrides (#1484).
• An authenticated live-source resolver and notify v2 protocol now give Skill Ledger canonical flat or Hermes skill identities, event kinds, and changed paths without exposing backing-root details (#1517).

Changed

• Agent-visible access checks now follow activated snapshot permissions while live-source permissions continue to govern writes (#1517).

Fixed

• SLS telemetry writers now honor /etc/anolisa/.telemetry_disabled dynamically and fail closed when the gate cannot be inspected (#1584).
• Hermes symlink boundaries, resolver paths, socket ownership, and peer authentication now fail closed across discovery, reads, and mutations (#1517).
• Control-socket prerequisite diagnostics now consistently include the public --control-socket flag name (#1739).

[0.3.4] - 2026-07-16

Fixed

• SLS ops logging now preserves exactly one command record when CLI output pipes close early and panic unwinds.

[0.3.3] - 2026-07-10

Added

• Hermes workspace layout compatibility. SkillFS now recognizes Hermes hub markers, preserves management paths, and exposes nested category/skill/SKILL.md skills alongside top-level skills.
• Nested Hermes skills now support activation state, installer lifecycle writes, notifications, audit attribution, fallback snapshots, and hidden visibility.

Fixed

• skillfs validate --json now includes source paths for warning and error entries so automation can locate invalid skills.
• FUSE teardown now bounds failed unmount cleanup and prevents leaked test mounts from affecting later sessions.

[0.3.2] - 2026-07-03

Fixed

• CLI SLS ops logging now records SkillFS mount and runtime operations.
• Runtime metrics now emit real-time deltas for SLS consumers.

[0.3.1] - 2026-07-03

Added

• Managed mount supervision can recover stale FUSE mounts and bound recovery retries during repeated starts.

Changed

• English and Chinese README guidance now covers managed mounts, in-place operation, security boundaries, and troubleshooting.

Fixed

• Post-publish grace reads fallback skill files from source paths after installers finish.
• skillfs validate now reports parse failures in the status summary.
• In-place authoring supports new skills and pending-install ownership changes.
• Managed stop and runtime-dir handling avoid stale ownership and unbounded recovery retries.
• Daemon-facing backing roots under PrivateTmp are rejected before mount startup.
• FUSE smoke cleanup handles leftover mounts and temporary paths more reliably.

[0.3.0] - 2026-06-26

Added

• Runtime security integration for agent skill directories. SkillFS can now consume activation decisions from .skill-meta/activation.json or the user.agent_sec.skill_ledger.activation xattr, then expose each skill as current, hidden, or a trusted fallback snapshot.
• File-change notification for external security daemons. With --activation-mode file, --notify-socket, --activation-events-log, and --activation-reload-mode poll, SkillFS reports skill mutations, reloads activation decisions, and keeps already-opened file handles pinned to their original target.
• Trusted control socket for activation writes. A daemon verified with SO_PEERCRED, executable identity, and start-time checks can update activation JSON or activation xattr through a bounded request API instead of writing .skill-meta through the agent-visible mount path.
• Installer compatibility for common skill installation flows. Staging directories, direct writes, quiet-timeout completion, and post-publish grace windows allow installers to finish writing a skill before SkillFS asks the security provider to scan and activate it.
• In-place mount support for security daemons. Ledger backing roots are bind mounted privately and validated at startup so scanners read the real source tree rather than the agent-facing FUSE view.
• Canonical skill identity based on the directory basename. Frontmatter name: remains display metadata and no longer changes the SkillFS store key or daemon-facing skill id.

Changed

• .skill-meta/** is hidden from ordinary agents and remains accessible only through trusted metadata paths or the control socket.
• Skill mutation notify uses ordinary filesystem event kinds, including create, write, rename, unlink, rmdir, and truncate events, instead of a separate install-complete protocol event.
• POSIX passthrough behavior was expanded for symlink, hardlink, FIFO, path length fallback, open-after-unlink, xattr, and inode consistency cases.

Fixed

• Prevented stale activation views by combining notify-triggered reload, polling, and activation watcher convergence.
• Hardened trusted-writer and trusted-peer checks against process reuse and executable replacement with start-time and file-identity validation.
• Avoided installer and daemon visibility bugs around hidden skills, fallback snapshots, staging paths, and backing-root propagation.

[0.2.0] - 2026-05-09

Added

• FUSE write passthrough for write, create, mkdir, rename, unlink, rmdir, and setattr(size) operations on skill directories.
• Background sync worker that reparses SKILL.md on write and upserts the entry back into SharedSkillStore.
• Immediate visibility for newly created skill directories: mkdir inserts a ParseStatus::Degraded placeholder, then the sync worker overwrites it with the real entry once SKILL.md is written.
• in-place mount mode that accesses the underlying source via /proc/self/fd/{n} to avoid the over-mount self-loop.
• Integration suite crates/skillfs-fuse/tests/write_guard_tests.rs covering both normal and in-place write paths.

Changed

• Directory name is now the authoritative store key. After rename, stale frontmatter name: no longer revives the old key.
• Read of SKILL.md still returns the compiled result; raw file is only used for writes and parsing.
• Architecture docs refactored into docs/specs/skillfs-spec.md, docs/specs/core-spec.md, docs/specs/fuse-spec.md.

Removed

• Workspace-related code paths and the unused workspace config support from skillfs-core (commit 6d604c7).
• Legacy ad-hoc test scripts (kept only scripts/build.sh and scripts/test.sh).

Fixed

• CLI tracing timestamps now use the local timezone instead of UTC.

[0.1.2] - 2026-04-29

Added

• Read-only mount write protection: mknod, symlink, link, and write callbacks all return EROFS.

Fixed

• Parser summary truncation now respects multi-byte character boundaries.

[0.1.1] - 2026-04-29

Added

• skillfs-mount agent skill under docs/skills/ to help users set up, mount, and unmount a SkillFS instance.

[0.1.0] - 2026-04-25

Added

• Initial release of the SkillFS workspace.
• skillfs-core: SKILL.md parser (with Ok / Degraded / Error status), in-memory SkillStore with flat and categorized directory layouts, skillfs-views.toml configuration, conditional compiler::compile, and environment probing (OS, commands, env vars).
• skillfs-fuse: read-only FUSE filesystem that exposes the configured default view at /skills, always-on virtual skill-discover, and compile-on-read for SKILL.md. Other files in a skill directory are passed through to the physical source.
• skillfs CLI: mount, classify, validate, list subcommands.

Changelog

All notable changes to Tokenless will be documented in this file.

Releases from 0.7.2 onward follow Keep a Changelog.

[Unreleased]

[0.9.4] - 2026-11-06

Changed

• Breaking for source installations: make install, framework registration, and removal now default to AWPRJ=anolisa, placing adapters and extensions in the shared ANOLISA namespace. To keep or remove an existing independent installation, pass AWPRJ= explicitly with the same profile and path overrides used for installation. Installation rejects resources owned by another installation; removal preserves them and warns. RPM/raw layouts and runtime configuration paths are unchanged (#9462).

Fixed

• JSON depth limits now preserve numeric, Boolean, and null leaves with their original types instead of replacing them with string markers. These leaves no longer create Stash entries or count as truncations; objects, arrays, and strings keep their existing depth-limit behavior (#7743).
• Recognized native grep and rg calls, including supported wrappers and compound commands containing them, now bypass RTK rewriting and use only lossless search compression in PostTool. Every received match is retained; disabled search compression, unsupported formats, and no savings preserve the original output even with force_json. Mixed command output also stays unchanged when search boundaries cannot be identified, which can increase result size (#9615).
• Qoder native Bash compression now replaces only string stdout, including short or empty values, preserving stderr, exit status, and every other result field (#9615).
• QwenWork on macOS can retrieve stashed output through its private plugin executable even when the model shell has no global tokenless command. Standalone tokenless retrieve <HASH> calls use the Hook's data directory and session identifiers, and recovered output bypasses further compression. Recovery requires the private executable, valid state directory, and registered rewrite Hook; Windows and other hosts retain their existing behavior (#9622).
• AgentScope 1.x and 2.x retain complete tool results when optional PostTool compression fails, including protocol errors and incompatible SDK wheel signatures. The adapter logs the failure without exposing partial replacement text or recovery hints; cancellation still propagates (#8928).

