Changelog

All notable user-facing changes to cast, newest first.

0.61.0

Added

• MCP code mode, on by default (set "mcpCodeMode": false in ~/.cast/settings.json to go back to one tool per MCP schema). The model sees one codemode tool instead of every MCP schema and writes a short script against typed declarations (codemode.<server>.<tool>; the read-only built-ins read, grep, glob, ls, web_fetch, web_search sit under fs and web). The script runs in a child process under Node's permission model, with no file system, shell or secret environment variables, at most 8 calls in flight, and a two-minute limit. Every call it makes goes through the normal loop, so confirmations, hooks and plan mode apply to each one. Measured on MiniMax-M3.1-Flash with a 51-tool Bitrix24 server: about half the tokens of the classic scheme over 54 runs with the same number of correct answers, and 1.5 to 4 times cheaper in real cast run sessions. Known limit: the script can still reach the network.

0.60.1

Changed

• Monos buttons now cover the full browser chat flow. Header actions, session creation, status and composer controls share the same primitives while keeping Cast's theme and mobile touch targets.

0.60.0

Added

• The browser chat uses Monos UI's chat components. The panel, message and composer now follow the shared Monos structure while keeping Cast's session state, streaming, tool cards and message actions. The terminal interface continues to use pi-tui.
• The web client can be installed as a PWA. Its app shell, sign-in page and icons are available offline; sessions and provider requests still require a network connection. Remote installs require HTTPS.

0.59.1

Fixed

• A Windows install can start its own daemon again. cast run and every other headless surface that had to start the daemon itself read the bundle path with a POSIX-only check, took the source-checkout branch, and launched tsx against a src/ an install does not have. The child died at once, the launcher burned the full 60-second startup budget, and then reported that the daemon "did not start". One shared check now handles both separators, and the wait ends as soon as the child exits.
• cast server stop drains before it kills on Windows. Windows never delivers SIGTERM to a JavaScript handler, so stop was an unconditional TerminateProcess: no SessionEnd hooks, no checkpoint drain, a turn's snapshot cut mid-write. Stop now asks the daemon to shut down over its authenticated route first — the same shutdown() the signal handler runs — and falls back to signals only if that fails.
• cast upgrade restarts the daemon on Windows. The detached restart waiter was a sh -c script, and a Windows release carries no sh, so the replacement never started. It is a small Node process now, with the same contract: take the start lock, wait for the old pid, start the new daemon, drop the lock.
• cast run no longer calls a dropped connection a finished turn. One SSE hiccup printed "output may be incomplete" and exited 1 while the daemon went on running the turn. A reconnect in progress now gets a bounded window; only a stream that is really closed ends the run.
• cast server start --port 0 reports the port it actually bound, instead of http://127.0.0.1:0 and no address to open.
• A command hook can no longer hang a turn forever. The timeout only killed the process and waited for an exit; on Windows the killer is a separate taskkill that can fail silently, and Stop/PreCompact hooks are awaited outside the 2-second net that closes an aborted tool batch — so neither the timeout nor Esc ended the turn. The hook now settles unconditionally shortly after its timeout.
• tools/list cannot paginate forever. A server handing out a fresh cursor per page looped during startup and /mcp reconnect, where there is no Esc to reach. The listing stops at 50 pages and says so.
• An MCP tool call has a real ceiling. Progress notifications reset the per-request timer and no total timeout was passed, so a chatty server pinned one call until someone pressed Esc.
• A busy daemon keeps its registration. The identity probe read a 1.5-second timeout as "not our daemon", cleared the state file and let a second writer start beside the first. It now retries, tells a refused connection apart from silence, and never clears on silence.
• cast server stop no longer gives up on a wedged daemon, clearing its state while the process and its port stay up.
• The terminal screen says "Starting the cast daemon..." after 400ms instead of showing nothing for up to a minute while the daemon comes up.
• The screen no longer reconnects in a tight loop. Each onerror re-subscribed immediately from an effect that re-ran on its own result, so a daemon that answered but no longer held the session became an unthrottled request storm with the composer refusing input. Reconnects back off from 1s to 15s, ask whether the session still exists, and stop with a plain message when it is gone.
• The lsp tool's deadline covers server startup. Starting — or auto-installing — a language server took no signal, so npm and a release download could run for minutes after the tool had given up.
• A stale start lock no longer costs a minute. A lock whose recorded pid had been recycled by a long-lived process looked held forever; it is taken over after five minutes.

Internal

• Cross-platform tests for the behaviour above: a probe that never answers is unknown rather than a different daemon, a refused connection is a mismatch, a recycled-pid lock is taken over, runaway tools/list pagination is refused, and the shutdown route is authenticated.
• The suite no longer collects the throwaway fixtures under test/__test_tmp__/. An interrupted run leaves them behind, one carries a tools.test.ts of its own, and the next run reported a failed suite on a tree that was green.

0.59.0

Added

• Spanish translation of the README.

Fixed

• Temporary-file guidance now recognizes the canonical system temp directory, including macOS symlink paths and Windows path aliases.
• Snapshot setup now rejects filesystem roots instead of treating a root directory as a project.
• Package metadata and the investor-deck example now report seven built-in personas.

Internal

• Stabilized cross-platform tests around filesystem watcher startup, temporary-directory cleanup, and Windows Vitest worker reporting.
• Corrected the README's Vitest file count to match the current suite.

0.58.3

Internal

• Added regression coverage for valid PermissionRequest deny decisions, restoring the hook module's committed per-file coverage floor.

0.58.2

Added

• Sandbox sessions now isolate shell processes at the OS level. Commands are limited to the session folder and a private temporary directory, cannot access the user's home or common credentials, and have no network by default. The release archive includes the sandbox runtime; Linux and macOS need their documented system tools, and Windows needs a one-time elevated setup.
• /cost-cap <USD> sets a session-wide provider-reported spend threshold. It covers the main loop and auxiliary model calls, including subagents and maintenance. If a provider omits price, cast stops later requests while the cap is enabled.

Fixed

• Background checkpoint writers now share the parent session's cost cap and sandbox identity. Previously this maintenance path could make uncapped model calls and lose the process boundary after switching to a worktree.

0.58.1

Fixed

• Project instructions and extensions no longer need a manual /reload after editing. Cast watches instruction files, skills, rules, personas, and MCP configuration on macOS, Windows, and Linux. Changes are applied when the current turn ends, so a running turn keeps the context it started with.

0.58.0

Added

• MiniMax's newest models think by depth, and cast speaks that language. MiniMax-M3.1-Flash cannot turn its thinking off — the API answers 400 … requires adaptive thinking — and its depth is set with reasoning_effort (low, medium, high, xhigh, max). Cast sends that field for the M3.1 family, offers their five depths in the reasoning picker, and resolves a level left over from another provider to the model's own default instead of failing every request with a 400. The older MiniMax models keep the vocabulary they honour (thinking: { type: "adaptive" | "disabled" }).
• A script that runs cast and mcode against the same task, the same model, the same repository and the same grading. scripts/compare-with-mcode.mjs ships with four tasks — a one-line comparison bug, a function to implement from a spec, a parser that does not strip \r, and a money-in-cents bug that spans six modules — and a hidden test the agent never sees, so "the tests pass" cannot mean "the agent's own tests pass". docs/harness-comparison.md has the method and the measurements.

Fixed

• A bash call could not run at all. On macOS, node-pty runs every command through a prebuilt helper that has to be executable, and an install that skipped scripts (npm install --ignore-scripts) left it without that bit: the module loaded, every pty.spawn threw posix_spawnp failed, and every bash call in the session died with it. Cast now checks whether a shell can actually start before it takes the PTY path (and falls back to plain foreground execution when it cannot), npm run pty:fix puts the bit back, and the reason is reported instead of a bare failure.
• A background task that failed to start reported that it had started. The model was told "Started in the background as bg-1" for a task whose shell had never run, and then waited for output that could not arrive. It is now reported as the failure it was, and a shell that is not on PATH is named as such on every platform.
• A file's trailing newline was counted as an extra line. read showed alpha\n as two lines, the second one empty — a phantom the model read as content it had to double-check, which cost it a diff to confirm what read had already shown. Lines are counted the way an editor counts them, and read says to pass offset/limit when a line range is asked for.
• The harness on macOS. Twenty-two tests failed there for platform reasons and were hiding real bugs: the snapshot repository was refused because a resolved temp path was compared with an unresolved one, the directory watcher re-indexed ignored folders and reported a path that did not exist, a context file was counted twice on a case-insensitive filesystem, and the tests compared /var/... with /private/var/....
• A tool that says the thing does not exist is an answer, not a failure to retry. An MCP lookup that reports "no such entry" now says so in the tool result — where the model decides what to do next — instead of reading like a transient failure that invited a dozen spelling variants and, finally, an answer about a different item.
• The same tool failing over and over is noticed. The doom-loop guard saw identical calls and the repeated-output guard saw identical results; between them a model that failed the same lookup with different arguments slipped through. After three failures in a row the result says so.
• A check that failed twice in one session now says so, and says whether anything changed since. The model no longer has to run a check again to learn whether the failure is its own: the earlier turn is named, and — the part it cannot work out itself — whether any edit or write has run since.

Changed

• The verification prompt says what a check costs. The same check, but the narrowest one that shows the failure; one run per kind; to learn whether a failure is yours, that one test on the unmodified source; a check that passed on code you have not changed since still holds. Measured on one real task: 62 tool calls became 50, and the context sent to the provider fell from 5.2M to 2.2M tokens, with the same result.
• MiniMax's M3.1 family starts on the cheapest thinking depth. The provider would think at max; measured over the behaviour bench, low was both steadier (39/39 tool contracts and 11/12 of the cases that used to flip, against 36/39 and 7/12 at max) and about twice as fast. /reasoning raises it for the tasks that need the thinking.

0.57.5

Fixed

• A todo list that is too long, or has two items in progress, is reported as a retryable argument error. It was labelled an internal error that could not be retried, so the model gave up on something it could fix; the message now names the item and the limit.
• A quiet provider is announced again while it streams nothing visible. Empty keep-alive chunks used to hold off the "waiting for the provider" notice, so a long wait with nothing on screen looked like a hang. The connection is still allowed to stay open on any bytes.
• Tool calls made by a subagent are recorded in the usage telemetry, under the subagent's own session, with their errors and latencies. Before, only the parent's calls were counted.
• A glob search that times out is reported, instead of silently searching again with a different method that applies the limit and ordering differently. A missing fd still falls back to the built-in walk.

0.57.4

Changed

• A mistyped flag is refused, not sent to the model. cast --forse used to open the TUI with --forse as the first message, and cast run fix it --format yaml ignored the format. Now an unknown flag exits 2 with unknown option, a flag is read anywhere on the line (-- still ends the flags), and a value-taking flag with no value (cast -m, cast -p -c, cast --session) is an error instead of a silent default.

Fixed

• Concurrent cast processes no longer drop each other's saved logins. Two processes saving MCP tokens at the same moment could each write back a token file without the other's entry: with 16 saving at once, 2 to 15 of 16 servers were kept. The token file is now written under a lock, and a lock whose owner died is taken over at once.
• Concurrent sessions in one folder no longer break the shadow repository. A checkpoint written while another session released its last ref could be deleted under it, leaving the repository broken for later checkpoints. The write and the delete now hold one lock per repository.
• Starting or upgrading the daemon under contention. A stale start lock could block every later start, and the web upgrade's restart could race a cast run into a second daemon. The lock names its owner and is reclaimed when the owner is gone, and the in-daemon restart hands the lock on before the old daemon exits. A daemon that died while the upgrade waited is started again.
• The web server answers 400 to a body that is not a JSON object, where it answered 500. A command that is not a string is refused the same way.
• An SVG shown inline cannot run script: it is served in a sandbox.
• A folder download survives a machine without tar, and server.json (which carries the bearer token) is written owner-only.
• The login limiter counts a client behind a local reverse proxy by its X-Forwarded-For address, so one client's failures no longer lock out everyone behind the proxy. Only a loopback peer is trusted to set that header.
• An OAuth callback visit without its query no longer ends the login with an empty code.
• A picker inside an MCP form closes when the form is cancelled, instead of staying on screen; the multi-select and text prompt now honour the abort.
• Picker overlays on short terminals keep their hint row and bottom border: the list gives room to the error, detail and search lines.
• The resume hint is painted through the legibility floor, and session tables align CJK and emoji by terminal width.
• cast server --port accepts --port=N; a port that is not a number in range is refused before the daemon starts.
• An ssh host or user that starts with - is refused, so it cannot be read as an ssh option.
• Malformed tool-call arguments are repaired in a copy: the session history and its saved file keep what the model actually sent.
• An interrupted read with an image no longer gets a second, fabricated result for its tool call.

0.57.3

Fixed

• cast upgrade no longer leaves two daemons behind or reports a false failure after restarting the server. The upgrade stops the old daemon and starts the replacement without taking the shared start lock every other launcher uses, so a cast run (or a second cast) starting at that moment could win the port first, register itself under a private address, and make the upgrade both stack a second daemon and end with "the new daemon could not be verified" for a restart that did happen. The restart now holds the shared start lock, re-reads the recorded daemon after taking it and skips a pid that changed meanwhile instead of signalling it or clearing a newer daemon's record, and releases the lock when it is done.

0.57.2

Fixed

• A loop that alternates two calls is stopped, not run out to the iteration cap. The doom-loop detector compared only consecutive identical calls (same tool, same arguments), so a model that repeated a pair — bash, todo_write, bash, todo_write, … — never had two of one name next to each other and the check never fired. One live session ran that way for ~100 iterations, the same pair hundreds of times with the model itself saying "I'm stuck in a loop" in between, until a different backstop ended the turn. A call is now blocked once the same tool with the same arguments has appeared three times anywhere in the recent window, so an alternating loop is caught on its third repeat instead of never.
• A repeated tool output stops the turn at 25, not 100. When the model keeps calling and keeps getting the identical answer back, the reminder that repeating won't change anything now gives way to stopping the turn at 25 repeats instead of 100: a runaway costs ~25 model calls rather than ~100. Polling a running background task (bash_output) is still exempt, and re-running a check a few times after a real change still runs.

0.57.1

Fixed

• Answers were set as code, indented four columns more, from a point in a session on. The terminal carries an open code fence from one block of an answer to the next, and it counted two things it should not: the reasoning (shown or not), and a ```python line inside an open block, which it read as the end of that block. A model that opened a fence, forgot to close it and opened another left the transcript believing a block was open, and every answer after it was drawn as code (first row at eight columns, the rest at ten). A fence line with a language tag no longer closes a block (as in Markdown), reasoning keeps fences of its own, and a new prompt starts the text over. In the session that showed it, 30 rows were wrongly indented; now none.

0.57.0

Changed

• Alt+Enter queues, Enter steers. While a turn runs, Enter sends a plain message into it (steer) and Alt+Enter (Option+Enter) queues it for after the turn, in the terminal and the web UI. The /running-input setting ("Enter while a turn runs" in Settings) now only swaps the two keys, and the hint under the composer and the setting's own text say which does what. Idle, Alt+Enter is a line break as before; while a turn runs Shift+Enter or a trailing \ is.

