All notable changes to this project are documented in this file.

The format is based on Keep a Changelog, and this project aims to follow Semantic Versioning once the first release is tagged. Until then, source builds report the version dev.

• aimlapi: AI/ML API provider with guided onboarding (top-up + key issuance) (#655) (6b9c2f0)
• cli: show ZERO wordmark on --version (#673) (9acb411)
• cli: wire MCP serve WorkspaceRoot and --add-dir scope (#694) (75a78e7)
• npm: ship the native binary as platform optionalDependencies (#626) (5e1405d)
• perf: emit prompt-prefix hash fingerprint per turn (#704) (1c5c6e7)
• providers: add AI/ML API preset (rebased onto main) (#621) (d66a9dd)
• providers: refresh MiniMax model coverage (#665) (fa3052a)
• skills: discover shared ~/.agents/skills with multi-root skill loading (#696) (7d57999)
• tui: Ctrl+X leader chords and emacs menu navigation (#699) (7f669f4)
• tui: press up to edit queued messages (#656) (4c986d3)

• acp: make truncateHint rune-safe (#614) (ddc4927)
• agent,tui: resolve git branch detection when starting Zero in subdirectories (#613) (0184581)
• agent: raise default and deep-mode turn budgets (#650) (635c93a)
• cli: prevent consuming positional arguments as flag values (#619) (5b4f48d)
• config: enforce MCP trust boundary so project config cannot override user disable (#609) (4d8c31c), closes #512
• config: surface unknown/typo'd config fields instead of silently dropping them (#645) (893b7b4)
• cron: prevent cron job Mutate from clobbering concurrent updates (#630) (e4bd703)
• daemon: handle os.ErrPermission as collision during O_EXCL lock creation (#616) (8ea5384)
• exec: stop false INCOMPLETE downgrades on conversational final messages (#608) (b6117af)
• harden MCP credential boundaries (#597) (fdddb05)
• hooks: fail closed on launch failures for beforeTool hooks (#629) (dc06fe7)
• hooks: run sessionEnd hooks after Esc/Ctrl+C interrupts (#606) (824ecdb)
• keyring: pass generic password via stdin on macOS (#574) (91ea6de)
• lock: prevent POSIX lock file overwrite and leak on Windows/Unix (#628) (da41c3a)
• openai: omit prompt_cache_key for openai-compatible providers (#636) (1af5882), closes #624
• plugins: resolve relative executable paths against plugin root (#627) (2efe6d5)
• sandbox: remove windowsWriteRestricted flag to fix DenyRead bypass (#612) (3d96ac7)
• sandbox: scrub dynamic credential env vars (#682) (9043bae)
• sandbox: scrub sensitive credentials from sandbox environment (#660) (6fc1220)
• sandbox: unblock git fetch/commit/add under the write-restricted sandbox (#654) (5c4815a)
• sandbox: use WRITE_RESTRICTED token when no DenyRead paths are configured (#658) (a5d2e32)
• securefile,credstore: call Sync on temp file before close and rename (#631) (212734a)
• securefile: reclaim stale lock files to prevent permanent DOS (#615) (8536cc8)
• swarm: wait for job.Runs directly in scheduler skip test (#667) (1bb6b57)
• tools: classify silent wrapped Windows command failures as sandbox denials (#659) (8bd9742)
• tools: preserve SysProcAttr during PTY fallback (#618) (f78b36c)
• tui: resolve pending askUser callbacks to prevent runner hangs (#620) (aa73a76)
• tui: stop the composer cursor blinking while typing or unfocused (#672) (2b42cd5)
• windows: resolve absolute path for taskkill to prevent hijacking (#617) (2db00ee)

• tools: add explicit effect metadata for safe concurrency (#705) (8ef8576)

• gate project-scoped hooks, plugins, and MCP servers behind workspace trust (#529) (a880ce8)
• modelregistry: infer reasoning efforts for Hunyuan and vendor-prefixed model ids (#599) (92a92ce)
• providers: OAuth login profiles and list-first /provider manager (#560) (1655056)
• tui: remember recent provider+model selections in /model picker (#568) (d0c4e62)
• tui: show CLI version on the startup home screen (#538) (fd69233)
• voice dictation (speech-to-text) (#557) (87158a1)