[0.9.3] - 2026-11-05

Added

• tokenless rtk runs RTK v0.49.0 with the Tokenless patches from inside the tokenless executable; tokenless rtk --version reports the bundled version (#9324).

Changed

• Breaking: The npm, RPM (tokenless-core), ANOLISA raw, Windows ZIP, and Python wheel packages ship only tokenless and no longer install a separate rtk. PreTool rewrites commands to tokenless rtk <command>, naming the running tokenless by absolute path, so a rewrite and its execution use the same RTK build; it no longer looks for rtk on PATH. Scripts that call rtk directly must call tokenless rtk instead. Upgrades remove the rtk helper and link that earlier Tokenless releases installed and keep an RTK installed separately (#9324).
• Breaking for Rust callers: TokenlessRuntime::pre_tool has been removed. Short-lived processes keep dispatch_with_store; long-running hosts run tokenless compress instead, because RTK expects one process per command (#9324).
• The Python SDK's pre_tool() runs the bundled tokenless compress instead of rtk rewrite. A timeout or child failure now logs one warning and returns the original arguments as passthrough instead of raising TokenlessError, so the tool call still runs (#9324).
• A PreTool rewrite still has 5 seconds. On timeout, the processes RTK started, such as a stalled git, now end with it (#9324).
• Every framework integration runs RTK through the single tokenless executable. Claude Code, Qwen Code, Qoder CLI, QwenWork, OpenCode, Cosh-NG, OpenClaw, and Hermes already rewrote through tokenless compress and now receive tokenless rtk commands. The Codex PreToolUse hook, which ran rtk rewrite directly, now rewrites through tokenless compress as well, and QwenPaw and AgentScope do so through the Python SDK. Claude Code and Qwen Code detection and QwenWork installation no longer require rtk. Hermes treats tokenless rtk wrappers as RTK-owned output and no longer recognizes bare rtk wrappers. DeepSeek Harness only compresses tool results and is unaffected (#9324).
• Building from source, including the curl installer's source-build path, needs Rust 1.91 or later plus git and patch to fetch and patch the pinned RTK source. An existing third_party/rtk checkout made from other patches is rejected; run just clean-rtk once to recreate it (#9279, #9281, #9324).
• ANOLISA raw packages require ANOLISA 0.3.21 or later, which provides the Tokenless discovery registry (#9351).

Fixed

• HTML rendering handles long backtick runs in code blocks without rescanning them for each possible fence length, which could exhaust the PostTool time budget. Rendered content and recovery are unchanged (#9396).
• PreTool and PostTool recognize QwenWork's qualified workspace Shell name mcp__qw-builtin__mcp__workspace__bash, so its plain-text results reach the existing compression path, including TOON for JSON bodies (#9459).

[0.9.2] - 2026-11-05

Changed

• Choose the CLI and framework integrations separately using the core and plugins RPMs.
• Use the selected installation paths for adapter registration and removal.

[0.9.1] - 2026-10-29

Fixed

• Qoder retains the native Bash result envelope when compressing stdout, preserving exit status and telemetry fields without serializing them into the model's text. Other result shapes keep their existing replacement behavior (#9226).
• Recognized head and tail commands, including supported wrappers and compound commands containing them, now execute natively so the requested line window is preserved. Explicit RTK calls and custom RTK wrapper prefixes retain their existing behavior (#9226).
• QwenWork workspace hooks now use the system user's ~/.tokenless directory by default and honor an absolute TOKENLESS_DATA_DIR, keeping state in one location across working-directory changes. Existing workspace history is not migrated automatically. Install and detect commands report the resolved directory and explain that Shell sandbox permissions can prevent RTK statistics and execution receipts from being saved (#9215).
• Verbose unittest and Django test logs now compress repeated successful test records while preserving summaries, nonpassing outcomes, tracebacks, and database setup output. The original remains retrievable; multiline descriptions and unknown output are retained (#9083).
• HTML tables with rowspan="0" now keep cells under the correct column headers through the end of each row group. Original-page retrieval remains byte-exact (#9012).
• Windows builds now stage the current Tokenless and RTK executables from Cargo's resolved target directories, avoiding missing or stale artifacts when environment or configuration settings redirect build output (#9018).

[0.9.0] - 2026-10-25

Added

• Windows x64 support includes a native CLI, bundled RTK, npm launchers, a Python ABI3 wheel, and the QwenWork adapter for local sessions. Release builds produce Windows ZIP and wheel assets; npm installation awaits separate registry publication. Windows ARM and QwenWork VM sessions remain unsupported (#8853, #9011, #9015).
• Intel Mac (macOS x86_64) is now a release build target for raw archives, npm binaries, and Python wheels. npm installation awaits separate registry publication (#8770).

Changed

• Breaking for Rust callers: Remove drop_nulls and drop_empty_fields from JsonCompressionConfig initializers and preserve_top_level_shape from JsonCompressionContext initializers. Complete JSON candidates now retain every field and empty value, including array positions; some inputs save fewer tokens or pass through. Explicit truncation and record reduction retain their recovery policies, and CLI arguments are unchanged (#8814).
• TOON encoding uses spec v4.4 to compact nested record arrays and objects keyed by ID. Upgrade decoders from toon-format 0.5.0 to 0.7.0 before consuming the new nested and keyed headers. Previously saved malformed empty-object-array documents still require their original JSON; the codec update does not repair them (#7752).

Fixed

• JSON compression and Stash recovery retain source numeric literals without precision loss. TOON candidates must preserve the retained values and numeric types; otherwise compression keeps exact JSON, and direct compress-toon returns the original input byte for byte (#7784, #7752).
• PostTool compression can resume when all tracked RTK invocations report byte-identical output and the executed command matches. Changed output or missing, stale, or mismatched evidence retains the RTK bypass; adapters without recovery remain limited to lossless candidates (#8901).
• compress-response and compress-schema now emit payloads byte for byte without appending a newline. Active-mode statistics match those emitted bytes; dry-run still emits the original input while recording predicted savings (#7789).
• Advisory messages no longer turn successful compression, passthrough, or statistics operations into panics when stderr is unwritable (#7796, #7752).
• Codex adapter install and uninstall commands now preview the actual lifecycle branches under ANOLISA_DRY_RUN=1 without modifying files or registrations. Missing binaries and source trees fail before previewing steps the real installation cannot reach (#7723).

[0.8.8] - 2026-10-21

Added

• An opt-in, Bearer-authenticated statistics service now exposes read-only records with session and tool filters, pagination, and optional content for integrations such as AgentSight. Remote listeners need a private network or TLS proxy (#7303).
• Native find path lists can share repeated directory prefixes in a reversible view while preserving every path and line ending. Ambiguous or unprofitable output passes through unchanged (#7953).
• QwenWorkCN 1.3.2 workspace Shell calls can use Tokenless after the macOS plugin is loaded in a new conversation. Native Bash remains supported; Linux VM execution is unsupported (#8725).

Changed

• CSV and TSV compression now preserves every row and cell instead of sampling rows, and no longer writes Stash entries for tables. Some outputs save fewer tokens; previously stored reduced views remain retrievable (#8584).