0.56.4

Changed

• The terminal's command list is ordered for use. A bare / opens with the commands most reached for (help, new, sessions, compact, review), then the rest: built-in commands A to Z, your skills, MCP prompts. With letters typed, what starts with them comes first (the exact name before all), then what only contains them: /mo no longer leads with queue-remove and worktree remove. A subcommand (skills-sh install, worktree list) is not a row of its own but is named in its command's description (… [install | list-available | …]), and a short name (/s, /q, /qr) is told in the description of the command it stands for; /s now lists 19 rows instead of 25, none of them a variant.

Fixed

• Slash commands that answer with data are readable in the web UI. /skills, /provider, /hooks, /memory, /permissions, /mcp, /web-search-provider and others showed the raw JSON of their answer (/skills was five thousand characters of file paths). They show a list, one line each (* mimo (active) - https://...), or key: value lines, and the answer's own text when it has one (/lsp).
• A web command that asks the model is not cut off at 15 seconds. /evolve, /compact, /btw, /distill and /dream wait up to a minute, like in the terminal; before, the page reported "Request timed out" while the daemon went on and answered nobody.
• /cost says "1 request", not "1 requests".
• /evolve no longer answers twice, or reports a timeout it did not have. The analysis is a model request of its own and takes seconds on a long session; nothing said so, and a second press of Enter ran the same work again and answered again. It now says "Analyzing the session for reusable skills…", and a second /evolve meanwhile is told "Already analyzing" instead of starting another. In the terminal, a command that asks the model (/evolve, /compact, /btw, /distill, /dream) waited 5 seconds for the daemon like a quick call and showed "The operation was aborted due to timeout" while the daemon went on and answered a screen that had stopped listening (the picker or the result never appeared); they wait up to a minute now.

0.56.3

Fixed

• The microphone shows on a new session's page. The button depends on the session's model taking voice, and a new session that has not sent anything has no session to ask, so the page you land on had no microphone until the first message created one. The page now asks the daemon by model name (GET /api/model-audio). A model that does not take voice (a text-only one) still has none.

0.56.2

Fixed

• The sign-in page no longer shows first to someone who is signed in. The session cookie was SameSite=Strict, which browsers leave off a page opened from a link in another app (a chat, a doc, a bookmark manager): the visit went to the sign-in page, and only its own session check sent it on, a flash of the login window. The cookie is SameSite=Lax now: still withheld from requests another site makes (a POST, a fetch), sent on a link that opens the page. A session issued as Strict is re-issued as Lax, for the time it has left, by that same check, so no one has to sign in again (the first such visit still meets the sign-in page once).

0.56.1

Fixed

• A background task's result is not told to the model twice. When the model waited on a task with bash_output (or read it after it finished, or killed it itself), the completion notice still arrived later as a message of its own, and the model spent a turn on each one answering that it already knew. The notice is taken back once the model has the result. Two evals (background-wait-no-duplicate-notice, background-kill-no-notice) check it with a real model.

• A finished background task is one line in the terminal. [system] Background task bg-7 (du -xh …) exited with code 0 after 117s: that it came back and how, not a page of its output (the model has it), as a foreground command shows a row and not a block.

• The model is told two kinds of background task. A task it started with run_in_background ("do not poll it or wait for it, carry on or end your turn"), and a command that ran long and was moved for it ("if you need its output to carry on, wait with bash_output: that result is then yours and no separate notice follows"). Both said the same thing before, which invited polling for results that were not needed and gave no reason to wait for ones that were. Two evals (background-explicit-not-polled, background-promoted-result-awaited) guard both behaviours with real models.

• A finished background task is told to the model on its next step. It reached the model only when it would stop, so a turn that had other work and was asked for the result in the same reply had no way to see it and polled with bash_output. A notice cast itself queues (a finished task) now joins the running turn at the next step; a message you queued still waits for the end of the turn. The start text for a requested task also says to wait with bash_output when the answer needs its output.

• A finished background task is one line in the web UI too, in a live session and after a reload; a task that woke an idle session showed as an empty message of yours before. In the local terminal fallback, such a notice no longer takes a message you queued off the Queued list.

• Eight more background-task evals on real models, from the cases that matter in work: two slow commands at once, a failing task, a result the next step depends on, a dev server started, queried and stopped, a task cut off by its timeout, a very large output, and a wait longer than one bash_output allows, and a task that finishes while the model does other steps.

• Background task rows read like bash rows. bash_output bg-1 * wait 30s and bash_kill bg-2 in the terminal, instead of task_id="bg-1", wait=30000: the wait is shown as a bash timeout is (30s, 1m), capped to what the tool really waits.

0.56.0

Fixed

• The message queue is the same everywhere. It was drawn from each client's own memory: a message queued in the web page was not in the terminal's list (nor the reverse), a reload emptied the list while the messages still waited, and /queue-reset in the terminal cleared nothing on the daemon. The daemon now sends the list on every change and to a client that joins, so the web page and the terminal show the same entries. A shared page's viewers do not see it. A background task that finished no longer shows up in the list as a raw <system-reminder>.

Added

• Queued messages can be removed one at a time. /queue-remove <n> (the number in the Queued list), or the cross beside an entry in the web UI.
• A plain message during a turn can steer it or wait for it. Steering stays the default. /running-input queue (or Settings, "Message while a turn runs", in the terminal and the web UI) makes a message typed while a turn runs wait for the turn to end and run as the next one, the way /queue does; /running-input steer goes back. /steer and /queue work as before in either mode.

0.55.0

Added

• /init, /commit, /cost, /export, /doctor. /init [focus] has the agent write or refresh AGENTS.md from the repository's tracked files, running the commands it writes down; /commit [hint] commits the current changes in the repository's message style, with explicit paths, secret-looking files left out and named, one commit per concern, and no push or amend (both show as the typed command in the thread, not as their prompts). /cost shows the session's tokens, cache and subagent share, price when the provider reports one, and a line per kind of request from telemetry. /export saves the conversation as Markdown under ~/.cast/exports/. /doctor checks Node, the provider and that it serves the session's model, git, ripgrep, the sessions database and each MCP server, and says what is wrong. In the terminal and the web UI. Two evals (init-writes-agents-md-from-repo, commit-stages-explicit-paths) check the first two with real models.

• MCP resources. A server that offers resources (documents, files, records) now gets mcp_<server>_list_resources (the resources with their URIs, and its templates) and mcp_<server>_read_resource (by URI: text as it is, an image as an image, other binary content described) beside its own tools, under the same persona allowlists, /mcp disable and reconnects. The model lists, then reads, and builds a URI from a template when that is the way in; <available_mcp> marks the server resources="true" and /mcp list shows + resources. Three evals (mcp-resource-*) check it with a real model. Not supported: change subscriptions, @-mentions of a resource.

• The agent can work in a git worktree by itself. A worktree tool (enter, exit, list) does what /worktree <name> does: it makes (or reuses) .cast/worktrees/<name> on branch cast-<name>, runs the WorktreeCreate hook, and moves the session into it, so relative paths, bash and permission rules work there, the working directory is saved for the next message, and CwdChanged fires. Ask for "an isolated worktree" or "an experiment that does not touch my checkout" and it uses it; asked for an ordinary fix, it does not. Without the tool it ran git worktree add ../feature-x in bash: a branch named feature-x in a folder beside the project that the session never moved into. Offered where a daemon records the move (web, the terminal on the daemon, cast run); not in plan mode or to subagents. Four evals (worktree-*) check it with a real model.

• Worktrees stay out of the way. .cast/worktrees/ is added to the repository's local .git/info/exclude when a worktree is made (or reused), so the main checkout's git status is clean and glob/grep there no longer list the copies. A session that moved into a worktree is still its project's: cast run -c from the project continues it, the ACP session list includes it, and the web sidebar groups it under the project with a wt:<name> mark (the composer shows the same).

• The web session list can be grouped by project, and pinned sessions stay on top. A Date / Project switch in the Sessions heading (remembered in the browser) groups the list by working directory: every quick-session sandbox is one group, a project is named by its folder (and its parent where two share a name), the project used most recently comes first. A "Filter by project" box under the search narrows the list, or a search, to one project. Pinned sessions are one list above all groups, newest first, wherever their date is: a session pinned months ago used to sit under "Older", and past the first page it was not even loaded (the server now sends pinned sessions first). Grouping by project and filtering load every session rather than the first pages.

• The web folder picker can be typed into and filtered. The path is a field: type or paste a path and press Enter, and a long path shows its end (the folder that "Use this folder" takes) instead of its start. With more than a few folders a filter appears (Enter on a single match opens it, Escape clears it), a "Hidden" box shows the dot folders, and arrows, Home and End move through the list as one tab stop (Delete asks to remove the folder). The list says how many folders it holds.

• MCP prompts. A server that offers prompts gets a /mcp:<server>:<prompt> [arguments] command for each one, in the web and terminal palettes with its argument names as a hint. The server renders the prompt, and the messages it returns are sent as your next message. Arguments are positional or name=value, with quotes for values holding spaces; a missing required one is reported and nothing is sent. Checked against the reference server-everything with a real model. Not available over ACP or cast run.

• MCP: everything a server can send or ask. Tool and prompt lists are read again when a server says they changed (also over Streamable HTTP, where cast now opens the listening stream for servers that declare they send unasked messages). Long calls show progress ([3/10 ...] in the terminal, a bar in the web UI). A server's log is kept (/mcp logs <name>), servers are told the working folder (roots), and a tool that returns only structured output is read. A server may ask for a model answer (sampling, confirmed first like a dangerous command) or for input (elicitation: a form card in the web UI, field by field in the terminal). @<server>:<uri> in a message reads that resource into the turn, and a server that offers subscriptions tells the model which resources it read changed.

• MCP OAuth. /mcp auth <name> signs in to a remote server with OAuth (authorization code with PKCE, dynamic client registration, loopback return or a pasted address for a browser elsewhere), /mcp logout <name> forgets it; the token is kept in ~/.cast/mcp-auth.json (mode 600) and refreshed. A connect that gets 401 says to run it. Checked against the SDK's own OAuth server.

• MCP prompts over ACP and cast run. The editor's command list carries a server's prompts, and cast run runs one as a command action.

• Skills: a skill that fails to load says so. Load errors were computed and thrown away, so a skill with a bad name or broken YAML simply was not there. /skills problems (and the end of /skills list) lists them with the reason, and notes about ones that loaded. An over-long description is cut and noted instead of dropping the skill.

• Skills survive a compaction. The latest three loaded skills (up to 12,000 characters each) are put back as a reminder after the summary; before, a workflow loaded early was gone halfway through a long session.

• /btw <question> asks on the side. The model answers from the conversation so far, with no tools, and the answer shows as a notice; neither the question nor the answer joins the conversation, so the work in progress and its context stay as they were. It works while a turn is running, and then also hears what that turn has said and done so far. Billed like any request (a new side kind on the usage dashboard); a conversation that fills the window is refused with a pointer to /compact. In the terminal, the web UI and cast run (a command action).

• !command runs a shell command yourself. A prompt line starting with ! (!git status, !npm test) is run in the session's folder with no model turn, in the terminal, the web composer and cast run (a shell action). The command and what it printed show in the thread and are added to the conversation as a message that says you ran it, so the next message can refer to it. It goes through the same gates as the bash tool (plan mode reads only; a dangerous command asks first), waits for a running turn to end, and !!text sends a message that starts with ! to the model. Not handled before: such a line went to the model as text.

• Ctrl+Q quits the terminal at once. One press, from any state (a turn running, a question open), with no second press; the session is saved on the way out and the resume line is printed, the same as /quit. Ctrl+C twice still works. It is the input.quit action, so it can be rebound or unbound in keybindings, and it is shown where the exit key was: the hint row (Ctrl+Q quits), the first-Ctrl+C message, /keys, and the docs. Ctrl+D is not used, since it deletes a character in the composer.

• Rules: /rules says what is wrong. The list now shows [always:waiting] for a nested always-apply rule whose subtree has not been touched, [on disk, not loaded: /reload] for a file added since the last reload, the files that did not load, and notes: a rule hidden by another of the same name (.md over .mdc, a project rule over a global one), an always-apply value that was not understood, a name @ cannot spell. The web UI printed the raw JSON of the list; it shows the same text as the terminal now, with the globs, scope and source it never had.

• Rules a session latched survive a restart. The rules an @ mention or a matching file attached are saved with the session and in force again when it is resumed (or the daemon restarts); before, the conversation was built on a rule that vanished from the prompt until the files were touched again.

• Rules are bounded. All the rule bodies together may cost 160,000 characters on a request (each was already cut at 64,000), and the lazy-rule list has a budget of about 3k tokens; what does not fit is named, not dropped silently.