• address bugs found in a multi-agent codebase audit (#481) (008bc9b)
• agent: keep tools exposed for max-turn finalization (#533) (3f0503b)
• auth: persist OpenRouter API key after login (#595) (2a062aa)
• bump Go to 1.26.5 for crypto/tls fix (GO-2026-5856) (#607) (a7cfb99)
• gitignore Windows sandbox helpers and npm version marker (#578) (25653f6)
• mcp: silence startup warning for unconfigured default servers (#563) (302f58b)
• mcp: skip RFC 8414 discovery when OAuth endpoints are preconfigured (#586) (8a52d98)
• modelregistry: reject oversized models.dev cache responses (#602) (66a6396)
• provider: stop dropping custom no-auth providers on restart (#558) (ba99fa8)
• sandbox: Windows-appropriate suggestions when blocking interactive commands (#414) (ba4c007)
• tools: block MSYS and WSL shells under the Windows sandbox (#587) (0666818)
• tools: platform-specific pager suggestions, quote/caret-safe cd detection (#543) (8b248f4)
• tools: Windows cmd.exe quoting guidance and clipboard escaping fix (#468) (f10ed0c)
• tui: bypass toggleSidebar and toggleMouse global shortcuts when composer is non-empty (#576) (c7346fb)
• tui: paste protection for Termux char-by-char paste (#573) (8e9149f)
• tui: update picker_test for switchProviderModel 4-value return (#589) (8f15650)
• update: clearer error on unsupported release platform (android/termux) (#603) (1fc9b2d)
• update: support safe symlink extraction during updates (#575) (ce9cb91)
• warn about untracked scratch files left behind after a run (#571) (062328b)

• grep: stop content scan after head limit (#601) (8a05e64)

• add --auto flag for LLM-generated commit messages (#423) (b0abde7)
• add zero changes push and pr subcommands, and extra repo-info metrics (#391) (2312abe)
• agent quality, caching, retry, and tooling upgrades (#506) (3c81fea)
• agent: curb over-engineering the solution in the editing discipline (#517) (f4c998a), closes #516
• agent: inject per-user config.UserConfigDir()/zero/ZERO.md guidelines into system prompt (#475) (7b10aab)
• openai: forward prompt_cache_key for server-side prefix cache routing (#515) (87e7e69)
• providers: add zero providers models to discover a provider's models (#386) (0bc8074)
• providers: add KiloCode and OpenCode provider support (#388) (b1ccb6d)
• providers: add Meituan LongCat catalog preset (#424) (b4275e3)
• providers: split minimax zai into intl cn (#398) (aaad4d2)
• require manual approval before npm publish + drop release-as pin (#369) (bd89a1f)
• sandbox: unelevated Windows fallback tier instead of prompts-only degrade (#427) (b9ddd6f)
• support shift enter for composer newlines (#462) (daf65e0)
• tui: /loop — repeat a prompt or command on an interval or self-paced (#502) (387fe67)
• tui: add search/filter to provider picker in setup wizard (#400) (2fcea71)
• update: add zero upgrade command to apply self-updates (#461) (5f36349)