Fixed

• CLI commands no longer panic when stdout or stderr cannot be written. A closed output pipe exits successfully after completed work, other output failures report failure, and an undelivered statistics-clear prompt cannot confirm deletion (#7777, #7773).
• Qoder, Claude Code, and QwenWork installers and uninstallers now preview their actions under ANOLISA_DRY_RUN=1 without changing registrations or files. OpenCode's preview also names conditional plugin-directory creation (#7715, #7731, #7747, #7750).
• Qoder unwraps shorter shell results before compression. QwenPaw preserves the entire response if any PostTool block fails and honors an absolute TOKENLESS_DATA_DIR (#8290).
• QwenPaw rejects a runtime wheel whose SDK constructors lack required keyword arguments before the plugin reaches a tool call (#7744).
• Hosts that replace tool responses directly now pass all raw response fields to Core instead of losing fields during Cosh wrapper extraction (#7633).
• The Codex adapter now recognizes its qualified plugin identity and passes through PreToolUse events whose decoded tool_input is not an object (#7565, #6984).
• Pipeline workers now return an error for invalid request variants and continue serving later requests (#7569).
• Git diff and HTML compression retain the original tool result and report Stash write failures consistently instead of failing the whole PostTool call as a pipeline error (#6619).
• stats show distinguishes empty or unstored after-content from a result that was not compressed (#7809).
• QwenPaw prerelease wheel URLs now use installable PEP 440 filenames while keeping the release tag's original spelling (#7662).

[0.8.7] - 2026-10-15

Fixed

• JSON responses containing numbers that cannot retain their exact value during parsing now pass through unchanged. TOON conversion is used only when decoding preserves the same values and types, preventing silent numeric precision loss (#7069).
• OpenCode schema compression now preserves executable parameter validators and modifies only the model-facing JSON schema. Older hosts exposing only a runtime codec skip schema compression (#7048).
• Qwen Code and OpenCode uninstall scripts now honor ANOLISA_DRY_RUN=1, previewing removals without deleting plugin registrations or changing enablement settings (#7348).
• Compression and retrieval now warn when the statistics database cannot be opened while continuing to return their normal output. Missed statistics are not retried or replayed (#7395).
• Selective-Claw now aligns archived summaries with the current conversation window's recall IDs. Partial or rewritten turns no longer overwrite unrelated archived summaries (#7042).
• Release validation now accepts normalized Python prerelease wheel filenames while checking the original release-tag spelling separately, and rejects filenames that pip cannot install (#5271).

[0.8.6] - 2026-10-14

Added

• Add a QwenWorkCN local-mode adapter with command rewriting, response compression, and explicit desktop plugin sideloading. The adapter ships in raw, npm, and RPM packages; security-workspace/VM sessions are not supported (#7257).

Changed

• Breaking: The OpenClaw adapter now requires OpenClaw 2026.6.6 or newer and applies lossless compression to supported live tool results before the same-turn model request. Results are no longer compressed a second time during persistence. Legacy hosts such as 2026.8.2 may truncate text before middleware runs; Tokenless cannot restore that missing content, and builds containing upstream fix 2f620b970a04 are recommended (#7124).

Fixed

• Quiet, print-only sed commands using long options, combined flags, or multiple expressions now preserve HTML source correctly. Commands that modify content or read scripts from files no longer qualify as plain file reads (#4963).
• HTML inline code containing consecutive backticks now receives a long enough Markdown delimiter to preserve the code span (#6393).
• On macOS, RTK command rewriting no longer rejects an otherwise successful result when cleanup encounters a process group containing only its exited leader (#7257).
• Shared and Codex stdin hooks now ignore JSON payloads that are not objects, and Codex response diagnostics ignore invalid payload shapes, avoiding tracebacks on unsupported input (#6691, #6663).
• AgentScope 2.x and QwenPaw now pass malformed tool arguments through to the host instead of aborting the whole Agent reply; response processing remains lossless for those calls (#5288, #5299).
• Stats and Stash library warnings no longer interrupt successful compression, statistics reads, or retrieval when stderr is unwritable (#6911).
• Selective-Claw returns each requested turn only once and preserves first-request order, avoiding duplicated recall output and token usage (#4859).
• Selective-Claw history reconciliation now distinguishes tool results by call ID, tool identity, and error state, retaining distinct results even when their text is identical (#7040).

[0.8.5] - 2026-10-11

Added

• Expired SQLite Stash payloads are now reclaimed during successful writes, so compression-only workloads no longer require retrieval to clean up old payloads. This does not immediately shrink the database file or securely erase deleted data (#3565).

Changed

• Complete HTML page rendering is now enabled by default in the CLI, Runtime, and Python SDK. Disable it with TOKENLESS_HTML_EXTRACTION_ENABLED=0 or SDK html_extraction_enabled=False; an empty environment value keeps the default. Git diff cropping remains opt-in (#3473).

Fixed

• Plain shell file reads such as cat page.html now keep HTML source verbatim across adapters that supply the command, including OpenClaw, DSH, QwenPaw, and AgentScope. JSON, tables, and other supported file data can still compress (#3481).
• A single leading byte-order mark no longer prevents HTML, JSON, tables, or stack traces from reaching their matching content handlers; recoverable transformations retain the original bytes (#3486, #4888).
• Bracketed tool output that is not one valid JSON document, including concatenated documents and NDJSON, now passes through unchanged instead of failing the PostTool call (#4159).
• Build/test commands wrapped in env -i or env -u, or using a Cargo +toolchain, retain their native output for build-log compression instead of being handed to RTK (#4270).
• RTK rewriting now enforces its deadline even when descendants keep stdout open after the parent exits, and cleans up the owned process group (#3552).
• Concurrent hooks can initialize or migrate the stats database without racing to add the same columns; failed migrations roll back together (#3607).
• Stats history and session-diff reports now order records by their actual timestamp, including mixed UTC offsets and sub-millisecond differences, so newest-record limits and compression chains remain correct (#3848).
• Failed stats and retrieval-event writes now emit a [tokenless-stats] warning while compression and retrieval continue, including when stderr itself is unwritable (#3587).
• Clean AgentScope 1.x installations now include the greenlet dependency required by newer SQLAlchemy versions. Positional application postprocessors are also chained correctly before Tokenless processing (#3496, #3706).
• Hermes preserves the full error envelope for failed or stopped shell calls, retaining diagnostics that may exist outside the output field (#3815).
• OpenCode forwards nonzero Bash exit codes for diagnosis, cleans up timed-out hooks and their descendants, and enforces the 1 MiB hook-output limit in UTF-8 bytes. Oversized hook responses leave the original tool output intact (#4398, #3818, #4757).
• OpenCode host edits to a returned tool schema no longer affect the cached schema used by later calls (#4731).
• Qwen Code adapter installation with --dry-run no longer invokes the host CLI, stamps manifests, or changes the active extension link (#4397).
• npm rebuild can now replace dangling tokenless and rtk launcher symlinks and complete repeated runs (#4711).
• OpenClaw binary discovery now skips same-named directories in PATH, allowing a later executable or executable symlink to be found (#4855).
• Selective-Claw turn recall now combines live and archived turns in request order and stays bound to the host session, preventing interleaved conversations from redirecting expand_turn (#4670, #4782).
• Selective-Claw keeps leading system or implicit turns distinct from later user turns and migrates older archives to matching ordinal turn IDs (#4673, #4693).
• Selective-Claw makes existing archive messages searchable when first creating its full-text index (#4689).
• Repeated Selective-Claw lifecycle calls no longer duplicate replacement conversation history, including after an engine restart (#4700).
• Selective-Claw restores structured host messages from the archive, preserving tool identities, content blocks, role aliases, and metadata when assembling stored context (#4699).
• Selective-Claw persists summaries for turns without a user message and includes summaries and fallback previews in context token estimates (#4698, #4662).
• Selective-Claw now honors OpenClaw pluginConfig options and expands ~/ archive paths, including the disabled registration setting (#4822).

[0.8.4] - 2026-09-22

Added

• Add a standalone installer and an install-tokenless OS Skill entry point alongside npm installation. The installer chooses npm or a Linux-only source build before installation starts, records owned paths for uninstall, and restores the previous installation if replacement fails. Source builds install only the CLI; npm also provides RTK and adapters (#2322).