Fixed

• web_fetch with the local backend works again. Every request failed with fetch failed (invalid onRequestStart method): its pinned connection pool is an undici agent, which Node 22's own fetch does not accept. Nothing noticed, since every test stood in for the network; it is now tested over a real connection.
• The local backend's address check covers IPv6 spellings of IPv4. [::ffff:127.0.0.1] is rewritten by new URL as [::ffff:7f00:1], which the check, looking for the dotted form, let through; so did [::127.0.0.1], NAT64 (64:ff9b::7f00:1), 6to4 (2002:7f00:1::) and Teredo. It now reads the address as 16 bytes and refuses all of them, site-local and multicast too, and the documentation and 6to4-relay IPv4 ranges.
• Jina no longer receives what a third party should not see. The default backend sent http://10.0.0.5/admin?token=..., https://user:password@host/ and localhost URLs to r.jina.ai. Internal addresses, hosts that resolve to one and URLs with a login are refused before anything is sent.
• A 404 through Jina is an error, not a page. Jina answers 200 and says Warning: Target URL returned error 404 before the content; cast cut that line off, so the model read the site's error page as the page it asked for. It reports the status now, and passes other Jina notes on.
• A search can no longer hang the turn. DuckDuckGo, Tavily and Brave had no deadline; they now give up after 20 seconds and say which one did.
• DuckDuckGo ads are not results. The first results of a commercial query were duckduckgo.com/y.js ad redirects. A page that is neither results nor "no results" is an error and is not cached, where it was remembered as "no results" for ten minutes; the bot check is recognised by more than one wording.
• Arguments are checked: a time or region DuckDuckGo would silently ignore is refused with the allowed values, maxChars is capped at 200,000, and a Jina response is read up to 5MB (it was read whole). A 429 from Jina says what it means.
• The model is told web content is untrusted data in the descriptions of web_search and web_fetch, and never to send your files or conversation to a URL because a page asks.
• Project rules no longer skip the trust question. The question looked only at <folder>/.cast/rules, so a repository whose rules were in Cursor's .cursor/rules, nested in a subfolder, or at the project root while you started in a subfolder was loaded into the system prompt without asking. It now lists every rules folder it finds.
• A nested always-apply rule no longer leaks into a subagent, and the folder you work in counts. A subagent's prompt carried every always-apply rule of the project whatever their subtree, against what the docs say; it carries the project's own and those around its working folder now. A session started in apps/web has apps/web's rules from the first message, before any file of it is read (they waited for one); /rules no longer shows them as waiting.
• always-apply: yes, on, 1 and alwaysApply: "true" work. Only a literal true did, and anything else made a rule that never applied with nothing saying so. An unreadable value is reported.
• Rules with a dot in the name can be @-mentioned (@api.style), and /rule:Spaces In Name works over the daemon too.
• The instruction cast gives the model about rules was wrong: it said always-apply rules with globs are auto-injected on a match. It now says always-apply and glob-matched rules are already in the prompt and need not be read.
• Skill arguments. A body that only named ${CLAUDE_SKILL_DIR} lost what you typed; one that used $issue got it twice; and substitution ran in passes, so $5 or a literal $ARGUMENTS in what you typed came out garbled. One pass now, and the User: fallback applies only when no argument placeholder took the text.
• Running a skill yourself is held to the same gates as the model loading it. /skill:name ran its !command`` blocks with no plan-mode read-only check and no confirmation for dangerous ones; the web UI also left ${CLAUDE_SESSION_ID} empty and did not accept /skill:name (only /name). Dangerous inline commands now ask, as bash does, on every path (they were silently refused when the model loaded the skill).
• argument-hint: [file] no longer drops the skill. That is how Claude Code's documentation writes the field, and YAML reads it as a list ([file] [format] is not YAML at all), so such skills vanished. A hint in brackets is read as the text it is.
• !command`` inside a fenced code block no longer runs. A skill that documents the feature executed its own examples.
• A skill linked into several agents' directories is one skill. skills add symlinks produced a collision note per link.
• The skill list has a budget (about 5k tokens); past it descriptions are cut evenly and names always stay.
• skill_install and /skills-sh run a pinned skills release instead of whatever npx skills resolves to that day.
• The legacy HTTP+SSE fallback failed on Node 22. Its dedicated connection pool was an undici 8 agent handed to Node's built-in fetch, which refused it (invalid onRequestStart method), so a server that only speaks the old transport could not connect.
• The terminal lost its own MCP connections right after start. Servers connected in the background were closed at once when React ran its state update late, so /mcp showed them but nothing could use them in the terminal. The check now reads the current state directly.
• A resource blob with a text type is read as text. text/plain content delivered as a blob was reported as binary.
• A server with only resources (or only prompts) no longer fails to connect. It has no tools/list, answered "Method not found", and the whole connection was reported as failed; docs and wiki servers are often exactly that.
• /worktree in the terminal attached to the daemon now moves the agent. It made the worktree and changed only the terminal's own idea of the folder: the daemon's session stayed where it was, so the next turn ran in the old directory. The daemon does it now (as in the web), and the terminal's folder and wt:<name> follow any move of the session (the agent's, or another client's).
• A folder made in the picker is now the one you are in. After "New folder" it used to stay in the parent, with the new folder one of dozens in the list; it now goes inside and leaves "Use this folder" focused. A path typed and not yet opened is opened by the first press of "Use this folder", and the first listing can no longer land on top of a path being typed.
• The picker's errors say what happened. Deleting a folder with something in it showed ENOTEMPTY: directory not empty, rmdir '/very/long/path'; it says the folder isn't empty. A missing path, a refused permission, a name that exists and a file where a folder was expected read the same way.
• The picker on a touch screen. Rows, the path, the filter and the delete buttons are 44px; the delete button is set apart by a rule since it is always there without a mouse; each one is named for its folder ("Delete proj-12").

Internal

• /btw has evals on real models (btw-answers-from-context, btw-says-when-unknown, btw-does-not-read-files, btw-during-tool-sees-running-work). The runner can put a side question to the model with the real code, after the run or while a named tool runs, and verify gets the answer and the conversation (which must not hold the question). The in-flight case has the model invent the file name its running command creates, so only what the turn has done can answer it; with that context withheld, or the conversation withheld, the cases fail. A model with no tools that writes a call out as markup is asked once more in plain words (it was seen doing so, 1 run in 3).

0.54.1

Added

• Arrow keys in the web workspace panel. The file tree and the list of changes are now one tab stop each, with Up, Down, Home and End moving between rows; in the tree, Right opens a folder (or steps into an open one) and Left closes it (or steps out to its parent). The panel's tabs are a real tab strip (arrows, Home and End, with the content in a tab panel), and the panel is named for screen readers. Escape clears the session search and the file search, and the session search says how many sessions it found.
• The composer says why something was left out. A seventh image, an image that could not be read, and a file that was refused each get a line under the box; a refused file shows its reason inside its chip instead of only in a tooltip. Dragging over the box shows "Drop to attach", Tab completes a slash command or persona without running it, and the attach dialog no longer greys out types that drag and drop accepts (.go, .rs, .sql and the like).

Fixed

• Signing in could send you to another site, and could put the password in the address. The next address was checked as text, so a tab in it (/%09/evil.test) passed and was read as //evil.test the moment the password was accepted; it is now resolved the way the browser resolves it and only the same site is kept. The form had no method, so with the script not loaded it submitted by GET and left the password in the URL; it posts. A dropped connection no longer reads "Failed to fetch", a lockout says how long to wait (from Retry-After) and holds the button until then, the password field is marked invalid and points at the message, the fields and button are 44px on a touch screen, the username is not capitalised or spell-checked on a phone, and the logo's space is reserved so the form does not jump when it loads.
• The sandbox choice in the new-session form no longer switches itself off. A second press on Sandbox left a form with neither a directory nor a sandbox and a Create button that was off for no visible reason. Its tooltip named the folder picked for the other mode, and the sidebar called the same thing "new". It now says the folder is deleted with the session.
• Workspace panel on a touch screen and for the keyboard. The tree and change rows and the toolbar buttons are 44px under touch; git-ignored files are no longer faded to 2.7:1 (they are muted text with an "ignored" tag); the row actions name their file ("Delete a.txt"); the loading and empty states are announced. Switching to the Changes tab no longer dropped the focus from the tab strip.
• Session history sidebar. A row no longer holds the pin and More buttons inside a button; running and failed sessions say so in words and not only by the colour of a dot; an empty history reads "No sessions yet" instead of No sessions match ""; renaming no longer re-renders every row on each keystroke; the menu items are 44px on touch.
• Composer. A recording is announced once ("Recording") rather than every second as the timer ticks; the image remove buttons are numbered; the disabled box keeps its "Connecting…" placeholder readable; spell-check is off for paths and code and Enter is labelled Send on a phone.

Changed

• The web sidebar's hidden persona and directory block is gone. It had been unreachable since the new-session form replaced it.

0.54.0

Added

• A scratchpad for every session. The agent is given a folder of its own, ~/.cast/scratch/<session id>, for temporary files (intermediate results, throwaway scripts, saved command output), tells it where it is in the system prompt, and may read and write it without a permission prompt. Temporary files stop landing in your repository or in a shared /tmp, and two sessions cannot collide. It goes with the session when it is deleted; subagents share their parent's; a sandbox session's working folder serves as its own. A scratchpad status bar segment (off by default) and /current in the web show the path; "scratchpad": false in settings turns it off; a refused write to /tmp points the agent at it; a folder whose session is gone is swept when the daemon starts; it is not mentioned to a run that cannot write (plan mode, a read-only subagent) nor when it could not be made. See docs/sessions.md. /scratchpad shows what is in it and /scratchpad clear empties it (terminal and web); the daemon also removes a folder with no activity for 30 days, and the root is private. Two evals (scratchpad-keeps-the-project-clean, scratchpad-leaves-a-requested-file-in-the-project) guard the behaviour with a real model.

Fixed

• The directory watcher reports nothing once it is closed. A change is reported only after a stat says whether it is a file or a folder, and that answer could come back after close(); it was then reported anyway (to a session that was already closed, and, in the suite, to the next test: a rare failure of dir-watcher.test.ts that stopped a release push).

0.53.3

Added

• npm run soak:tui (also run weekly in CI, .github/workflows/soak.yml) fills the terminal's transcript, scrolls, resizes, opens pickers and rewrites a large file against a fake streaming provider, and reports the live heap, RSS and longest event-loop stall of the TUI and the daemon, failing when memory does not come back after /clear or the screen stalls. See docs/terminal-ui.md.

Fixed

• /clear in the terminal now clears what the model sees. Attached to the daemon, it emptied only the terminal's own copy of the conversation: the daemon kept the whole history and sent it on the next turn (a word given before /clear was still answered after it), and held every cleared turn in memory. The terminal now asks the daemon first, and changes nothing if it refuses (a turn is running). The daemon's /clear also forgets the context size it had measured, which made the first turn after clearing a long session run a pointless compaction.
• /compact in the terminal works on the daemon's history. It compacted the terminal's copy, leaving the daemon's full history (and its PreCompact and PostCompact hooks) untouched.
• Resizing the window no longer freezes the terminal on a long conversation. Every width change laid the whole history out again in one go (about a second at a few hundred messages, seconds past that). It is now redone a little per frame, newest messages first, so the screen stays live: the worst stall in the soak test went from 519 ms to under 110 ms.
• A tool call with a huge payload no longer freezes the terminal. A multi-megabyte heredoc, or the arguments of a tool with no summary of its own, was measured and wrapped in full on every layout (12 seconds for a 1 MB write). The row now shows the first 1,500 characters and how many more there are.
• The terminal could stay on "running" after the turn had ended. After the daemon dropped the event stream mid-turn, the state fetched on reconnecting could arrive after the stream had already reported the end of the turn and put the screen back to "running" for good. A fetched state is now applied only if the stream said nothing in between.
• The daemon no longer cuts an event stream over one large event. A tool call carrying a megabyte of arguments, followed by a second large event, exceeded a 1 MB backlog limit for a client that was only a moment behind; the limit is 16 MB, and a cut is now logged.
• The copies kept for /undo of rewritten files git does not track are capped at 64 MB per session (oldest dropped first; /undo names the files it could not restore). They grew with every turn for as long as the session was open.

0.53.2

Added

• /goal resume continues a goal that was paused by an interruption or a failure. Until now the word became a new goal called "resume".
• cast run reads the prompt from stdin when there is no message (git diff | cast run "review this" still takes the message from its argument; cast run alone, or cast run -, takes the whole prompt from the pipe), and -- ends the options so a message can start with a dash.
• cast run --interactive gains abort, ids and action_done. abort now reaches a turn in progress (lines used to be read one at a time, so it could not arrive while one ran), an optional id on an action comes back on its action_done or error, and the startup state snapshot that the docs promised is actually sent.

Changed

• cast --version answers at once. The launcher prints the version itself instead of loading the whole bundle first: about 40 ms instead of 0.9 s on macOS and Linux (the Windows launcher is unchanged).
• The terminal shows its first screen without waiting for MCP servers. Servers are connected in the background right after it appears, as the web already did, so a config with a browser or remote server no longer adds seconds before you can type. /mcp list says connecting until they are up, and a first message sent in that window just runs without their tools.

Fixed

• cast run on a fresh machine no longer hangs. With no ~/.cast (a CI container) it spun for a minute in silence taking the daemon start lock, and with no provider configured it then waited forever for a turn that had already failed. It now fails in seconds with No provider is configured, and docs/non-interactive-mode.md shows the settings file to write.
• Stopping cast run stops the turn. SIGINT, SIGTERM, SIGHUP and a closed pipe (| head -1) used to kill only the client, leaving the turn (a running sleep, a model call) going in the daemon; they now abort it, kill the background tasks the run started, and exit 130, 143, 129 or 141.
• A wrong command line is an error, not a prompt. An unknown option was sent to the model as the message; a bad --format, -r or --persona, or a flag with no value, was ignored. They now exit 2 with one line saying what is wrong, an unknown session id no longer prints a stack trace, and -c with nothing to continue says so instead of starting an empty session.
• A dropped daemon connection is a failure. cast run exited 0 with a half-written answer when the daemon went away mid-turn; it now exits 1 and says the output may be incomplete. A turn that failed instantly (the event stream was not open yet) is no longer missed.
• No more EventSource is experimental line on stderr of every cast run.
• cast acp exits when the editor closes stdin, as docs/acp.md says. It used to stay alive on its MCP and language-server child processes.
• ACP advertises only the slash commands it runs. It listed ~90, none of which ran: /compact reached the model as plain text. A prompt of /plan, /build, /clear or /abort now does what it says, and those four are what the editor is offered.
• /memory cancel <id> with an id that is not a run says so ("not found or already finished") instead of printing the whole /memory usage.
• /review and /code-review show as typed. The thread (terminal and web) and the session title showed the whole instruction page as if you had written it; it is now /review or /code-review <range>.
• /goal, /review and /code-review no longer print the command twice in the terminal.
• Web commands refuse names they do not know. /mcp enable|disable, /skills enable|disable and /subagent-model-provider, /plan-model-provider answered "enabled" or stored the name for a server, skill or provider that does not exist; they now say it is unknown, as the terminal already did.
• /skills-sh failures read as a message, not as the installer's box drawing and "Agent detected" banner.
• /ssh list works in the terminal as it does in the web.

0.53.1

Fixed

• Stop during a subagent now stops the turn. An abort sent while a task was running let the parent call the model again (often starting a second task) and take up to a minute to settle; it now ends as aborted right after the tool batch.
• A read-only subagent's refused command says so. The message named plan mode even when no plan was active; it now says the agent is read-only.
• A subagent's thread in the web is view-only: Fork and Rewind are hidden there, and an open subagent no longer shows up in the session list.

0.53.0

Added

• The web shows the goal too: a goal active / paused / blocked / out of budget badge in the composer's role line, which clears when the goal is done or cleared. Until now only the terminal could say so, and only on asking.
• A goal status bar segment shows goal active, paused, blocked or out of budget, and nothing once the goal is done or cleared. Until now a goal riding along with every turn (or one that had given up) was invisible unless you asked with /goal status. It is on by default; /statusbar toggles it.