• action: keep provider key scoped to zero step (#448) (407a927)
• add android platform support for Termux npm install (#455) (9bd93c6), closes #449
• agent: reject a malformed additional_permissions payload before prompting (#453) (e4f760e)
• allow non-TLS connections to private-network provider endpoints (#444) (1d86384)
• auth: route zero auth login chatgpt to the dedicated ChatGPT flow (#443) (305a62c)
• config: fall back to a usable saved provider instead of forcing full re-onboarding (#410) (c60ad87)
• config: let a gateway ANTHROPIC_BASE_URL resolve as anthropic-compatible (#497) (30dd7c3), closes #479
• config: unbrick first-run setup — default google/anthropic models, enter setup on fixable config errors (#385) (72eed06)
• config: use ~/.config on macOS and enter setup when no provider (#371) (#372) (027a8f2)
• docs: rename AGENTS.MD > AGENTS.md (#438) (4266baf)
• gemini: strip unsupported JSON Schema fields from tool declarations (#374) (39e7100), closes #373
• install: persist install dir to user PATH on Windows (#407) (bdb1b0e)
• mcp: block cross-origin credential redirects (#396) (f915f70)
• oauth: treat Windows ERROR_ACCESS_DENIED as lock contention in createSecretFile (#445) (d05e914)
• openai: handle Ollama reasoning stream deltas (#486) (f6c0606)
• preserve conversation context in exec prompts (#460) (949ee43)
• provider-wizard: allow multiple custom OpenAI-compatible providers (#403) (3fbbd28)
• sandbox: fix nested pipe creation under the Windows restricted token (#456) (563a6db)
• sandbox: gate /tmp test assertions on GOOS, not path existence (#426) (f653dca)
• sandbox: self-heal a corrupt unelevated setup marker (#437) (8d0c5fe)
• specialist: cap max specialist nesting depth (#491) (177442c)
• Termux/Android support — PRoot scroll, SIGSYS sandbox, build docs (#509) (0f69d99)
• tools: Block MSYS coreutils under Windows sandbox (#476) (81aad58)
• tools: CRLF line ending mismatch in edit_file tool on Windows (#378) (33dc7ae)
• tools: fix cmd.exe /S/C corrupting commands with embedded quotes (#465) (190241b)
• tools: flag piped POSIX utilities before running on Windows (#412) (5658a36)
• tools: make grep and glob respect run cancellation (#464) (ba6c026)
• tools: require permission before web_search requests (#382) (960db96)
• tui: compose help overlay through the viewport overlay pipeline (#421) (5b2b4de)
• tui: keep the profile name on /model switch so the stored key resolves (#441) (9134148), closes #440
• tui: resolve every permission request so the agent can't deadlock (#397) (952788f)
• tui: show an M suffix for million-scale token counts (#457) (0562e3b)
• tui: title /model rows by model name, not the catalog description (#395) (cdf9d83)

• cache TUI model registry (#496) (e7d88b4)
• universal tool-output ceiling with spill + async post-edit diagnostics (#518) (95ccd5b)

• publish zero to npm via release-please (#367) (8eccc26)
• tui: FILES sidebar panel with click-to-select and file drill-in (#365) (142c548)

• auth: propagate credentials to every provider-build surface and pin children to the live provider (#366) (6e0a665)

• Shared multi-agent skills discovery: when present, ~/.agents/skills is searched after the primary Zero skills dir (and before plugin skill roots). zero skills list / info and the runtime skill tool share one multi-root discovery path; install/remove/lock still target only the Zero skills directory.
• SECURITY.md with a private vulnerability-reporting path, CODE_OF_CONDUCT.md, this changelog, and GitHub issue/PR templates.
• Interactive /theme picker: bare /theme opens a popup that live-previews each palette as you move and applies on select (Esc reverts).
• Twelve built-in color themes alongside the dark/light built-ins — dracula, nord, gruvbox, tokyo-night, catppuccin, one-dark, solarized-dark, rose-pine, everforest, solarized-light, dune, and neon — selectable via /theme <name>, --theme <name>, or ZERO_THEME. Every palette is contrast-audited to WCAG AA, and the new presets are additionally audited after xterm-256 downsampling; see docs/THEMES.md. The built-in light theme was reworked for legibility.
• --theme <name> flag for the TUI, accepting auto or any registered theme (previously only the ZERO_THEME env var existed).
• "Accessibility / Appearance" section in the README documenting NO_COLOR, ZERO_THEME, /theme, and ZERO_NO_FADE.

• Provider connectivity health checks now allow loopback hosts for explicitly user-configured local providers (Ollama / LM Studio), so the keyless local-model path verifies instead of failing with "localhost hosts are blocked". The SSRF guard for fetched/remote URLs is unchanged.
• Auth (401/403) errors now show a curated, actionable message pointing at zero auth / setup; the raw upstream body is shown only under a verbose/debug flag.
• No-provider / missing-key errors now point at zero setup and zero auth, and distinguish a missing key from a rejected key.
• zero doctor no longer reports "Overall: pass" when no provider credential is configured, and formats the missing-language-server list for humans (no raw Go map[...]).
• Raised the faint/faintest theme tokens (and the light-theme accent) to meet WCAG AA contrast for the content they carry.
• NO_COLOR is now honored for any non-empty value, per the no-color.org spec.

• The inert /input-style slash command (it had no backend).

• README/go.mod Go-version mismatch and other stale public-release docs claims.