Changed

• npm installation now requires Node.js 16.7 or newer and preserves shared adapter resources owned by another installation. Users can explicitly replace them with ANOLISA_TOKENLESS_FORCE_ADAPTERS=1; otherwise, the installer reports the bundled adapter location (#2322).
• Standalone uninstall removes only resources still owned by its install receipt, preserves runtime data unless --purge is requested, and retains adapter resources when framework deregistration cannot be verified. Codex plugins listed as not installed are recognized as successfully removed, so repeated uninstall can complete (#2322, #3412).

Fixed

• HTML extraction now keeps command output after the page's </html> end tag, such as build logs and HTTP status codes, after the rendered page instead of losing it. Text that imitates the page wrapper is escaped, and original recovery remains available (#3386).
• HTML extraction no longer rejects shallow pages containing many self-closing SVG elements as excessively nested. Depth limits now follow the parsed page, and malformed markup or wide tables no longer trigger repeated scans that can delay tool results (#3396).

[0.8.3] - 2026-09-20

Added

• Git diff context cropping can now retain all changed lines and file metadata while reducing surrounding context, with the received original available through recovery. Enable it with TOKENLESS_DIFF_COMPRESSION_ENABLED=1 or SDK diff_compression_enabled=True; it is disabled by default and requires text replacement and recovery support (#3299).
• Complete HTML pages from command or API results can now be rendered as Markdown with original recovery and counts of removed page elements. Enable it with TOKENLESS_HTML_EXTRACTION_ENABLED=1 or SDK html_extraction_enabled=True; it is disabled by default, requires text replacement and recovery support, and preserves file reads, including HTML printed by shell file-reading commands (#3306).

Changed

• npm installation now automatically enables the Claude Code adapter when the Claude CLI is available, and prints retry instructions when registration cannot finish (#2193).
• QwenPaw installation now checks the matching SDK wheel before handing over the plugin bundle and reports a confirmed missing asset with its version and URL. Offline or mirrored installations can skip the probe with ANOLISA_SKIP_WHEEL_PREFLIGHT=1 (#3289).

Fixed

• Claude Code detection now retries a staged plugin within a bounded settling window with backoff, reducing false “not installed” results while the host registry catches up (#3272).
• Raw packages now declare and include the OpenCode adapter and adapter manifest, enabling ANOLISA to discover and manage the bundled plugin. Restart OpenCode after enabling or disabling it (#3324, #3346).

[0.8.2] - 2026-09-15

Added

• Supported search listings, including Claude Code native Grep results without context lines, now share consecutive file paths while retaining every received match, line number, and line ending. This lossless optimization is enabled by default and requires a text replacement slot; disable it with TOKENLESS_SEARCH_PATH_SHARING_ENABLED=0 or SDK search_path_sharing_enabled=False (#3173).

Changed

• Bundled RTK is upgraded to 0.49.0, with conservative pipeline rewriting and unchanged sudo commands. Direct rtk grep users must use --max-len and --max for RTK display limits: -l and -m now retain native grep meanings, and file-type filtering moves to rtk rg -t (#3273).
• Supported RTK filters now provide rtk recall HASH hints for retained failure or truncated output. Recovery storage is scoped to the host OS user, with limits and expiry; sessions sharing that user can access the same store. RTK recall and Tokenless Stash retrieval remain separate (#3273).

Fixed

• Cosh-NG and copilot-shell now correctly attribute failures carried inside JSON-encoded shell results under Protocol v2, preserving the original failed output and sending error details for diagnosis (#2238).
• Bundled RTK preserves pytest startup and fallback diagnostics, including when recovery storage is disabled, and keeps the no-tests summary alongside stderr (#3273).

[0.8.1] - 2026-09-09

Added

• CSV/TSV tool output can now preserve all cells through quoting and line-ending compaction, or reduce larger tables to boundary rows, diagnostic rows, and a representative sample when recovery is available. Reduced views identify omitted rows and provide byte-exact original retrieval; complete enumeration or calculations require the original table. File reads and hosts without a text replacement slot pass through unchanged (#3089).
• SLS records can now carry tokenless.trace_id and tokenless.span_id from TOKENLESS_TRACEPARENT or TRACEPARENT, so observability backends can correlate token savings with a host trace. The launching host or adapter must inject the context; without a usable value, records remain uncorrelated, and local stats.db data is unchanged (#3094).

Fixed

• Claude Code detection now briefly re-lists a staged plugin missing from the first successful registry scan, avoiding false “not installed” results immediately after installation (#3085).
• Hermes now skips trusted shared hook modules whose APIs or call signatures are incompatible with the adapter, tries later compatible candidates, and reports rejected candidates when none work. This prevents stale installations or cached modules from breaking lifecycle hooks (#2249).
• OpenClaw installation now accepts declared capabilities when the host supports that option and sends the unsafe-install flag only when the host advertises it as effective. Hosts marking it as a no-op receive no bypass flag, and rejected installs point operators to security.installPolicy (#3126, #3152).

[0.8.0] - 2026-09-06

Added

• Large JSON record arrays can now retain representative records, errors, unusual shapes, and numeric outliers under a 32-record base budget, with the complete collection available through Stash. Compact JSON and TOON candidates that save at least 15% take priority over record reduction (#3047).
• Recognized Cargo, pytest, npm/Jest, Go, Make/C, and generic build/test logs can now drop repeated routine progress while preserving diagnostics, summaries, phases, and stack traces. Supported build/test commands keep their native output for this compression, and omitted intervals remain retrievable when recovery is available (#3067).
• Cosh-NG, Claude Code, Qoder CLI, OpenCode, Hermes, and DeepSeek Harness can now recover omitted content through their existing shell tools. Successful standalone tokenless retrieve HASH results bypass further compression; recovery requires a reachable CLI and a host that can replace the current tool result, including Claude Code 2.1.121 or newer (#3052).
• A QwenPaw plugin now provides in-process schema compression, RTK command rewriting, response/TOON compression, and a static tokenless_retrieve tool. Installation selects the matching SDK wheel, and tools outside the supported built-in table pass through unchanged (#3075).

Changed

• Breaking: tokenless compress now accepts only Protocol v2 before_model, pre_tool, post_tool, and retrieve requests; Protocol v1 and tokenless mcp serve have been removed. Core, adapters, and custom callers must upgrade together, including the required explicit recovery capability (#2978, #3068).
• Breaking: Rust callers now use the Runtime lifecycle methods in place of TokenlessRuntime::compress. Direct response-compression callers must migrate from the removed tokenless-pipeline crate and tokenless_schema::ResponseCompressor to the Runtime or tokenless-compressors APIs (#2974, #2978).
• Breaking: The Python SDK now uses typed lifecycle requests with before_model, pre_tool, post_tool, and retrieve; the old ModelRequest, ToolCall, ToolResult, and ToolResponseCompressor APIs have been removed. AgentScope integrations require ToolContract metadata for custom tools and expose one static retrieval tool (#2986, #3029).
• Recovery instructions now name the available shell command or configured static tool and use a bare hash, so agents can choose the correct recovery action. Historical <<tokenless:HASH>> markers remain readable; custom retrieve_tool_name settings must satisfy the tool-name rules (#3068).
• Lifecycle schema compression now requires an authorized static recovery tool and an available Stash. Common BeforeModel hooks without that capability preserve the original schemas (#2978, #2995, #3029).
• Lifecycle compression now preserves declared file contents and results already optimized by RTK. Common hooks carry per-call optimization state, and hooks without a stable tool-call ID leave command arguments unchanged (#2974, #2978, #2995).
• Breaking: OpenClaw now uses post_tool_enabled for PostTool optimization; its former response, TOON, skip-tool, and shell-tool policy settings have been removed. DeepSeek Harness also uses the shared compression policy instead of adapter-specific thresholds and tool lists. OpenClaw remains limited to lossless transcript updates without same-turn replacement or retrieval (#3009, #3036).
• Hermes now delegates PreTool rewriting and PostTool result handling to Core, using the shared response and TOON policy instead of adapter-local decisions; older Hermes releases retain block-and-suggest command rewriting (#3018).
• Compression statistics now expose content_origin, applied_operations, and recoverability in place of seam and compressor_chain; authorized retrieval events also carry agent, session, and tool-call attribution (#2978).