Fixed

• /dream and /distill with nothing to work on return at once. In a project with no conversation, no history and no memory they started an agent that wandered the folder for minutes (its context growing to 40k tokens) while the command waited with no output and held the project's memory queue. They now say "Nothing to consolidate yet".
• /dream says what it did. It reported "N notes stored" where N was the number of notes now in memory, even when nothing new was added. It now reads "N notes kept, M removed".
• The memory docs said the agent stores memory through its memory tool. It only searches. The page now lists who really writes memory (you, the checkpoint writer, dream, distill), and says plainly that with the defaults a short conversation writes nothing until a checkpoint threshold, an automatic dream or /dream. The /memory checkpoint ... subcommands are documented. The tool's own error, which claimed memory is written "at the end of a turn", no longer does.
• docs/web-ux.md was overwritten with the changelog's text in 0.52.12 and later (a script reused the wrong file's contents). It is restored, with its motion section.
• A second /goal during a run no longer replaces the live goal. /goal and /review were marked as needing an idle session but were missing from the list the server checks, so a /goal something else sent mid-run overwrote the durable goal under the running turn (resetting its counters) and then silently failed to start, while answering "Working toward the goal...". The server now refuses it with the usual "Agent running" and keeps the goal.
• /goal status, /goal edit and /goal clear work while a turn runs in both the terminal (edit was refused there) and the web composer, as the docs said. /goal edit also works on a goal paused by an interruption, and a bare /goal edit is a usage message instead of starting a goal called "edit".
• Starting a goal says when it replaces one that was still open, in the terminal and over the API. Over the API /goal edit answers "Goal objective updated" instead of dumping the goal's JSON.
• A goal's own prompts no longer pose as your words. The wrapper /goal sends, and the continuation, nudge and wrap-up prompts the goal drive injects, showed in the terminal and the web as a page of rules under "USER", and a goal session was titled "You are working toward a goal autonomously". The thread now shows /goal <objective> as typed and the others as one-line notices ("Goal: still open, continuing"), and the title is the objective.
• A refused command in the web composer keeps its text. A /goal ... sent while a turn ran was refused (with an error in the transcript) and the typed text vanished; it is handed back to the composer, as a failed message already was.
• Compaction no longer runs before every model call on a small window. When the system prompt and tool schemas alone sit above the compaction threshold (a 30k window with a 13k trigger, say), each compaction left the next prompt over it again, so one ran per call, each paying for a summary and folding the previous summary into a newer one. After a compaction the next measured prompt now says whether it worked; if not, further compactions wait until the context has grown a margin past where it landed, and the run says so once. Checked on a long goal (three modules, three test files, 18 compactions before): 3 compactions, a faster run, the same correct result.
• A compaction right after a compaction. The reading that decides it (the last measured prompt, and the index it was taken at) described the history from before the compaction, so a second compaction could follow at once. Nothing is due again until the provider measures a prompt.
• /mcp in the web UI started an untrusted project's servers. /mcp reconnect, enable, disable, uninstall and /reload read the MCP config of the session's folder under the daemon's trust decision, so from a session in a folder you had never trusted, that folder's .cast/mcp.json commands were run, and its servers then showed up in every other session's tool list. The shared set is now resolved from the daemon's own folder under its own trust; another folder's project servers are connected only if that folder is trusted, and stay in that folder's sessions.
• A server that dropped twice stayed dead. After a manual or automatic reconnect, the new connection's disconnect handlers tended a private copy of the server set, so the first drop was healed and the second was not: the live set kept a dead connection and every call said "no longer connected" until /mcp reconnect. Reconnects now connect into the live set.
• Switching one MCP server restarted all of them. /mcp enable, disable, uninstall, reconnect and /reload closed and reconnected every server, so a browser server lost its page whenever any other server was toggled, in the terminal and in the daemon. Only the servers that differ are touched now.
• /reload did not apply an edited server. It reconnected only when the set of names changed, so editing a server's command, arguments or address and reloading did nothing. It compares each server's config now. /mcp reconnect also picks up a corrected config for a server that never started.
• A disabled project server vanished from /mcp list, so it could not be switched back on from the list. Every configured name is listed, disabled ones included.
• Role colours in the web UI are lifted to a readable contrast. Muted and dim text already were, but the colours of the speaker labels and statuses (user, agent, tool, persona, success, warning, error) were drawn raw, so Nord's and Solarized's agent label sat at 4.4:1 and 3.4:1. Each is now moved toward the text colour only as far as the page, panels and cards need, so a palette keeps its hue. A check of every rendered text element in all 19 themes (about 6000 per run) now finds none under 4.5:1.
• Monokai gave the error colour to the agent label, the tool label and the accent (all #f92672), so a failure read like any agent heading; Molokai gave it to the persona name. They now use orange and purple from the same palette, and a test keeps every theme's error, success and warning, and the speakers, on different colours.
• The web fell back to the Cast theme when none was saved, while the terminal and the docs say Man page is the default for both. The fallback, /theme with no argument and the first-paint colours of the speaker roles all follow Man page now.
• /theme NORD was refused; theme ids are taken in any case, in the terminal and the web.

0.52.15

Fixed

• Quitting leaves only the resume line. The screen was left by writing its whole last frame (header, input box, status bar, "Press Ctrl+C again to exit") into the terminal's scrollback, with the line that matters, how to resume, under it. It now just returns the terminal to what it showed before cast started.

0.52.14

Fixed

• A screen that loses its daemon brings it back on the address you chose. An open terminal screen restarts the daemon when it goes away (an upgrade, a crash), and it always did so on a private random port, so the public web address stayed down until you restarted it by hand. It now starts it on the remembered address while that is free, and no longer touches the remembered choice.

0.52.13

Fixed

• A bash row shows its timeout again, and keeps it. Since the move to the new screen the deadline was hidden unless the model had chosen one, so a command cut off after the default 3 minutes gave no warning. Every foreground bash row now ends with * timeout 3m (dim, after the command; the word stays so it is not read as how long the command took), and a long command that is still running is trimmed in the middle of the command, not at the end where the deadline sits. A finished command that wraps now continues under its text instead of at column 0.

0.52.12

Changed

• The web session list says what each session is. An untitled session was named after its persona, so every row read "senior". It now shows "New session" while empty, and each row has the folder and its age. Sessions nobody wrote in are hidden unless open, pinned or running.

• Finished reasoning folds to one line in the web UI (tap to open); it stays open while it streams. On a phone a reply with tool calls was mostly boxes of thought.

• The web composer's role line shows "sandbox" instead of the long sandbox path (the path is in the tooltip).

• The new-session dialog fits a phone on one screen. Persona name and source share a row, so the folder choice and the Create button are no longer below the fold.

• Signing in takes you back to the page you were going to. A link to a session, or a login that expired while you worked, used to land on the empty home page afterwards.

• The web header's two panel buttons look like panels (a window with a left or right bar) instead of two chevrons pointing opposite ways.

• Settings opens with its current tab focused, not "Reload resources" with its tooltip over the tab row.

• The dashboard button is back on phones. It was hidden although the dashboard already fits a phone.

• A file preview fills a phone screen instead of stopping 70px short, and no longer numbers a phantom empty line after the last newline.

• Line numbers in the Changes diff were wrong after the first context line (an added line showed 1 where it was line 2), and context lines had none. A phantom empty line and \ No newline at end of file also showed as context.

• A message with a picture lost its attached documents (only the picture showed) and its Fork and Rewind buttons.

• The plan review card shows the plan. It said only "Plan ready. What next?" over a JSON dump in a collapsed tool row; it now shows the plan's summary and a "Read the plan" button that opens the plan file.

• MCP settings say why a server is not connected (the spawn error, the HTTP failure) instead of just "not connected".

• Settings buttons for hooks, MCP servers and skills say Enable or Disable in words, not a pause or play icon that said nothing on a phone; the reconnect and uninstall icons got accessible names.

• Voice errors tell a denied microphone from a missing or busy one. The settings tab strip scrolls the chosen tab into view.

• A tooltip no longer sits over the page after a click or a file dialog; it shows on hover and for keyboard focus only.

• "1 notes" in project memory reads "1 note".

• "Continue planning" no longer leaves plan mode. It took the approve path on the server: the session went to build while the page still said PLAN, the model could write code, and plan_done stopped being offered. Only approving switches to build now.

• Escape while renaming a session no longer saves the text. The input's blur on the way out committed what Escape was meant to throw away.

• A message queued or steered during a run is no longer lost when you stop it silently. The stop now says which messages were not sent, with their text.

• Looking at an old session no longer moves it to the top. Closing a session (idle eviction, a daemon restart or upgrade) rewrote its time as "now", so every thread you had opened floated up after a restart.

• The saved theme is marked in Settings after a load. A parameter was never passed to the session controller, the call threw inside a promise chain with an empty catch, and no swatch looked selected. A test now checks the wiring.

• A file error ("Already exists") is a line above the list you can dismiss, not a page that pushed the list out of the panel.

Changed

• Motion is one scale. Three durations (instant, fast, base) replace a dozen literals. Dialogs lift in, menus and the command palette drop in, a phone dialog slides up, tool bodies and plan cards fade in, and a press sinks a control slightly. With reduced motion these arrivals just appear and every transition is instant.
• "Loading" shows only after a beat, so a load that finishes at once never flashes the word.
• After a rewind that removes the conversation, the message comes back in the composer to change and send again (unless you are already typing).
• Notices no longer start with a bare "[system]".

Added

• docs/web-ux.md: the map of the browser client (surfaces, flows, responsive rules, decisions).

0.52.11

Fixed

• /continue goes back to this folder's latest session with something in it. It took the newest session of any folder, empty ones included (a /clear or /new that was never used), and could drop you into another project. It now does what cast -c does.
• /copy and copying by selecting text work in more places, and say what happened. /copy knew only xclip and showed the shell's own error ("/bin/sh: 1: xclip: not found"). It now tries pbcopy, wl-copy, xclip, xsel or clip, and over SSH (where a local tool would fill the remote machine's clipboard) or when none is installed asks the terminal itself (OSC 52), saying that it cannot tell whether that arrived. Selecting text with the mouse uses the same path.
• A project's memory lease is taken back at once from a process that is gone. Closing a terminal right after a turn left the lease for five minutes, and every session in that project then reported "Automatic dream scheduling failed: Timed out waiting for project memory lease" for as long.
• A table with many columns stays inside the screen. Columns of a wide table were given their minimum width and the rest shrunk by one common factor, so the sum could exceed the room; the room is now shared out in proportion to how much wider than the minimum each column is. A fuzz test over thousands of random documents at every width from 24 columns up now guards this.
• Ctrl+X writes the draft to a file only you can read (it may hold a secret), says so when it cannot write it, and says when the editor was stopped by a signal instead of "exited with code null".
• Lighter frames while a long answer streams. A frame with no new token (the dots ticking) no longer lays the streamed blocks out again.
• A message the composer refuses stays in it. Pressing Enter on a command during a turn (or while the daemon was away) emptied the composer and, in the same breath, said the text was kept; it also was not in the Up-arrow history. It now goes back into the composer. Ctrl+L, Ctrl+G, Ctrl+X and PageUp no longer act on the draft behind an open question, and Esc can stop a turn while a progress box is up. A first Ctrl+C is forgotten when you type something else, and a first Esc when the turn ends.
• Commands. The command word is case-insensitive (/HELP, /Steer ...); /compact keep auth says the command did not take that instead of "Unknown command /compact. Did you mean /compact?"; a command that throws says so instead of leaving a cleared composer and silence.
• Two questions at once no longer lose one. A permission asked while another picker or /settings was open replaced it, and the replaced command waited for ever (a turn could hang). Questions now stack: the new one is shown at once, the older comes back after it, and answering the same question twice does nothing.
• A turn that fails to start does not leave the screen busy. A prompt blocked by a hook, or a failure while preparing the turn (a full disk, a locked database), left the activity dots running beside an idle status, and the latter left the run marked busy so every later message was queued for ever. The same for a send to a daemon that is away.
• Attached to the daemon, a turn you did not start now shows and ends correctly. Opening cast on a session while a turn was running (or one started from the web) showed only a fragment of the final message, since only the text after you attached had streamed; the history is now read again from the saved session when such a turn ends, and its text streams in the meantime. An error that ends a turn without the usual end event no longer leaves the dots running, and a daemon that came back with nothing running no longer leaves a half-turn and "queued" rows.
• Quitting twice quickly runs the SessionEnd hook once, and it gets time to finish.
• cast upgrade brings the daemon back on the address you chose. It restarted the daemon where it happened to be running, and, since the address of a started daemon is now remembered, would have remembered a private fallback port in place of your public one. It now starts the daemon on the remembered address (the one it was on if there is none) and does not remember anything itself.
• Onboarding says what is missing. Pressing Enter on an empty address or key now explains that it is required instead of silently staying on the step.
• Text from a model, a tool or a file can no longer drive your terminal. An escape sequence in a reply, a tool's output or a skill's description could clear the screen, move the cursor, retitle the window or write your clipboard (OSC 52), and in a permission prompt hide part of the command being asked about. Everything shown from outside is now stripped of escape and control characters, and tabs become spaces so rows are the width the layout thinks they are.
• A huge message or table no longer crashes the screen. A message of a few hundred thousand lines, or a very large table, overflowed the stack; a message of an unexpected shape (an unknown block, no text) took every frame down. Such a message now shows as one quiet row, and the rest of the conversation is drawn.
• Tables with many columns, long words under a heading and multi-line commands fit. A table with more columns than the width can hold is set as rows instead of overflowing; a long word under a heading is split to the narrower line; a finished multi-line bash command is one row under its margin; the minus sign of an edit row has an ASCII form.
• The terminal is handed back on every exit. SIGINT and SIGQUIT left the alternate screen and mouse tracking on; so did an exit during start-up (a failed start, Esc on a first-run question), and its message was lost with the screen. An uncaught exception now ends with the reason printed on the normal screen, and a render error ends the session instead of leaving a frozen screen (the session is saved as it goes).

0.52.10

Fixed

• An MCP server the agent adds is connected at once. Asking cast to add a server meant it wrote mcp.json and the list stayed empty, and the agent had no tools from it, until you ran /reload (and attached to the daemon, even /reload only updated the list, not the agent). When write or edit changes ~/.cast/mcp.json or .cast/mcp.json, the servers are now connected right away: they appear in /mcp, and the agent has their tools on its next turn. /reload in the daemon mode reloads the daemon as well.
• cast upgrade no longer cuts off a turn that is running. It stopped the daemon first and waited afterwards, so a request in progress ended as "Request interrupted — server restarted" with no response. It now asks the daemon whether any session is running a turn and waits for them to finish (up to two minutes) before restarting; if one is still running after that, the daemon stays on the old build and the message says how to restart it later.
• A remembered public address survives the restart in an upgrade. The terminal screen checked whether the remembered port was free in the instant the old daemon was still letting go of it, called it taken, and started a private daemon. It now waits up to six seconds for the port to come free (or for the daemon cast upgrade starts to appear) before it falls back.

0.52.9

Fixed

• A skill the agent installs is a slash command at once. Asking cast to install a skill (from skills.sh, say) put it on disk, but /<skill> appeared in the list only after restarting the terminal screen: the agent reports the install with a skills_changed event, which the web UI handled and the terminal ignored. The terminal now re-reads the skills when it arrives, in both the local and the daemon mode, so the next turn's catalog has it as well.

Added

• Skills complete in the middle of a message. Type / after other text (review it with /fo) and the skills that match open as a list, as they do at the start; Tab inserts one. Only skills are offered there (the commands work only at the start), and Enter sends exactly what you typed unless you moved the highlight with the arrows, so a word or a path that happens to contain a slash is never replaced. A skill named in the middle is plain text the agent reads; it is expanded only when the message starts with it.

0.52.8

Changed

• A public web server stays public. The address you choose with cast server start --public (or --host / --port) is remembered in settings.json, and a daemon started later binds it too: cast server start with no flags, the terminal screen when it has to start the daemon itself, and the restart after cast upgrade. Before, an open cast window answered each stop by starting a private daemon on a random port, so the public one could not be brought back until the window was closed. If the remembered port is taken by something else the terminal screen falls back to a private daemon; cast server stop then cast server start --port 0 forgets the address.