Fixed

• OpenClaw now reads plugin-local configuration, so explicit enable and disable settings take effect even when global configuration contains conflicting values (#3009).
• npm packages now include executable shared hook dispatchers as regular files, so installed plugins can invoke Tokenless even though npm pack omits source symlinks (#3068).

[0.7.14] - 2026-08-26

Added

• The protocol-v1 tokenless compress command and TokenlessRuntime::compress now provide one entry point for schema, response, and TOON compression, so adapters make at most one subprocess call, apply one final size decision, and record only the winning operation (#2844).
• tokenless stats summary now excludes dry-run rows from active totals while reporting their count, and adds gross savings, retrieved tokens, net savings, Retrieve hit/miss/error counts, and unrecoverable truncation attribution; JSON output uses schema version 1.1, and the Python TokenlessStats API exposes the same typed fields (#2885).

Changed

• Truncation markers now include a directly runnable tokenless retrieve command, retrievals through the CLI, MCP, and embedded Runtime contribute to attribution, and MCP retrieval accepts uppercase hashes like the CLI (#2885).

Fixed

• The Codex integration no longer appends a second compressed copy after Tool use; it keeps environment diagnostics and RTK source reduction without increasing the Model-visible Prompt (#2866).
• tokenless compress-toon and the Runtime/Python SDK now consistently leave valid payloads shorter than 500 characters unchanged, while --min-toon-chars 0 can force encoding; malformed JSON still fails, and CLI output preserves the input's exact trailing-newline form (#2869).

[0.7.13] - 2026-08-25

Added

• Rust callers can now use the tokenless-protocol and tokenless-pipeline crates for versioned compression requests and responses, bounded content detection, registry routing, staged execution, and fail-open arbitration (#2783, #2788, #2799).

Changed

• The CLI compress-response command, TokenlessRuntime::compress_response, and the Python binding now route record-shaped JSON through the shared pipeline; scalar JSON roots pass through unchanged, while timeouts and rejected candidates return the original content and roll back their Stash writes (#2816).
• Runtime and Python disposition values now use the protocol's snake_case forms such as dry_run and no_savings, and may report passthrough, timeout, or error; cleanup-only savings can now apply under require_reversible without a Stash when no truncation occurred (#2816).

[0.7.12] - 2026-08-22

Changed

• Response compression now keeps a configurable tail window after the retained array head (8 items by default, controlled by --array-tail-preserve and the Runtime API), so final statuses and error details remain inline while Stash stores only the omitted middle segment (#2433).
• The BeforeModel schema hook now warns once per session when a payload is malformed or carries no tool declarations, making a skipped hook distinguishable from a successful run that produced no savings; explicitly empty tool arrays still pass through silently (#2606).
• L2 benchmark JSON, Markdown, and semantic-gate findings now identify the missing ground-truth items behind retention failures instead of reporting counts alone (#2433).

Fixed

• tokenless stats enable and stats disable now persist only the Stats toggle from the on-disk configuration, so temporary compression and SLS environment overrides are not copied into config.json (#2592).
• tokenless stats summary --compare now fails when either Session has no records, and --limit 0 is rejected, preventing typos or empty samples from appearing as successful 0% comparisons (#2674).
• Schema compression now handles complete request objects with a top-level tools array, compressing Function Calling entries while preserving non-function tools and fields outside the array (#2758).
• Lossy array truncation markers now survive TOON round trips intact, and extremely large tail-preservation values keep the full array instead of overflowing (#2433).

[0.7.11] - 2026-08-20

Fixed

• tokenless compress-toon now scores TOON savings with the same CJK-aware character estimator as stats summary and the Python/SDK path, so dry-run stderr predicted counts match recorded before_tokens/after_tokens. JSON parse, oversized input, and TOON encode failures still exit 2 (#2681).

[0.7.10] - 2026-08-19

Added

• Gemini-native functionDeclarations tool schemas are now compressed in BeforeModel integrations such as copilot-shell, including declarations that use parametersJsonSchema, while preserving unrelated Gemini Tool fields (#2663).
• The anolisa-tokenless Python SDK now exposes typed, read-only status, summary, list, show, diff, and comparison queries through TokenlessStats, using the same Runtime data directory and returning stored tool content only for explicit show and diff calls (#2666).

Changed

• Raw, RPM, npm, and source installations no longer build or ship the unused standalone toon executable; TOON encoding remains available through tokenless compress-toon and tokenless decompress-toon, and upgrades remove only Tokenless-owned legacy artifacts (#2657).

Fixed

• The AgentScope integration wheel now declares tqdm, so clean installations using the supported AgentScope 1.x range continue to import with OpenAI 3.3.0 and later without a manual dependency workaround (#2665).

[0.7.9] - 2026-08-18

Added

• The anolisa-tokenless Python wheel now exposes framework-neutral before_model, before_tool_call, after_tool_call, and retrieve lifecycles, with bundled RTK plus native schema and response compression, TOON, marker-authorized retrieval, and per-call attribution (#2627).

Changed

• AgentScope 1.0.11 through 1.x and AgentScope 2.0.x integrations now attach the same complete SDK contract, adding schema compression, command rewriting, TOON, environment-error guidance, and per-call attribution to the existing response compression and retrieval support (#2627).

Fixed

• The Cosh-NG extension's RTK rewrite hook now matches the lowercase shell tool name directly, so shell commands are rewritten without depending on host-side tool-name aliases (#2611).

[0.7.8] - 2026-08-18

Changed

• TOON encoding is now skipped for payloads under 500 characters; below that threshold the token savings are near-zero while the per-event encode cost stays the same (#2613).

Fixed

• npm platform packages (@anolisa/tokenless-*) no longer declare tokenless/rtk/toon bin entries. The name collision with the root package made npm remove every conflicting .bin link during install, leaving installs without a usable tokenless executable (#2613).

[0.7.7] - 2026-08-17

Added

• A source-built anolisa-tokenless ABI3 wheel now provides stateful in-process JSON response compression and marker-based Stash retrieval for CPython 3.11+ without spawning the CLI (#2501).
• AgentScope 1.0.11 through 1.x and AgentScope 2.0.x applications can install a separate same-version integration wheel to compress successful final Tool Responses and expose retrieval only for markers visible to the current Agent (#2507, #2528, #2553).
• DeepSeek Harness profiles can enable a bundled native Plugin that compresses successful single-block JSON Tool Results while preserving environment-error attribution and fail-open behavior (#2581).

Changed

• Claude Code Adapter detection now retries transient first-run binary and Plugin-registry initialization failures, reducing false not-ready results immediately after provisioning (#2519).
• The Tokenless RPM now provides the virtual anolisa-component(tokenless) capability, allowing ANOLISA to resolve the Package when the repository component index is unavailable (#2576).

Fixed

• Cosh-NG extension execution now treats the hard-disabled Tool Ready Hook's empty result as a successful no-op instead of failing closed (#2506).
• No-savings response compression now removes only Stash rows created by the discarded candidate, avoiding orphaned rows without deleting entries refreshed by another process (#2480).

0.7.6 - 2026-08-13

Changed

• TOKENLESS_DATA_DIR now accepts absolute non-root directories outside the real user home, while invalid explicit directories disable SQLite state instead of silently falling back to home (#2434).
• Tool Ready pre-call checks, repairs, and blocking are now hard-disabled across adapters so incorrect readiness results cannot block valid work; post-tool failure attribution and other Tokenless features remain active (#2487).

Fixed

• Direct JSON Schema descriptions are now stashed once, so one retrieval returns the original content without a nested marker (#2399).
• Dry-run compression settings from config.json now remain effective when statistics and SLS toggles are set through environment variables (#2380).
• tokenless retrieve now writes stored payloads byte-for-byte without appending a trailing newline (#2396).
• Stash retrieval now scans past malformed markers to find a later valid key and stays linear on adversarial input (#2386).
• RPM installations now include the shared Codex lifecycle helper required by the adapter install script (#2425).

0.7.5 - 2026-08-10

Added

• OpenCode users can now enable Tokenless through a collision-safe local plugin that shares the existing readiness, rewrite, schema, and response-compression hooks (1233cfcf).

Changed

• The Qoder adapter now uses native plugin and hook conventions, replacing compressed tool output in place while preserving fail-open behavior (13817938).

Fixed

• Rewritten shell commands now use the resolved absolute rtk path, so they continue to work in agent environments with a restricted PATH (ae83f7d3).
• Qoder and OpenClaw hooks now preserve agent, session, and tool attribution across rewrite and proxy boundaries (#2158, 2f330656).
• Adapter installation now recognizes legacy /usr/local layouts, recommends RPM upgrade mode, and removes stale packaged user-manual files during upgrades (f7ce3878, ec25d516, 917f151e).

0.7.4 - 2026-07-31

Added

• Tokenless can now be installed from npm on Linux and macOS x64/arm64, including the tokenless, rtk, and toon binaries plus framework adapters (#1929).
• tokenless stats diff now explains estimated savings for records, sessions, and tool uses with text or JSON reports and bounded unified diffs (#1991).
• TOKENLESS_DATA_DIR now sets one trusted directory for both statistics and reversible-compression databases while preserving per-database overrides (#2038).

Fixed

• The Qwencode adapter now declares its delivered compress-toon capability, keeping adapter discovery consistent with its compression behavior (#1945).
• Hermes copy installations now resolve shared hook resources from trusted system, XDG, and user data paths with actionable diagnostics when no safe candidate exists (#2058).

0.7.3 - 2026-07-28

Added

• ANOLISA can now install Tokenless on macOS and enable Qwencode as an independent adapter (#1964).

Changed

• Adapter hooks now discover tokenless, rtk, and toon across user, /usr/local, RPM, and legacy installation layouts (#1957).
• Hook launchers now prefer resources from the active installation, preventing mixed versions when multiple Tokenless installations coexist (#1964).

Fixed

• Tool schema compression now reads the canonical Cosh and Cosh-NG request field, so schemas are compressed instead of silently passing through unchanged (#1894).
• Cosh-NG compression statistics are now attributed to cosh-ng when hook environment variables are present (#1894).
• Qoder plugin installation now expands cached hook paths, preventing invalid /rewrite_hook.py commands from blocking tool calls; the user manual includes recovery steps for affected upgrades (#1924).
• ANOLISA packages now include the shared hook resources required by Tokenless adapters (#1964).

0.7.2 - 2026-07-27

Added

• Tokenless now compresses Cosh-NG tool responses by replacing the original model-visible content (#1669).
• Tokenless now rewrites supported Cosh-NG shell commands for more compact output (#1669).

Changed

• Shell environment checks now report only recommended tools referenced by the current command (#1598).
• tokenless env-check --fix now installs required dependencies only, leaving optional recommendations untouched (#1598).
• Automatic dependency fixes now fail quickly with actionable authentication, network, or permission messages instead of prompting for sudo (#1598).
• Cosh-NG compression statistics are now recorded under the cosh-ng agent (#1669).
• Cosh-NG compression now excludes display-only content from model context (#1669).
• Cosh-NG runs with undetectable versions now keep original tool responses unchanged (#1669).
• Compression now leaves tool results unchanged when the compressed output is not smaller (#1674).
• Tokenless user manuals now live in the central ANOLISA guide instead of the RPM package (#1586).

Fixed

• Claude Code 2.1.121+ now replaces original tool results with compressed versions, preventing duplicate context (#1674, #1686).
• Older or undetectable Claude Code versions now pass tool results through unchanged instead of duplicating compressed context (#1674, #1686).
• Claude Code replacements now preserve built-in tool result formats, including empty fields (#1674, #1686).
• ANOLISA now recognizes the packaged Tokenless version correctly (#1587).

0.7.1

• fix RPM tarball to exclude generated .anolisa/component.toml, ensuring rpmbuild always regenerates the adapter contract from the authoritative .toml.in template — previously stale checked-in copies shipped outdated contracts missing claude-code, codex, and cosh adapter declarations (closes #1470)
• synchronize adapter contracts: declare every shipped driver (qoder, claude-code, codex, cosh, qwencode) in component.toml.in and add CI check (check-component-contract) to keep them in sync
• raise test coverage from 75% to 90%: ~170 new unit tests across all four crates covering compression edge cases, stash round-trip, schema migration, SLS writer, and CLI dispatch
• harden test isolation: replace unsafe env-var mutations with RAII TempDbGuard / EnvGuard to prevent tests from touching real ~/.tokenless state; enforce --test-threads=1 in Makefile (Rust 2024 set_var is unsafe)

0.7.0

• add MCP tokenless_retrieve stdio server (tokenless mcp serve) so MCP-connected agents can recover truncated payloads on demand — the MCP analogue of the tokenless retrieve CLI, closing the stash MCP gap vs Headroom CCR's headroom_retrieve
• complete reversible-compression (stash / CCR) coverage across the remaining lossy paths: ResponseCompressor string truncation, ResponseCompressor depth truncation, and SchemaCompressor description truncation are now stash-backed with <<tokenless:KEY>> markers; fit-check before stash prevents orphan entries; shared stash_suffix() helpers keep marker budget consistent
• add --no-stash / --stash-db flags to compress-schema (mirroring compress-response); dry-run (compression_on=false) skips the stash so markers never reach the LLM without a retrievable entry
• add lazy TTL purge to SqliteStore: expired rows are physically deleted before retrieve lookups so the stash db does not grow unbounded
• add actual-savings-rate display: StatsSummary::actual_savings_percent(session_total_tokens); format_summary() / format_summary_json() accept optional session total and emit an "Overall Savings vs Total Consumption" section plus new JSON fields (session_total_tokens, actual_savings_tokens, actual_savings_percent) — backward-compatible when absent
• add stash write/size counters to compression stats (record_compression_stats extended); retrieve-side hits/misses deferred pending a stats use case
• add qoder framework driver (qodercli install + settings.json merge/prune, AdapterOps::read_file, symlink-safe atomic write_file); gate qoder to adapter_type=plugin; fail closed on forged receipts and require all managed hooks
• raise test coverage from 59% to 75%: 100+ new unit tests plus 18 CLI integration tests across all four crates, test code moved to src/tests/ via include!() for cleaner separation
• add reversible-compression user manual (docs/stash-reversible-compression.md) plus README updates: architecture tree entry for tokenless-ccr, retrieve subsection documenting hash/marker input and --no-stash/--stash-db, scenario-mapping rewrite of the "Applicable Scenarios & Expected Effects" chapter
• rename tokenless docs *_CN.md to *_zh.md, add bidirectional bilingual links, create README.md + README_zh.md
• address adapter review findings: trust packaged datadir roots for Codex symlink targets, scope Claude Code marketplaces per component and fail closed, reject framework/adapter type mismatches before enable
• silence clippy warnings surfaced by rustc 1.94 stable in existing tests (field_reassign_with_default in tokenless-cli, bool_assert_comparison and default_constructed_unit_structs in tokenless-stats)

0.6.1

• bundle tool_categories.json into dist for npm installs
• use node: prefix, eliminate shell subprocess in openclaw plugin