0.52.7

Fixed

• Context and token figures in the status row work when attached to the daemon. ctx 10.5k/168k (6%) and 41.5k in / 27 out never appeared in the default (daemon) mode, because the client ignored the totals and messages the daemon sends when a turn ends. It now takes them over, so both follow each turn as they do without the daemon.
• The length of the last turn stays in the status row. Attached to the daemon (the default), took 5s appeared while the turn ran and vanished the moment it ended, because the status row counted turns from a list that is not filled in on the client. It now counts what the screen shows.

Changed

• The conversation uses more of a wide terminal. Text, code and tool rows follow the terminal's width up to 120 columns (it stopped at 100). The header, composer and status row still use the full width.

0.52.6

Fixed

• The ssh tool answers on its timeout and on Esc. With the connection reuse cast sets up, a sleep 30 with a 2 s timeout reported "TIMED OUT after 2000ms" only after 30 s, because the persistent master held the pipes until the remote command ended. The call now returns half a second after the client is stopped.
• "Show reasoning in the transcript" in /settings showed the wrong value and every second flip did nothing. toggleReasoning handed back the value from before the flip, so the row and the real setting drifted apart. It now returns the new value, and /rd reports the right state too.
• /ssh (and any command hidden from the / list, such as /skills) runs what you typed. Typing /ssh and pressing Enter ran /skills-sh: the list offered fuzzy neighbours of the hidden command and Enter took the first one. A hidden command typed in full now shows no suggestions, so Enter sends it as it is.
• /current shows the working folder row it has had no value for since the folder moved to the status row.

Changed

• /keys, /current, /ssh and /context open in a window you read and close with Esc, instead of leaving a block of text in the conversation. They still print into the chat where there is no window (the plain command line).

0.52.5

Fixed

• The waiting dots after your message line up with the reply text (four columns in) instead of sitting at the two-column tool margin.

0.52.4

Fixed

• /settings keeps your place: coming back from a row that opens its own list (model, provider, reasoning, skills and the like) no longer jumps the cursor to the first row.

Changed

• The top row is just CAST(1) * v<version>. The persona and the model were repeated in the status row at the bottom, which now also shows the working folder (~/pet/cast, dropped first on a narrow screen). /header still brings back the persona, the model and the folder, and a header you have already set up is kept.

0.52.3

Changed

• The start-up and loading box is compact and centred. "Connecting to model…" sat in a box 80–90% of the screen wide with the text at its top-left and an empty row below it. The box now fits its label and is centred on the screen, with the line in the middle of it, one row of air above and below; it never asks for more columns than the screen has.
• The loader is three running dots instead of a braille spinner. Connecting to model and the other waiting boxes show ., .., ... in turn after the label, and so does the row that waits for the model during a turn. The text does not move as the dots change, and it needs no glyph a non-UTF-8 terminal cannot show.
• Pickers and /settings open in the middle of the screen instead of sitting at the bottom, so a list that changes length while you filter keeps its place.
• The browser now shares the terminal's look. The man theme (one ochre accent, quiet greys) is available in the browser and is the fallback before a theme loads, instead of the violet one; the group labels in the sessions list are muted rather than accent-coloured. DESIGN.md now describes both screens.
• Bigger touch targets in the browser sidebar. On a phone the session rows, the search field and "Load more" are 44px tall, and the search field has room above the first date.
• Calmer web chrome. The header's gradient text and the coloured glow around the connection dot are gone; the state is still carried by the dot's colour and its tooltip.
• Tool calls in the browser are one-line rows, like in the terminal: * bash git status, with the name in bold, the main argument muted, … while running and ✗ … failed when it failed. The card, the name chip and the colour-only dot are gone; click a row for the full arguments and the result.
• Browser clean-ups from a design critique. The persona line above the composer is plain bold text instead of accent capitals; the side panel opens on Files instead of an empty Changes tab; the panel tabs, settings controls, modal buttons and login form are 44px tall on a phone; the turn footer uses * between provider, model and time; three off-scale radii and one font size are back on the scale.

0.52.2

Added

• A guide to the terminal screen (docs/terminal-ui.md, "The Terminal Screen" on the docs site): what is on the screen, how to type, scroll and choose, how to fit it to a phone or a wide monitor, colour and plain-terminal settings, and how to get back to a session. Getting Started, Sessions, Interactive Commands and the README link to it, and the text about unknown slash commands is corrected.
• cast shell-init puts cast --resume=<id> in your shell's history when a session ends. Add the function it prints to your shell once (cast shell-init >> ~/.zshrc, or bash, or fish); after you quit, Up brings the command back. A child process cannot write its parent's history, so the function runs the real cast and then reads the command cast leaves in ~/.cast/last-resume. An empty session adds cast --continue; the printed Resume this session: line stays for terminals without the function.

Fixed

• Quitting an empty session printed nothing about how to get back. A session that had a turn still names itself (cast --resume=<id>). One that did not (nothing was said, or the conversation was cleared with /clear or /new, or the daemon under it was restarted by an upgrade) now points to the folder's earlier sessions: cast --continue, or cast --resume to pick. A folder with no history still prints nothing.
• cast upgrade could leave a second daemon running and report "failed to start". If a running cast started its own daemon while the upgrade was restarting the old one, the daemon the upgrade started lost the registration but kept serving on another port, out of reach of cast server status and stop, and the upgrade called that a failure. A daemon started by cast server start that finds another one registered now exits, and the launcher says already running instead of failing.

0.52.1

Fixed

• Opening Skills, MCP or Keybindings from /settings printed YOU /skills in the conversation, although nobody typed it. A command started from the settings screen no longer echoes itself; one typed in the composer still does.

0.52.0

Added

• An ASCII look for terminals that are not UTF-8. With LANG=C (or any set locale that is not UTF-8) or CAST_ASCII=1, the box, arrow and marker glyphs the screen draws are swapped for one-cell ASCII look-alikes on the way out, so the layout holds instead of showing garbage. CAST_ASCII=0 turns it off.
• /header chooses and orders the parts of the top row. The row is now CAST(1) * persona * model * v0.51.1 * folder, joined by one * instead of padding to the edges, which a phone has no room for. Each part can be switched off or moved (also under Appearance in /settings); on a narrow screen the parts at the end drop first, whole. The model shown is the live one, so a /model change shows up.
• cast-light, a theme for light terminals, and NO_COLOR. The new theme keeps the cast hues at 4.5:1 or better on white. With NO_COLOR set, cast draws no colour and relies on markers and words.
• /settings is a settings screen, not a menu of commands. Toggles, the permission mode and the theme change in place (Space, Enter or ← → ) and are saved at once; each row shows what it is set to. Rows that need a list or a prompt (model, provider, persona, turn cap, status bar, skills, MCP) open it and bring the screen back after. Choosing bypass still asks first. /theme, /permissions and /web share the setters, so the screen and the commands cannot disagree.

Removed

• The reduceMotion setting and CAST_REDUCE_MOTION. It existed because Ink's terminal jumped to the bottom on every write; the pi-tui screen keeps its own scroll position, so there is nothing left for it to fix. The settings screen no longer lists it, and the window title no longer shows cast · working Ns.
• The old Ink front end and CAST_TUI=ink. The pi-tui screen has been the default since 0.51.0 and does everything the Ink one did, so the variable is ignored now. ink and the code only it used (the composer, chat log, Ink pickers, terminal-resync and stdin plumbing) are gone from the package; react-reconciler is now a direct dependency because the headless app model runs on it.

Fixed

• Picker footers were cut mid-word and lost the exit key at 46 columns. Footers are now an ordered list of hints, Esc close second, dropped whole from the end; the vocabulary is one set (Enter confirm, Esc close, ↑↓ move), the palette marks the chosen row with ▸ like every other list, and truncation uses one …. A list's filter placeholder sits on the prompt row, and a settings list that scrolls shows where you are (3/24).
• A new session showed the last session's took 9s. The elapsed time is shown only in a session that has had a turn.
• A bash row read (3m) on every call, which looked like how long it took. A timeout is shown only when the model chose one, as (timeout 10m).
• Notices were bracketed at column 1 and phrased two ways. [Cancelled — x] and Cancelled — x are now the same unbracketed notice, aligned with the composer's text.
• The status-bar editor offered left and right for a row that no longer has sides. The row follows the configured order, and the editor drops the side column.
• /help had /rule:: and argument hints glued behind a dash. Arguments now sit next to the command (/worktree <name>, /code-review [range] [-- path…]).
• A session row could run past its date, because the folder column was not cut to its width. Columns are cut with …, and the list title no longer carries (most recent first).
• A # heading and a ## heading looked the same. The top level is now bold and underlined, deeper levels bold.
• /turn-cap did nothing in the terminal screen. The command was listed and documented but had no handler, so /turn-cap 800 was sent to the model as a prompt (and now answered Unknown command). /turn-cap shows the cap, /turn-cap N sets it (10 to 10000), /turn-cap reset or off restores 500; the settings screen row shares the same code.
• /current listed the session twice. The heading row and the Session segment both printed it.
• Blank lines in an answer were padded with the four-column indent, which copied out as trailing spaces. They are empty now.
• Prose ran the whole width of a wide terminal. At 200 columns a paragraph was lines of 190+ characters. The conversation now keeps a measure of at most 100 columns (headings, code and tool rows too); the header, composer and status row still use the full width, and a narrow screen uses all of it.
• The permission question did not show what it was asking about. On a phone the box covered the transcript, and the command was only visible cut off inside the Always allow row. The box now carries the reason and the full command (wrapped, the rest marked), and y, a and n choose Allow once, Always allow and Block at once.
• A session row lost its date on a narrow screen. The first line of the message took the whole row and the date and message count were cut off. They now sit against the right edge and keep their room; the message gives way.
• Footers and the placeholder mixed separators and ran past the edge. Every picker footer now uses * like the header, and the placeholder while a turn runs reads type to steer * esc esc to stop.
• Code was cut off mid-token on a narrow screen. The extra indent of a code block was added after the lines had been wrapped, so a long line ran past the edge and was truncated. The indent is now counted when the line wraps (checked at 32 and 40 columns).
• The banner's gradient ignored the terminal's colour depth. On a terminal without truecolor (macOS Terminal, many SSH clients) the screen used 256 colours but the cast v… wordmark still sent 24-bit codes. It now goes through the same colour path as everything else, and NO_COLOR applies to it.
• Modals showed scraps of the transcript beside them. A picker or the settings screen now covers the full width with its box centred (at most 104 columns), so no half a word shows on either side.
• The banner and the hint line were cut in the middle of a word on a narrow terminal. They now give up whole parts (the folder, then the model; the last hints first) until they fit. The settings screen also trims a long value (a provider URL) rather than the name beside it, and fits its list to a short window so its footer stays visible.
• cast started in a pipe wrote screen control sequences to stdout and exited 0. It now says it needs an interactive terminal, points to cast run, and exits 1.
• /sessions with no saved history reported Cancelled. It says No saved sessions yet.
• Muted text was hard to read. The grey for hints, the placeholder, reasoning and the status separators was under 4.5:1 on 13 of the 18 themes (Nord 1.7:1), and dim lowered it further. Text colours are now lifted to 4.5:1 against the background they sit on, and dim is no longer stacked on them.
• A mistyped /command was sent to the model as a prompt. /nonsense now says Unknown command /nonsense and, when it can, Did you mean /clear. A path such as /tmp/shot.png is still sent as text.
• The elapsed time stayed on the status bar without saying what it was. After a turn it reads took 4s.
• Session rows repeated the folder and wrapped. This directory's list leaves the folder column out, and a row wider than the screen is cut with … instead of wrapping.

Changed

• The status row is one row joined by * (Senior Developer * BUILD * model * ctx 9k/168k (5%) * took 3s), like the header, instead of two groups pushed to the edges.
• Markers are ASCII. List bullets are *, -, + by depth, task boxes [ ] and [x], and the switches in /settings read [x] on and [ ] off, like the checklists in the status bar and header editors.
• /help lists top-level commands only; a sub-command such as /worktree list shows in the palette once its parent is typed.
• /help is built from the same command table as the / palette and fits any width. It was a hand-set text in 80-column columns that broke on a phone and had drifted from the real commands (it listed some settings and missed others). It is now a list that wraps under each command's name, shows every command the palette shows, and points to /settings for the settings.
• The terminal screen is set like a man page, and the default theme is man. Speakers are bold headings (YOU, AGENT, REASONING) with their text at a four-column indent; code is indented four further. The coloured stripe down every line, the gradient wordmark and gradient rules around the composer, the band behind your turns, the accent-coloured boxes and the muted capitals over settings groups are gone. The header reads CAST(1), persona and model, version. State is a mark and a word rather than a colour, and * replaces the middle dot as the separator. Your saved theme is kept; /theme man switches to the new default.
• The context figure is on in the status bar by default, and turns amber at 70% and red at 90% of the input budget. Speech and embedding models sit below the chat models in /model, marked not for chat.
• /sessions (and cast --resume) list this directory's sessions first. The picker opens on the sessions whose folder is the one you are in; Show all sessions (N) on the next row lists every project's, and Only this directory comes back. ←, → or Tab flip between the two views without moving to that row (the footer says so). Search stays inside the scope you are in. When the directory has no sessions yet it shows all of them and says so. Sessions with no messages, which every launch leaves behind, are no longer listed.

Internal

• The always-false Kitty-protocol flag and its setter are gone from the key matcher, about 45 comments that still described the Ink renderer now describe the current one, and .impeccable/hook.cache.json and the critique snapshots are git-ignored while the direction contract stays tracked.

0.51.1

Added

• /settings. One menu over the settings that used to be separate commands (model, provider, persona, permissions, reasoning, theme, status bar, web tools, skills, MCP servers, memory, turn cap, keybindings), each row showing its current value on the right. Enter opens that setting's own picker. It also opens while a turn runs.

Fixed

• A question tool call showed its whole form as JSON in the transcript. The row now says how many questions were asked and what the first one is (2 questions: Which database?).
• A skill whose text used $ARGUMENTS showed as a bare /name in the thread. The arguments you typed now ride on the skill tag (arguments="…"), so the thread shows /name your arguments however the skill used them, in the terminal UI and the web UI.
• The bands and highlights in the terminal UI follow the terminal, not the theme. The band behind the person's turns and the highlight on a list row were the theme's own surface colours, which put a dark stripe under dark text on a light terminal. They are now the terminal's background nudged toward its foreground (asked of the terminal at start), and are left out where the terminal does not answer.

Changed

• A more finished look for the terminal UI. A blank row between the person's turns and the agent's, the person's turns on a band, a bold speaker label, the brand gradient along the composer's edges, a persona and mode in colour in the status row, the running tool's rail in the accent colour, a themed scrollbar, and a banner with the persona, model and folder. In pickers the highlighted row sits on a band with a ▸ marker, and a row can carry a hint (a setting's value) against its right edge.
• The / palette no longer lists the commands that only change a setting. /settings reaches every one of them (/model, /provider, /persona, /permissions, /reasoning, /theme, /statusbar, /web, /skills, /mcp, /memory, /turn-cap, /keys, the plan and subagent model commands, /ssh). They still run when typed in full, with or without an argument, and /help still lists them.