0.6.0

• add absolute saved values + schema version to JSON output
• use import.meta.dirname instead of __dirname in openclaw plugin
• add qwencode adapter for Qwen Code extension
• fix rtk pytest 'No tests collected' regression
• add trusted FHS fallback paths for hook_utils import in codex scripts
• add SLS JSONL data collection with config toggle
• add tokenless RPM component contract (publishing metadata)
• add compression toggle with dry-run compare mode (TOKENLESS_COMPRESSION_ENABLED, stats summary --compare)
• enable SLS recording by default and document usage
• align compression mode serde/db form and dedup config load
• expand RPM component contract (bundle.entry + hermes)
• make SLS writer append-only and skip when log file absent
• prefer tool_call_id over internal tool_use_id for qwencode hooks
• bump vendored rtk to v0.43.0; rework pytest stderr-surfacing patch for the refactored runner; drop grep-fallback-fix (root cause fixed upstream) and preflight-skip-python (reversed upstream)
• sync toon-format to 0.5.0 in Makefile and spec (was stale at 0.4.6)

0.5.1

• add --json output to stats summary
• implement unified tool categorization and 3-layer compression strategy
• add rtk grep fallback pattern fix patch
• add rtk pytest error report patch

0.5.0

• add Hermes adapter runner
• drop TOON wrapper prefix and slim diagnostic tags
• unify rtk rewrite exit code 3 handling across adapters
• secure shell variable interpolation in env-fix and hooks
• add subprocess returncode checks and extract shared hook utilities
• secure resolveBinaryPath and improve binary cache invalidation
• use mktemp in tests and safe home expansion
• bound SchemaCompressor recursion to prevent stack overflow
• propagate env-fix subprocess failures instead of returning stdout
• anchor home lookup on getpwuid_r and trust-check candidate binaries
• harden env-fix install paths with uid trust check and divert stderr to log
• recover from poisoned mutex in stats recorder instead of failing
• add input size limit and validate db path
• reserve truncation marker length in response compressor
• rename openclaw plugin Name to Tokenless and ID to tokenless
• add qoder CLI adapter
• compress-schema on array input
• warn when compression is skipped
• stats command syntax
• add Claude Code adapter plugin
• error on TTY stdin instead of hang
• add codex adapter plugin
• fix compression pipeline output inflation, truncation and hook timeouts
• harden env-fix, version extraction, file trust, schema, permissions
• address review findings — trailing newline, chmod guard, rate-limited log, comment
• make env attribution reachable for skip-tools entries
• add selective-claw context engine plugin
• address review findings for selective-claw plugin
• remove invalid "2" dependency from selective-claw
• restore indentation in compress_response_hook.py
• harden hook exit-code handling + trust model consistency
• only warn on truly unexpected rtk exit codes
• dedup rewrite_hook, import from hook_utils

0.4.1

• fix version_ge 3-segment truncation in env_check.rs (compare all segments)
• add qoder, claude-code, codex adapter plugins and documentation
• sync manifest.json with template to include all six agents
• update README and user manuals for new agent integrations
• add pycache to root .gitignore
• update response-compression.md with all agent integration paths
• derive Makefile version from Cargo.toml, fix spec changelog weekday
• normalize adapter version numbers to 0.4.0
• derive adapter plugin versions from Cargo.toml instead of hardcoding

0.4.0

• correct 5 bugs in stats, naming, SQL, paths and permissions
• align FHS paths, restructure adapter dir, remove install.sh
• address code review findings across schema, env-check, hooks, and plugin
• add hermes agent plugin
• security hardening & critical algorithm correctness
• behavioral correctness & logic fixes
• dedup, dead code removal & cosmetic cleanup
• support staged installs
• support Debian/Ubuntu FHS paths and harden binary resolution
• build OpenClaw plugin to dist/index.js

0.3.2

• replace spoofable home-dir uid derivation with libc::getuid() syscall for trust chain integrity
• replace subprocess toon -e calls with in-process toon_format::encode_default() library call
• replace rtk/toon git submodules with crates.io deps and inline toon-format source
• hard-fail on rtk stats patch failure in justfile setup-rtk recipe
• unify compress-toon/compress-schema/compress-response error exit codes (all exit 2)
• remove 2>/dev/null || true from Makefile toon install (hard fail on missing binary)
• remove redundant #[source] attribute on thiserror variants that already have #[from]
• deduplicate Python hook FHS path constants into shared hook_utils module
• add libc to workspace dependencies for uid syscall
• add detailed rust >= 1.89 comment in spec.in explaining CI pin rationale

0.3.0

• add tool-ready 4-phase environment pre-check with cosh extension integration
• skip compression and stats when no token savings
• pass caller context to rtk stats via .rewrite-context file
• remove redundant cosh extension install/uninstall from install.sh
• convert cosh hooks to extension format per cosh dev guide
• skip zero compression and stats recording
• use isExecutable() and resolved paths in openclaw plugin
• resolve rtk/toon binary paths for RPM-installed plugins
• correct RPM install paths to align with install.sh expectations
• preserve tool result message structure in TOON encoding
• align install paths with FHS
• auto-record stats with real tool_use_id from hook payload
• restructure RPM dirs and remove auto plugin/hook installation

0.2.0

• add compression stats with auto-record from real data
• add TOON context compression support
• skip compression for skill and content-retrieval tools

0.1.0

• introduce tokenless into ANOLISA (#199)

Changelog

0.7.0

Added

• Added limit and cursor pagination to Hermes ws-ckpt-list (#8874)
• Added cached health advisory sampling; health-check-interval=0 disables periodic diagnostics but retains advisory sampling; warnings are omitted when samples are incomplete or stale (#8774)
• Added skill-only per-turn snapshots, cron schedules and retention management without host plugins; orchestration is model-driven, not a guaranteed lifecycle hook (#9465)

Changed

• BREAKING Changed make install to install prebuilt files without building or activation; added selective install-core, install-plugins and install-skills targets (#9222)
• BREAKING Defaulted make install to AWPRJ=anolisa; use AWPRJ= for the independent layout (#9462)
• Moved RPM executables from /usr/local/bin to /usr/bin (#9222)
• Removed ANOLISA discovery contracts from standalone packages; new raw packages require ANOLISA ≥ 0.3.21 (#9222, #9351)
• Improved cursor paging performance on long snapshot histories (#8881)

Fixed

• Shared one inotify instance across workspaces; exposed missing watcher coverage and queue overflows in ws-ckpt and cosh checkpoint status (#7592)
• Preserved service enablement and activity when rolling back to the legacy unsplit RPM (#9472)
• Rejected unsafe snapshot IDs at the legacy IPC boundary (#7593)
• Detached idle loop associations before remount, with bounded retries for transient device holders (#9385, #9471)
• Enforced a 5 GiB minimum for btrfs-loop img_size; invalid configuration now fails startup instead of falling back to defaults; repair legacy values with ws-ckpt config -g --img-size <GiB> (#9400)
• Fixed out-of-range auto_cleanup_keep ages stopping periodic cleanup; such retentions now keep all snapshots (#9399)
• Honored btrfs-base.btrfs_mount and reused persisted native storage roots across restarts; mount changes require restart without data migration (#8943)
• Correctly parsed stringified Hermes rollback preview, preventing unintended rollback (#9527)
• Scoped rollback auto-checkpoint suppression to the target workspace and session (#8866)
• Bounded Hermes plugin activation and deactivation commands; failures or timeouts no longer block local installation or cleanup (#8998)
• Persisted Hermes workspace and cron configuration before activation (#3618)
• Resolved symlinked workspace paths in OpenClaw cwd checks (#4768)
• Corrected the skill's rollback parent-chain guidance: -n 1 selects HEAD and -n 2 its parent; undoing a completed turn selects that turn snapshot's parent (#9465)
• Corrected ws-ckpt IPC enum indices, payload fields and client-mirror compatibility in the cosh-ng reference; wire encoding is unchanged (#9466)

[0.6.1] - Unreleased

Changed

• Install the runtime, host integrations and skill through separate RPMs.
• Place the skill and host plugins in the shared ANOLISA resource directories.