0.51.0

Added

• reduceMotion for a terminal that jumps to the bottom on every repaint. With "reduceMotion": true in settings.json (or CAST_REDUCE_MOTION=1) the TUI draws no animation: the spinner stays still and the counter does not tick, so during a turn nothing is written to the terminal between real changes (measured: one screen change in six seconds instead of about seven) and scrolling up is left alone. The window title carries the sign of life instead (cast · working 12s, every second), since a title is not screen content.

Changed

• The terminal UI runs on pi-tui and keeps its own scroll position. The conversation is one document in a full-screen viewport the app owns, so output that arrives while you read no longer pulls you to the bottom, a repaint cannot leave a stale copy of a row, and there is no live region to outgrow the window. The wheel, trackpad, PageUp/PageDown, Home/End and Ctrl+Shift+F search move through it; a ↓ newest label returns you to the end. The behaviour underneath (commands, plan mode, pickers, subagent viewer, confirmations, image attach, external editor, key overrides) is the same code, now running headless with the new screen drawing what it produces. CAST_TUI=ink starts the older Ink front end; CAST_NO_MOUSE=1 leaves the mouse to the terminal.

• The TUI repaints about four times less while a turn runs. The spinner and the elapsed counter ticked at 8 frames a second, and a terminal jumps back to the bottom on every write, so scrolling up during a turn was undone within a frame. The clock is now 2 frames a second and the counter shows whole seconds (41s).

• Open, Stop and Back are 40px tall on touch screens (and under 768px), up from about 20-27px.

Fixed

• A line could be drawn twice in the TUI while a command ran. A running bash row with a long command wrapped to four lines in the live region, which the layout counts as one, so the region outgrew the terminal and Ink left stale copies of the rows below it (the status bar, the spinner). A running tool row is now one truncated line; the full command is wrapped once the turn is committed.
• The subagent viewer said "running" for up to two seconds after the subagent had answered. It now reads the saved final answer too.
• A /skill command filled the TUI thread with the whole SKILL.md. The model has to receive the skill's text, but the thread showed it as if the person had typed it. The TUI now shows what was typed (/name args), as the web UI already did.
• Skills did not suggest their arguments. A skill's argument-hint was read and never shown. The / palette (TUI and web) now lists it after the skill's name, and the TUI shows it under the composer once /name is typed.

0.50.5

Fixed

• A subagent opened while it worked showed nothing of its work so far. Its saved copy was updated only at the end of each model turn, so a child opened mid-tool-call (web Open, TUI Watch) showed the assignment and nothing else until it finished. It is now saved on every change to its messages.
• A card for a subagent stopped while queued stayed "queued". The stop worked, but the card was never told. It now shows cancelled.

0.50.4

Added

• Watch a subagent live in the TUI, and come back. /agents now works while a turn is running. Pick a subagent and Watch it: its session (the assignment, each tool call, the report) refreshes every second and follows the newest lines; ↑↓/PgUp/PgDn scroll, s stops a running one, Esc returns to the thread. In the web UI the task card's Open does the same, with a banner to go back.

Fixed

• A subagent was invisible until its first model turn ended, and a queued one for much longer. Its session was saved only after that, so /agents said "No subagents" and Open had nothing to show while it ran a long first command; with more than four in one response, the rest were missing from the list until a slot freed up. A subagent is now saved when it starts, and one waiting for a slot shows as queued (◌ in /agents, queued on the web card and in the API's queued field). A queued one can be stopped like a running one.

0.50.3

Fixed

• glob and grep found nothing in dot-directories. With fd and rg installed, .github/*, .githooks/* and **/*.yaml returned "No files found" for files that were right there, because both tools skip hidden paths by default (the built-in fallback, used without them, did list them). This is what sent a subagent into a loop of empty globs. Both now search hidden paths and still skip .git.

• A subagent could keep repeating the same empty result until cancelled. An explore subagent ran 335 model calls of parallel globs that all found nothing, and the "same output again" reminder, shown about 490 times, changed nothing; the iteration cap counts model calls, not tool calls, so it never came near. A tool that returns the same output 100 times in a turn now ends the turn (bash_output polling is exempt), and a subagent has its own budget of 150 model calls instead of the parent's 500.

• /quit did not print the command to resume the session. Ink redraws its last frame on exit and erased the line, so only Ctrl+C left cast --resume=<id> on screen. The frame is now unmounted first, and the line prints once on every way out.

0.50.2

Fixed

• The TUI could stay on "Daemon connection lost" for good. The reconnect attempt ran once per stream; if the daemon was not back yet, nothing retried. A failed attempt now re-arms, so the next retry of the stream tries again.

0.50.1

Fixed

• Abort listeners piled up in long turns. Every batch of tool calls added an abort listener to the turn's signal and never removed it, so a turn with hundreds of tool rounds kept every batch's results alive and ended in MaxListenersExceededWarning: 101 abort listeners. The listener is now removed when the batch settles.
• A finished background job could crash the server. When a background command exited after its session was gone, waking the session threw Session not found as an unhandled rejection and killed the daemon (and with it every other session). Those follow-up submits are now logged instead of thrown, and the server and the TUI both have an unhandledRejection handler as a last net (the TUI writes to ~/.cast/tui-errors.log and stays up).

0.50.0

Added

• A fork can take the files of its point. Forking from an earlier point used to share the working folder, so the fork's conversation talked about files that had moved on. Every turn now records which message it started with, and forking from an earlier point (web UI and TUI) offers the fork its own copy of the files as they were then: a git worktree at that turn's snapshot in a repository, or a copy of the snapshot in a new sandbox folder outside git. Files git ignores (node_modules, build output) are not in a snapshot, and older sessions, whose turns did not record this, fork into the shared folder as before. The fork endpoint takes withFiles, and GET /sessions/{id}/fork-preview says beforehand whether it can.
• Fork from an answer. In the web UI, an answer of the agent that ends a turn has a "Fork from here" button that starts a new session with the conversation up to and including that answer, so you can carry on from the answer instead of from the question after it. Until now only your own messages could be fork points ("fork before this message", now labelled as such). An answer that calls tools is not a point, since the cut would separate the call from its result. The fork endpoint takes afterSeq, and /fork after <seq> does the same. Forking from an earlier point now says that the two sessions share the working folder, so the files are as they are now.
• /rewind: go back to before any message, and choose what goes back. /undo only ever took the last turn. Every turn now records a snapshot of the folder and the message it started with, so you can pick any of your messages and rewind the files and the conversation, only the files (the conversation and every snapshot stay, so the files can go forward again), or only the conversation. The TUI has a /rewind picker; in the web UI each such message has a Rewind button that opens a dialog naming what each choice does and which files would be deleted. GET /sessions/{id}/rewind-points, GET .../rewind?userSeq= and POST .../rewind are the API. Sessions from before this version recorded no per-message snapshots and keep /undo only. A typed /undo in the web UI opens a dialog that says which message goes, how the files come back and what will be deleted, then asks; GET /sessions/{id}/undo returns the same preview.

Fixed

• An undone turn came back after a reload. /undo (in the TUI and the web UI) rewound the files and removed the turn from the conversation in memory only: the saved history was never shortened, so the turn, its replies and its search hits reappeared on the next page load or restart while the files stayed rewound. The messages are now deleted from the store as well.
• /undo no longer stalls the daemon. Checking what it would delete and restoring took 73 and 117ms on a 30 000-file repository, synchronously, with every session waiting; both are async now. A message sent while an undo is rewinding the folder waits instead of starting a turn on it.
• /undo restored less than it claimed. In a git repository it did not bring back a file that git ignores (.env, build output) and that the agent had edited or created with edit/write, nor a file outside a subfolder session's directory; both are now backed up and restored. Its snapshot was a commit that nothing pointed to, so git gc deleted it after two weeks and /undo on an older session failed; each snapshot now has a ref under refs/cast/checkpoints/, released when it is restored or the session is deleted. A failed restore in the daemon also dropped the checkpoint from memory, so a second try said there was nothing to undo until a restart.
• /undo outside git now undoes shell commands too. Without git it only had a copy of each file edit and write touched, so sed -i, rm, mv or a generator stayed applied, and the message said "Restored 3 file(s)" anyway; sandbox sessions, the default start in the web UI, are never repositories. The folder is now committed each turn to a hidden repository under ~/.cast/shadow (deduplicated by git, so a turn that changed one file costs one file), and /undo restores it, including files a command created or deleted; dependency and build folders (node_modules, dist, ...) are left alone. Folders over 3000 files or 50MB, the home directory and / are not snapshotted, and /undo there says that shell changes are not undone. The hidden repository is deleted with the session.

Changed

• Clearer, touch-friendly message actions. The buttons on your messages now say what they do ("Fork before", "Rewind") instead of being unlabelled icons, which a phone has no tooltip to explain; on touch screens they are 44px or more to tap (they were 20px), with room between the rows. The undo dialog no longer counts raw messages (tool calls included), it says your message and everything the agent did after it are removed.

0.49.0

Added

• A file explorer you can work in. The web Files tab now creates files and folders (a/b/c.txt makes the folders too), uploads files with a progress bar (a button, or drop them on the tree or on a folder), moves items by dragging them onto a folder, and deletes several at once (Ctrl/Cmd-click to select). Uploading over an existing file asks first, and renaming or moving onto an existing name is refused instead of overwriting it. Long folders load 1000 entries at a time with "Show more", git-ignored entries are dimmed, and the search can include ignored files. A search that hit its limit says "Showing 200 of 30000". Download supports byte ranges, so video and audio seek, and a folder downloads as a .tar.gz. The panel button is now "Files and changes".
• API. POST /fs/create, /fs/move, /fs/delete (several paths, each reported on its own), PUT /fs/upload and PUT /inputs/upload (the file as the raw request body, up to 1 GiB), GET /diff/file, and offset/limit/hasMore on GET /fs. They are in the OpenAPI document.

Fixed

• The daemon no longer freezes while you browse files. Listing a folder, searching, the @ file picker, deleting, uploading, downloading, the Changes tab and /repo ran synchronous file and git calls on the one thread that serves every session, so a big folder froze all of them (a 20 000-file delete stalled the daemon for 270ms, a 30 000-entry folder for 200ms, the @ picker for 90ms). Everything now runs in child processes or async calls with bounded concurrency; the worst stall in a probe run of 19 file operations on a 30 000-file repository is under 100ms.
• Search finds files in ignored and huge folders. It used to skip any folder named like node_modules or dist and silently cut the list at a few thousand entries. It now uses git's own file list (untracked files included, deleted ones dropped), matches every word of the query against the whole path, and reports the total. The list refreshes as soon as a tool, the watcher or the explorer changes files.
• The Changes tab on a large change. With 20 000 deleted files /diff took 132s. It now lists everything, diffs the first 200 files (tracked changes first) and loads the rest on click.
• Escape in the explorer's rename field saved the typed name instead of cancelling, because the input's blur committed it.
• Watching a big project no longer freezes the daemon. When a session went idle the file watcher (chokidar) put a watch on every file and stated each one on the thread that serves every session: 2.2s of stalls on this repository, 3.5s and 32 000 watches on a 30 000-file project, with two agents working on it the daemon stalled 100 to 470ms at a time for seconds. It now watches directories, listed from git instead of walked (66 folders here, 443 on the big project), and picks up new folders through their parent: 22ms to start here and 184ms on the big project, no stalls in a live two-agent run. It watches at most 4 000 folders, well under Linux's usual inotify limit, and a folder it can't watch is skipped rather than killing the watcher. The chokidar dependency is gone.
• The session list and the sidebar search no longer stall the daemon. Building the list of 888 sessions took 85ms in-thread, and every keystroke in the sidebar search 15 to 285ms (the one-letter prefix "f" took 237ms), each with every session stalled for that long, and the cost grows with the history. They now run on the sqlite worker; the thread is held for 11 to 18ms. The ten-minute WAL check also built the whole list only to ask whether a turn was running; it now asks the live sessions.
• session_history answers real questions better. The session that is asking is left out of the results: its own question matched its own words and took three of the eight slots. Russian function words of one or two letters ("по", "в", "на") no longer count as search terms, since OR-ed in they matched almost every message. A model that cannot find what it wants used to reword the query 50 times in a row; a turn now gets 8 history searches, and the tool then tells the model to answer from what it found or say it is not in the history.
• session_history no longer freezes the daemon. The search over past sessions ran synchronously on the thread that serves every session: 80ms to 280ms on a 370MB store, with all sessions, the web UI and every stream stalled for that long. It now runs on a worker thread with its own read-only connection (and falls back to the old in-thread search if the worker fails), so the event loop stays free.
• session_history no longer floods the answer with one session. A word one session repeats used to fill all 8 results with near-copies of it ("sandbox" on a real store: 8 rows from a single session). At most 2 rows per session are kept, so 5 different sessions answer instead. The tool also said "default 10" while it has always returned at most 8; it now says 8.
• New session in the web UI ignored the chosen folder. The New session dialog got the default persona as an object instead of its name, so creating the session dropped both the persona and the folder you picked and opened it in your home directory. It now opens in the folder you chose.
• Deleting a session no longer blocks on removing its uploaded attachments.

Changed

• The web UI's blank start is a sandbox, not your home directory. Opening the page (or deleting the last session) and just typing used to start the session in the folder the daemon was launched from, usually your home directory, with the agent able to reach everything in it. It now starts in a throwaway sandbox, like the lightning button; pick a folder in New session to work on a project.
• Readable text on a phone. The web UI's root size was 87.5% of the browser's (14px), so on a phone the chat text was 12.6px, secondary text 11.2px and small labels 10px: under Apple's 11pt floor and Material's 14sp body. On touch screens up to 768px wide it now follows the browser's own size: chat text 14.4px, secondary 12.8px, labels 11.5px. It is still a percentage, so the browser's or Android's text size setting and the Scale in Settings keep working.
• A smaller message box on a phone. The web composer took ~100px of the screen: three 44px buttons left the field 176px wide, and its font was forced to 16px everywhere. The buttons keep a 44px touch target but look 36px, the padding is tighter (the box is 50px, the field 238px wide), and the 16px floor now applies only on iOS, where a smaller font makes the page zoom on focus. On Android the field uses the chat's own text size.

0.48.0

Added

• Language servers. After every edit and write, cast asks the project's language server about the file and adds the errors the change introduced to the result, including other open files it broke, so the model fixes them in the same turn without running a build. Errors that were already there are counted, not listed. The new lsp tool asks the same servers: definition, type definition, implementation, references, hover, file outline, workspace symbols, call hierarchy and diagnostics, 1-based, with the line of code. About 40 languages work out of the box: TypeScript (including TypeScript 7's own server), Python (pyright), ESLint, Go, Rust, C/C++ and more; npm servers install into ~/.cast/lsp on first use and clangd, lua-language-server, zls, texlab, tinymist and rust-analyzer download from their GitHub releases (lspAutoInstall: false stops that). /lsp and cast lsp show and query them, the web UI's Status window lists them, and the TUI has an optional /statusbar segment. lsp: false or CAST_LSP=off turns it all off; lspServers adds or overrides a server.
• Fork from any point. /fork asks where from: the whole session, or before any message you sent, with the full conversation up to there, even what compaction had summarized. The web UI has a fork button on each of your messages, and the API takes beforeSeq.
• The request log. Every request cast sends to the model is stored exactly as it went out (system prompt, reminders, history after compaction, tools, retries, usage and the raw answer), so a bad turn can be replayed as it happened. cast requests <session> [n] reads it; it goes with its session.

Changed

• Faster TUI start. The saved model is checked with a real request at most once a day per provider, key and model, not on every launch (a rejected key or model makes the next launch check again); the model's details load alongside that check, and the launchers keep Node's compile cache. On a slow provider, from ~10s to ~2s.
• A lighter TUI while the model works. The spinners and the elapsed time tick on one clock: half the frames and half the CPU while waiting for an answer. A status bar too wide for the terminal drops whole segments, least useful first, instead of cutting off the mode and model.

Fixed

• A slow agent through tool calls. The model catalog (~5MB) was read and parsed on every request to estimate its cost: over half of cast's CPU in a run of tool calls. It is now parsed once.
• cast --resume <id> opened the session picker and then sent the id to the model as the first message; it now resumes that session.

0.47.1

Changed

• Long tool output costs less context. A bash result shows the model at most 32000 characters, its start and end, cut on line breaks with the cut marked; before, up to 128KB went in and stayed in every later request. read stops at 50KB and says which offset continues, and a line past 2000 characters (a minified bundle, a JSON dump) is cut with its length noted. The full bash output is still saved to a file the result names. Setting maxToolOutputBytes yourself restores your own limit for both.

Fixed

• The same instructions load once. An AGENTS.md/CLAUDE.md whose text is already loaded from another level (~/.cast/ and ~/, a symlink, a package that copied the root file) is skipped instead of being sent twice with every request.

0.47.0

Added

• Claude Code skills load too. Skills in ~/.claude/skills show up everywhere, and a trusted project's .claude/skills loads after .cast/skills and .agents/skills.
• Whole skill sources can be switched off. /skills sources (or Settings → Skills → Sources in the web UI) turns builtin, cast, agents or Claude Code skills off and on; the slash palette updates at once. Saved as disabledSkillSources.

Fixed

• Symlinked skills load. A skill directory or SKILL.md that is a symlink, as npx skills add creates, was skipped. Dangling links and link loops are ignored.
• A persona without the skill tool no longer gets a skill listing in its prompt.

0.46.0

Added

• File tools ask before leaving the project. A read, write, edit, ls, glob or grep outside the session's directory and its project root asks first, following symlinks. Allow or wall off directories with external_directory(<glob>) rules; "Always allow" saves the directory. Cast's own memory, saved tool output, uploads and skills stay open.
• --dangerously-skip-permissions works as the same flag as --bypass-permissions, as in Claude Code. Deny rules still apply.
• A silent provider is reported. After 60 seconds without a byte, cast says it is still waiting and when it will retry.

Fixed

• The agent no longer wanders into another repository. Asked to "commit my changes", it could commit in a different project: its shell inherited the directory you were in before, and the system prompt named cast's install directory a dozen times. Both are gone.
• Several cast runs started at once all work. Some failed with "cast run requires the server daemon" while the daemon was still starting. The TUI had the same limit.
• cast run no longer hangs on a confirmation. A dangerous command or an ask rule is refused at once, with the reason, instead of after five minutes.
• A stuck check stops being repeated. When the same tool output comes back again and again, the agent is told that repeating it won't help, and to try something else or say what is blocking it.
• The senior persona commits only when you ask.
• edit and write accept each other's path argument.

0.45.1

Fixed

• A prompt waiting for your answer is never lost. A confirmation (a dangerous command, or an ask permission rule) now comes back after you reload the page, reopen the TUI, or restart cast. If cast stopped before you answered, the prompt says how long ago it was asked, and approving it lets the agent pick the step up again without asking twice. Answering in one window closes the prompt everywhere else, and sending a new message instead drops it. Questions and plan approvals come back the same way.
• Quitting the TUI mid-turn no longer loses the turn. Without the daemon, cast only saved a turn when it ended, so quitting or crashing midway dropped your message and everything that had run.
• Esc no longer leaves the turn waiting on an open confirmation for five minutes.

Changed

• The built-in cast skill is up to date with the current TUI, commands and skill format, and explains permission rules and settings, so you can ask the agent to set them up.

0.45.0

Added

• Permission rules. permissions in settings lets you allow, ask about or deny tool calls by tool and pattern: bash(git push*), write(.env*), mcp_github_*. Deny wins over everything, in bypass mode too. Always allow in the confirmation prompt saves an exact rule, so the same call isn't asked about again. Works in the TUI, the web UI and for subagents.
• Cut output is saved to a file. When a command's output is too long for the tool result, the whole of it goes to ~/.cast/tool-output/ and the agent is told where, so it reads the part it needs instead of running the command again. Covers bash, background tasks and ssh.
• Auto-format after write and edit. If the project has biome, prettier, ruff or gofmt configured and installed, cast formats each file the agent writes, and tells the agent to re-read it. Turn it off with autoFormat: false. The hooks docs have a recipe for a type check after every edit.
• @ file picker. Type @ in the composer, TUI or web, to fuzzy-search project files and insert a path. It respects .gitignore.
• Notifications when you're away. The TUI sends a terminal notification and a bell when a turn ends or needs approval while the terminal window is out of focus. The web UI also notifies on approval requests, and asks for permission when you first send a message.
• Edit the prompt in your editor. Ctrl+X opens the draft in $VISUAL or $EDITOR. TUI keys can be remapped with keybindings in settings, and /keys shows the keys in effect.

Fixed

• Background and TUI commands no longer lose the end of a large output. A command that printed a few KB and exited at once often came back cut short.
• A PostToolUse hook's additionalContext now reaches the agent, as documented.
• The web UI shows the dangerous-command confirmation while the turn waits for it. The card only appeared when no turn was running, so the command sat blocked until it timed out.

0.44.1

Fixed

• Background commands report done right away again. Since 0.43.2 every background bash task waited an extra fifth of a second after it finished before cast noticed, and longer on a busy machine. It is back to a few milliseconds, and output written just before the exit is still kept.

0.44.0

Added

• A second opinion before a goal closes. When the agent marks a /goal complete, an independent check reads the objective, the agent's evidence and what its tools actually returned. It can send the close back once, naming what's missing.
• goal on the chat API starts a real goal, the same as /goal: the objective persists and drives later turns until the agent closes it.

Fixed

• A goal that runs out of iterations stays open. Hitting the turn's iteration budget used to spend all of the goal's continuations in an instant and mark it budget-limited, leaving unanswered messages behind. The turn now just ends and your next message carries on.
• /goal N respects N in the TUI without a daemon. It ran with the 500-step safety cap instead.
• A goal stops pushing when nothing changes. Two passes in a row that did nothing now pause the drive and wait for you, instead of burning the rest of the budget.
• A provider failure pauses the goal, like Esc does, so the next turn re-checks the files before building on a half-finished step.
• /goal clear and /goal edit take effect right away, even in the middle of a turn.
• Your reply starts the blocker count over, so an earlier stuck spell no longer counts toward giving up after you've helped.
• Plan mode is left alone by an active goal, which no longer pushes the turn on while the plan waits for your approval.
• /goal status reads the same in the web UI and the TUI, and deleting a session deletes its goal.

0.43.2

Fixed

• Background commands no longer lose the end of their output. When a background bash command finished on a busy machine, output it printed just before exiting could be dropped, so the agent saw a cut-off result. It now waits for the terminal to deliver everything the command wrote.

0.43.0

Added

• Subagents run in parallel. Several task calls in one reply now work at the same time (up to 4 per session) instead of one after another.
• Follow up with a subagent. Each subagent is kept as a session of its own. The agent can ask it a follow-up or have it fix its work with task_id, and it continues with its full history instead of starting over.
• Background subagents. With background: true a subagent works on while the conversation goes on; its report arrives as a message when it finishes, and starts a new turn if the session is idle.
• Watch subagents work. In the web UI a task card shows what the subagent is doing right now; Open shows its session (view only), Stop ends it. In the TUI a running task row shows the current step, and /agents lists the session's subagents: see one's steps and report, or stop it.
• Custom subagents load from ~/.cast/subagents/ and a trusted project's .cast/subagents/.
• The default senior persona can delegate — for wide exploration, independent areas in parallel, and independent review.

Fixed

• The explore subagent really is read-only. It had full bash and was only asked not to change anything; now it can't write or edit, and bash is inspection-only.
• A persona switched in the TUI takes effect when a daemon is attached. The daemon kept running the thread under its old persona and saved that back over the switch.
• "Write exactly X" writes exactly X. Some models added a trailing newline the user never asked for.

0.42.0

Added

• cast can create personas for you. Ask it for a new persona, role or assistant style and it saves one with the new persona_create tool: its prompt and, if you want, limits on tools, skills and MCP servers. The persona shows up at once in /persona and the persona pickers of the web UI and the TUI, with no /reload. Ask it to switch and a new session with the persona opens when the turn ends, so the role starts from a clean context; ask it to keep this conversation and the current session switches from your next message instead. The tool isn't offered in plan mode.

Fixed

• The web UI sees persona files as soon as they're saved. The daemon kept the persona list from startup, so a persona added or edited on disk stayed missing from the pickers until /reload.

0.41.1

Fixed

• A provider that stops answering no longer hangs the turn. If a provider sent the start of a response and then went quiet without closing the connection, the turn stayed "running" until you pressed Esc. Now, after 180 seconds with no data (CAST_STREAM_IDLE_TIMEOUT_MS to change it), cast retries if nothing had arrived yet. If the answer had already started, the turn ends with "Provider sent nothing for 180s", which you can retry.
• A turn in a big repository no longer freezes cast. Every turn saves a snapshot for /undo, and that snapshot ran git while blocking everything else: every session, the web UI and the TUI waited. On a 20,000-file repository that was about 0.4s per turn. The snapshot now runs in the background and is about ten times faster: it reuses git's file cache instead of hashing every file again. On a machine where git has no user name configured, these snapshots used to fail silently; they now work.
• Long answers stream smoothly in the web UI. Every update re-rendered the whole answer so far, so a long reply kept the page busy for most of the stream. On a slow CPU it dropped to about 5 frames a second. Only the part still being written is re-rendered now. The finished answer appears without a pause, and a long code block no longer slows the stream down.
• Big threads open faster in the web UI. History loads 15 turns at a time and shows the newest messages first. A thread whose first page doesn't fill the screen now loads older turns on its own; before, you couldn't scroll up to them.
• The TUI uses about half the CPU while streaming. Release builds ran React's development build, and the TUI redrew the screen for almost every piece of streamed text. Opening a large session is also faster, 2.8s down to 1.9s in our measurement.
• Long sessions respond faster. Saving no longer re-writes details of every earlier reply each time.

0.41.0

Fixed

• Saving a long session is cheap again. Every save used to rewrite the reasoning of every earlier reply: on 400–600 message sessions that was about 200–260 database writes per save, and it grew with the session. Each save now writes only what changed, about 11 rows and roughly a millisecond, however long the session is.
• Reasoning stays with the reply it belongs to. After a compaction, or when a session was reopened, reasoning could be saved onto a neighbouring message, including your own messages and tool results. That no longer happens, and the upgrade clears reasoning that had landed on the wrong messages.
• Finished background agents no longer keep a copy of the conversation. Each one kept the full transcript it started from, about 56MB on one real store, and a running one rewrote that copy every 15 seconds. The upgrade clears the old copies. Run VACUUM on the sessions database with the daemon stopped if you want the file itself to shrink.
• Compaction is counted correctly. The summarizing call now appears under its own kind in the dashboard, including after a manual /compact in the web UI, where its cost used to be missing from the totals. It no longer stands in for the session's context size, and the size is reset after a compaction, so the next turn doesn't compact again right away.
• Turn metrics include every turn. Turns started from cast run, the API or a retry are now grouped as turns too, along with their retries and errors.

0.40.1

Fixed

• Voice messages can actually record. The server told browsers the page may not use the microphone, so on a real phone or laptop the voice button failed before any permission prompt. A device with no microphone now says so instead of reporting that access was denied.

0.40.0

Added

• Voice messages in the web UI. With a model that accepts audio, such as mimo-v2.6-flash or -pro, a microphone button sits next to the attachment clip. Record, listen back, and send: the model gets your voice itself, with no transcription step in between, and replies or calls tools as it would to typed text. For a text-only model the button isn't shown and the server refuses voice notes. Voice notes stay in the thread as players after a reload. The browser only opens the microphone over HTTPS or on localhost, so a daemon reached over plain http needs an HTTPS proxy in front for this to work.

Fixed

• On a phone, the question card's "Or your own answer…" hint is the same size as the options. It used to be noticeably bigger.

0.39.0

Added

• The agent can install a skill and use it right away. Ask it to install one (from skills.sh or a local path) and the new skill_install tool installs it, asking first like a shell command does. The skill works in the same turn, and in the web UI its slash command and completion hints show up immediately, with no restart. A /skill invocation reads in the thread as the command you typed, not the whole SKILL.md.

Fixed

• Long sessions stop paying for their whole history again. Measured on mimo-v2.6-flash against 0.38.0:
  • Each todo_write rewrote the system prompt, and the provider cache fell from 100% to 0-14% on the next request. It now stays at 99%.
  • A session reopened after a restart sent the persona prompt twice. It now sends it once.
  • On OpenRouter, the cache point now moves forward through tool calls. It used to stay on your message, so every tool result in the turn was billed again on each request.
• @rule mentions stick. A mentioned rule dropped out after the agent read an image and was gone on the next turn. It now stays for the rest of the session, the way glob rules do.
• Compaction keeps your instructions. The summarizer only saw the first 500 characters of each of your messages and had a 2000-token budget, so a requirement at the end of a long message was missing from the summary. It now sees up to 8000 characters of each message and has an 8000-token budget.
• The web UI compacts against the session's own model. Every session used the context window of the model the server started with, so a session on a larger model compacted on every turn.
• Compaction in the middle of a turn triggers on time. Its size estimate left out tool definitions and counted images as a few tokens, so a large tool result could push past the limit unnoticed.
• Editors over ACP get project rules, nested AGENTS.md files and the date change. None of them reached the model on that path before.

0.38.0

Added

• Retry a failed or stopped turn. A turn that ended in an error or was stopped by hand now shows Retry turn in the web UI. It runs the turn again from the saved history without resending your message: a turn that failed before replying picks up from your prompt, and a stopped one continues from where it was cut off. Also POST /api/sessions/:id/retry (and /api/v1), which answers 409 when the last turn ended normally.
• Retries, errors and aborts stay in the thread. They are saved with the session and shown in the history at the point they happened, so they survive a reload and read the same on any device. Consecutive provider retries collapse into one row listing every attempt with its reason, and that row stays after the reply arrives instead of disappearing. They are kept when old session telemetry is pruned.