0.6.0

Added

• CI prebuilt packages for ws-ckpt (#7106)
• Pagination for snapshot listings (#3451)
• Reconciliation of interrupted cleanup operations (#3450)

Changed

• Updated the English ws-ckpt README with restored sections (#6157)
• Improved test coverage of the ops-log record writer (#3738)

Fixed

• Fixed startup rollback recovery: restore rollback head, finish interrupted rollbacks, and limit repeated daemon restarts (#8570)
• Fixed non-termination when the parent chain contains a cycle (#8467)
• Cleaned up stranded config temp files (#3764)
• Raised the openclaw CLI capture limit past 1 MiB (#4040)
• Fixed btrfs creates under storage pressure (#7888)
• Hardened cron locking: require the lock before writes and keep removal with its owner (#8273, #3755)
• Logged failed recovery index saves (#3605)
• Reused generated checkpoint identifiers (#4780)
• Translated confirm prompts to English (#3930)
• Isolated returned schedule arrays (#4674)
• Refused line breaks in cron-interpolated values (#6774)
• Parsed metadata before snapshotting (#6956)
• Refused cwd-inside workspace updates in both plugins and surfaced init failures (#6216, #6217)
• Hardened diff snapshot handling: isolate temp snapshots, preserve escaped paths, and reject malformed snapshot lists (#6198, #3558, #5695)
• Re-armed the write watcher after rollback (#5054)
• Preserved workspace metadata (#6930)
• Bounded cleanup counts to the u32 range (#3808)

0.5.0

Added

• Unified workspace path identity, conflicting alias registrations are rejected at init
• Workspaces whose init or unregister was interrupted are recovered on daemon restart
• Added guarded rollback V2 protocol and evidence wire variants used by cosh-ng governed tasks, cosh-ng requires ws-ckpt daemon 0.5.0 or newer

Changed

• OpenClaw tool allowlists are now managed through the OpenClaw config CLI, requiring OpenClaw 2026.2.13 or newer (#3221)
• /etc/ws-ckpt/config.toml is now RPM %config(noreplace): upgrades keep admin edits and land new defaults as .rpmnew; erase keeps a modified config as .rpmsave, restore it manually after reinstall (#3070)

Fixed

• Fixed empty workspaces being skipped instead of snapshotted
• Fixed checkpoint/rollback silently succeeding on a detached workspace directory, now failing fast with a recovery hint (#3059)
• Fixed recover --all exiting 0 when individual workspaces failed (#3069)
• Fixed rpm -e wiping the last remaining snapshot copies when recover failed (#3069)
• Fixed checkpoint failures under disk-space pressure by reclaiming deleted subvolumes (#3053)
• Fixed a race when two clients initialize the same workspace concurrently
• Fixed adapter discovery for raw installation layouts
• Fixed OpenClaw plugin install to probe the installed CLI before accepting capabilities (#3116)

0.4.5

Added

• Added bilingual (English/Chinese) sidecar deployment guide (#2965)

Fixed

• Fixed intermittent bootstrap failure when all loop devices are in use (#2965)
• Scoped sidecar preStop loop cleanup to ws-ckpt-owned devices only (#2965)

0.4.4

Added

• Added guarded checkpoint protocol with identity-fenced snapshot creation, checkpoint state stays verifiable across crashes

Fixed

• Fixed interrupted rollback state lost on daemon restart, ambiguous candidates are now preserved instead of deleted
• Fixed config --global to verify the daemon actually loaded the written config file (#2813)
• Fixed sidecar deployment guide missing the /etc/ws-ckpt shared volume required for global config (#2813)
• Fixed error hints to cover containerized deployments and the daemon's mount namespace (#2807, #2814)

0.4.3

Added

• Added k8s sidecar containerized deployment support (#2034)

Fixed

• Fixed daemon memory leak that caused unbounded growth under sustained checkpoint workloads, eventually leading to OOM (#2554)
• Fixed loop-device backend checkpoint performance under concurrent IO, reducing latency by up to 5x (#2523)
• Fixed bootstrap failure leaving orphan images and loop devices behind, and now reports clear startup errors instead of exiting silently (#1956)
• Fixed init failing with a cryptic EBUSY error when workspace path is already a mount point; now rejected with a clear message (#1798)
• Added RPM component identity declaration for anolisa-cli adapter discovery (#2568)

0.4.2

Added

• Added an telemetry gate to ops log writes (#1509)

Fixed

• Fixed auto-recover orphan .pre-init-bak from interrupted init (#1601)

0.4.1

Added

• Added skip auto-checkpoint after rollback (#1263)

Fixed

• Fixed workspace sync after config update (#1263)
• Fixed absolute path handling for ws-ckpt in crontab entries (#1263)
• Changed rollback -n offset, pass numAncestors as-is (#1263)

0.4.0

Changed

• BREAKING checkpoint -i/--id flag replaced by -s/--snapshot as primary; -i remains as hidden alias but may be removed in a future release (#1064)

Added

• Added plugin install/uninstall subcommand (#1005)
• Added component.toml for anolisa-cli adapter discovery (#1005)
• Added rollback preview support with --preview parameter (#1103)
• Added elapsed time display after each CLI operation (#1075)
• Added auto-generated snapshot ID when --snapshot is omitted (#1064)
• Added SLS ops log output for dashboard metrics (#1059)
• Added optional -t flag for diff to compare snapshot against current workspace (#848)
• Added rollback-by-ancestor-count and snapshot DAG tracking (#877)
• Added cron-based scheduled checkpoint snapshots (#819)

Fixed

• Fixed --snapshot/-s as primary flag and aligned plugin flag handling (#1103, #1064)
• Fixed SKILL.md to sync with actual CLI/plugin implementation (#847)
• Fixed init and recover to guard against replaced workspace symlink (#860)
• Fixed init rsync by dropping --copy-unsafe-links (#873)

0.3.3

Added

• Added per-workspace policy override with hermes/openclaw plugin support (#721)
• Added /proc cwd occupant guard for init and rollback (#684)
• Added Hermes adapter runner script (#617)

Fixed

• Fixed write lock contention and cwd guard deadlock in rollback (#721, #684)
• Fixed input validation for non-UTF-8 paths and path-traversal snapshot IDs (#695, #678)
• Fixed seccomp arch selection, workspace registry concurrency, and RPM packaging (#695, #684)

0.3.2

• Fixed openclaw uninstall to remove tool whitelist from config
• Fixed parent path refusal to apply as workspace-level rules for skill and openclaw plugin

0.3.1

• Fixed plugin workspace config registration and auto-loading
• Reject workspace paths that are hermes cwd itself or parent
• Fixed plugin tool to prefer explicit workspace parameter over config
• Fixed skill delete requiring --force flag
• Fixed daemon workspace path validation and fswatch fd leak
• Removed unused btrfs_ops.rs module

0.3.0

• Added openclaw plugin scaffolding for ws-ckpt
• Added hermes plugin scaffolding for ws-ckpt
• Made ws-ckpt skill agent-agnostic and prompted for workspace at invocation
• Followed make install contract for build-all integration
• Fixed bugs in list and diff sub-commands
• Made daemon stateful

0.2.0

• Added auto_cleanup feature and switch
• Unified config modification entry through the TOML file
• Added global CLI warning when any workspace>1000 snapshots or filesystem usage>90%
• Fixed backend detection and daemon state recovery logic
• Fixed image size configuration not taking effect after daemon restart
• Removed obsolete fs_warn_threshold_percent parameter
• Fixed config.toml to ship as a sample file

0.1.0

• Daemon with Unix Socket IPC and Bincode binary protocol.
• init / checkpoint / rollback / delete / list / diff / cleanup / status / config commands.
• Background scheduler: auto-cleanup, health check, orphan recovery.
• Multi-backend: btrfs-base / btrfs-loop / overlayfs with auto-detection.
• TOML config persistence with runtime hot-reload.
• systemd service with RPM packaging for Alinux 4.