Fixed

• Stopping a turn or hitting an error no longer wipes the transcript. Error rows, retry rows and "Run aborted" vanished a moment after appearing: the history refresh at the end of every turn dropped anything the browser had added itself, and it fired on almost every turn because it compared message counts that were never counted the same way. What had already streamed was also discarded when a turn ended without its final message. Measured on a mock provider against 0.37.0: a 400 error never stayed visible, and "Run aborted" was gone after every stop.
• A new retry could rewrite an earlier turn's retry row, and scrolling up then refreshing the latest page dropped system notices from the part already loaded.

Internal

• The eval scoreboard keeps one row per model and reasoning level; certifying a model with and without reasoning used to overwrite the first run. mimo-v2.6-flash and -pro are certified at 92.9% with reasoning, flash at 88.1% without.

0.37.0

Web UI, measured end to end in Chromium on desktop and on an emulated touch phone.

Fixed

• The web UI can be used from the keyboard. Every button had its focus ring removed, and session rows, folders, the file tree and the changed-files list only reacted to a mouse click, so from the keyboard you could not switch sessions or leave the starting directory in the folder picker. Focus is visible again, those rows answer Enter and Space, Escape closes the dialog on top (Share, New session and confirm dialogs had none), and hidden panels drop out of the Tab order.
• Panels can be resized from the keyboard. The sidebar and workspace dividers are focusable: arrows move them, Shift for bigger steps, Home and End to the limits.
• Screen readers hear what changes. The end of a reply, connection trouble, toasts and errors are announced; switches, tabs and toggles say their name and state; the command palette reports the highlighted command; fields have labels; dialogs have headings.
• Themed buttons are readable. Labels on accent-filled buttons were always white, down to 1.6:1 on the default theme. That label, and secondary and dimmed text, are now derived from each theme so every one of the 18 palettes meets WCAG AA.
• Pinch zoom works on phones, and iOS no longer zooms into the message field. Buttons are at least 44px on touch screens, and the controls that only appeared on hover (the session menu, copy code, file actions) show on any touch device, including an iPad in landscape.
• Long sessions stay fast. On a 400-turn session, opening a dialog or toggling a panel took 197 ms and dragging a panel edge 411 ms per frame; now 11 ms and 23 ms. Settled messages no longer re-render on unrelated changes, and every finished reply was being kept laid out even off screen.
• Diffs mark added and removed lines with + and -, not only a tint.

Changed

• Bold text uses real bold faces. All six fonts ship a true 600 weight (Latin and Cyrillic, loaded only for the text on screen) instead of the browser's smeared synthetic bold.
• Text sizes follow one scale with a 10px floor, and respect a larger default font size set in the browser.
• Reduced motion is respected everywhere: nothing slides, rotates or pulses, while fades and state colors stay.

0.36.4

Fixed

• A code review skipped hand-maintained vendored code. The noise filter dropped everything under vendor/ and third_party/ along with node_modules and dist, but those are not the same thing: an installed package arrives from a package manager, while vendored code is checked in and then edited by hand. Measured on chalk, whose fix lives in source/vendor/supports-color/: one review was left with nothing in scope at all and answered "no reviewable changes", and another saw only the readme and the tests. With the filter narrowed to installed and generated directories, the first case now finds the defect on every attempt.

0.36.3

Tooling only, no user-facing change: evals/review-bench/ measures /code-review on merged bug-fix pull requests with the fix reversed back out, so the planted defect's position is known and recall can be counted instead of judged.

Two things it established straight away. Two runs of the same build score 10/16 and 12/16 with four cases flipping, so a configuration has to be repeated before its numbers mean anything. And two candidate improvements — putting the diff in the brief, and telling the reviewer to re-read a line before quoting it — were both measured and both dropped: neither moved recall, the inline diff halved the number of findings, and the position check that re-reading was meant to help was already dropping nothing on all sixteen cases.

0.36.2

Fixed

• A code review could not correct findings the position check rejected. The first review_report closed the review, so a model told that its findings were unlocatable had nowhere to send the corrected ones — it got "no code review is open". Found on a real 45-file review where all four findings were dropped as unlocatable, which is exactly the case the check exists for. The scope now stays open until the turn ends, however many submissions that takes.

0.36.1

Tests only: the TUI /code-review route shipped without one in 0.36.0, which the per-file coverage floor caught after the tag was cut.

0.36.0

Added

• /code-review [range] [-- path…] — a review of a change, where the scope is computed rather than recalled. Which files are in it, which are filtered as generated or vendored (each named with its reason), how they group into review units, and which language rules apply are all decided in code before the model sees anything; only the judging is left to it. Rules live in prompts/review-rules/, one document per language, loaded only for the languages actually in the diff — add your own by dropping a file there. Findings go through a review_report tool that checks each against the file: a wrong line is moved to where the quoted code actually is, a finding whose code isn't in the file (or whose file is out of scope) is dropped before you read it, and one on an untouched line is kept and flagged as context. -- <path> narrows a change too large for a single turn; past 25 files the command says so up front.

0.35.0

Changed

• A goal's first "complete" now has to prove itself. goal_update answers the first completion with a demand for evidence — enumerate what the objective requires from the current state, inspect each requirement, then call again with what you saw — and closes on the second call. One challenge per goal, so nothing can be held hostage by its own check, and an agent that stops at the challenge leaves the goal active rather than closed. Measured on MiniMax-M3 over twenty runs of a goal whose objective covers three files while the prompt names one: 19/20 before, 20/20 after; the run that failed had closed the goal after the first file. The check costs one extra model round per completion.

0.34.1

Fixed

• The bash_output wait argument was still being written in seconds. Both duration arguments advertised that a value under 1000 would be read as seconds, which reads as permission rather than a warning — so a model that had just written timeout: 120000 correctly went on to write wait: 2 for two seconds. The leniency stays in the runtime; the schema now teaches by example instead ("for ten minutes pass 600000", "for two seconds pass 2000"). Measured on MiniMax-M3 before and after: wait now arrives as 2000, and a half-hour timeout as 1800000 rather than 1800 — the value that is legal milliseconds and would have silently become 1.8 seconds.

0.34.0

Changed

• bash and ssh timeouts, and bash_output's wait, are now in milliseconds (default 180000, max 3600000). The unit was seconds, and a model that had learned the other convention sent timeout: 120000 meaning two minutes — read as 33 hours, which is not a long timeout but no timeout at all, leaving a hung command to hold the turn. Milliseconds is the more common convention across harnesses, so that is what the tools take. A value under 1000 is read as seconds and converted, with a warning naming the unit, so the opposite mistake can't turn timeout: 600 into a 0.6-second deadline. Above the maximum the value is capped, with a note that longer work belongs in the background. This is breaking for callers that passed 1000 or more meaning seconds: timeout: 1800 now means 1.8 seconds, not half an hour.
• A bash row in the TUI shows the timeout that will apply to it — bash npm test · 3m — so the deadline is visible while the command runs rather than only in the [TIMED OUT] result afterwards. It is the effective value, read through the same code the tool uses, so a converted or capped timeout displays as what will really fire; a background task that asked for no timer shows nothing.

Fixed

• A failed checkpoint write no longer dumps the validator's report into the transcript. The whole issue list was the error message and the error message is the user's notice, so a dozen lines about section budgets and missing Why: entries landed mid-turn. The notice is one line now — what blocked it, that the checkpoint on disk is untouched, and where the full list is written beside the rejected draft. It quotes a blocking issue rather than the first one, since warnings ride along in the same list and never caused the failure. The writer also gets three passes instead of two, because one repair pass rarely fixes an oversize document and several over-budget sections at once.

0.33.1

Added

• A bash row in the TUI shows the timeout that will apply to it — bash npm test · 3m — so the deadline is visible while the command runs rather than only in the [TIMED OUT] result afterwards. It is the effective value: the call's own timeout when it gave one, the foreground default when it did not, and nothing at all for a background task that asked for no timer, since nothing will stop it.

0.33.0

Changed

• Reasoning blocks are hidden by default, in the TUI and the web UI alike. Thinking is the model talking to itself, and on a reasoning model it arrives in bulk and buries the answer. Turn it on with /reasoning-display (/rd) or the web Settings > Appearance switch; the choice persists. A showReasoning already written in settings.json is left alone — this changes only what happens when nothing has chosen.

0.32.1

No behaviour changes — this release exists so the published version matches the tree CI validates. 0.32.0 shipped with the durable-goal paths in loop.ts and commands.ts untested, which the per-file coverage floor caught after the tag was cut, and with search.ts coverage that depended on whether fd was installed on the machine measuring it. Both are covered now.

0.32.0

Added

• /goal now outlives the turn that started it. The objective is recorded for the session and rides along with every later turn until it is closed, instead of living inside a single submitted message. Where a turn would end, an open goal continues the run on its own — bounded by a continuation budget and by the turn's existing iteration cap — and a pass that changed nothing gets told so rather than repeating. The agent closes the goal with a new goal_update tool, which requires the evidence for every requirement the objective names; a blocker only ends the goal once it has come back three times, and a safety or policy refusal ends it at once.
• /goal status, /goal edit <text> and /goal clear. Status and clear work while a turn is running, which is when a long autonomous run most needs them. Editing rewords the objective without resetting the history behind it.

Fixed

• A session lock could be taken from a live, working process. The turn-runner lock recorded when the turn began and nothing refreshed it, while anything older than 60 seconds counted as stale — so an ordinary long turn was stealable and two agent loops could drive one session. The lock now heartbeats while the turn runs, so "stale" means the owner died or wedged. The same staleness also made a long, healthy turn show up as idle in the web UI.

0.31.7

Fixed

• The coder-with-subagents persona demonstrated an edit call that doesn't exist. Its Validate-then-Commit example passed path and an edits array; the tool takes filePath, oldString and newString. The example now matches the real signature.
• It also carried an instruction that contradicted the shared file-tool rules, telling the agent to use one edit call per changed place while the shared workflow puts adjacent changes in a single call and splits only unrelated regions.

Changed

• coder-with-subagents no longer repeats the shared appendix. Its Guidelines and Working Style sections restated the tone, file-tool, verification and preamble rules that every persona already receives. What stays is what those sections don't cover: reuse before writing new code, read a file fully before wide-ranging changes, ask when a requirement is unclear, and report which subagents were spawned. The persona goes from roughly 5100 to 4650 tokens.

0.31.6

Changed

• Read-only subagents no longer carry the edit argument contract. explore and review declare tool allowlists without edit or write, but their system prompt still spelled out the whole oldString/newString contract — about 320 tokens of rules for a tool they cannot call. The shared appendix now takes the agent's allowlist into account. The file-tool workflow above that section is unchanged: it governs read/grep/glob/ls, which every agent has.
• The agent is told not to re-read a file whose content it already has, unless it edited the file, something else may have changed it, or an error suggests its copy is stale.
• Five personas no longer repeat the skill tool bullet. The skills instructions already explain the tool in full, and they are appended only when skills exist — with none installed, the bullet described a menu with nothing on it.

0.31.5

Changed

• A grep result with three matches or fewer now says to read the file before describing the code. A grep line carries the matched text, so it reads like a finished answer, and the model went on to report on code it had never opened. glob already gives the same nudge on a short hit list.
• The "inspect with the tools, not with bash" rule now covers verification too. Reading back a file you just wrote goes through read, not cat/wc/xxd, and several inspections packed into one bash call are called out: the blocks of output then have to be matched back to the paths that produced them, and getting that backwards reports the opposite of what is on disk.

0.31.4

Fixed

• glob reported "No files found" for an absolute pattern whose files were right there. With a pattern like /abs/dir/**/*.spec.ts and no path argument, the search still ran from the current directory, while the / in the pattern switched on full-path matching and anchored it with a leading **/ — so the pattern being matched was **//abs/dir/**/*.spec.ts, which can never match. An absolute pattern now takes its own directory prefix as the search root. The miss was silent: no error, just an empty result the model had no reason to distrust.
• Three prompt rules removed in the 0.31.3 prompt trim are back. The trim described them as consolidated elsewhere, but nothing carried them: no colon before a tool call, short progress updates at key moments rather than silence between the opening preamble and the summary, and a preamble on every response that calls tools (not only the first of a turn).

0.31.3

Changed

• pptxgenjs is now a declared dependency in cast's own package.json, tracked alongside cast's other dependencies instead of being an untracked package only npm audit/lockfile tooling couldn't see. The presentation-builder skill generates and runs its build script inside the target project's directory, so this does not remove the need for npm install pptxgenjs there — cast's own dependency list isn't on that script's module resolution path.

Fixed

• /distill could write a generated skill or persona outside its intended directory. The name sanitizer for a model-proposed artifact stripped disallowed characters but let a bare . or .. through unchanged, so an artifact named ".." landed at .cast/SKILL.md instead of .cast/skills/<name>/SKILL.md. Dot-only names are rejected now; the artifact is skipped instead of materialized in the wrong place.
• /distill could propose a command artifact that did nothing. It wrote to .cast/commands/<name>.md, a path nothing in cast ever reads back as an invocable command. Dropped command from the set of artifact kinds /distill can produce — only skill and persona, both of which are actually loaded.

0.31.2

Added

• The connection dot in the header says what it means on hover: Connected, Reconnecting… or No connection. It was a coloured dot and nothing else.

Changed

• Status and Keyboard shortcuts are the same window as Settings — same width and height, full-bleed on a phone the same way, so the three dialogs are one shape instead of three.
• The session's directory is in brackets next to the persona: SENIOR DEVELOPER (/home/ubuntu/pet/cast).

Fixed

• grep (and glob) against a sibling directory returned a path the model could not read. With path: ../proj-extra, rg was run with cwd: ../proj-extra and the relative argument ., so a hit in b.txt came back as b.txt:1:hit here — a bare basename the model then couldn't read. The directory search path is now resolved to an absolute root, rg is run with that as its cwd, and rg's output is rewritten so every path is absolute again. The JS fallback already produced absolute paths and is unchanged.
• "Load more" in the sidebar looked like it ignored the click. The button had no pending state at all: the next page of sessions appeared 200ms later on a fast link and well past half a second on a phone, with nothing happening in between. It now shows a spinner and refuses a second click while the page is on its way — measured at 27ms from the click, whatever the latency. While it spins, the button drops its frame: there is nothing to press, so only the spinner is left.
• The Status dialog spilled its last rows outside the box. It is a flex column with a capped height, and its body never declared that it may shrink and scroll — so with a long model id, provider name or branch, "Git branch" and "Worktree" were drawn below the dialog, on top of the page behind it. The body scrolls inside the dialog now. The confirm dialog had the same gap and got the same fix.
• A tooltip kept the text the element was born with. The themed tooltips copy an element's title once, so every title that changes with state — the connection dot, Abort while it is aborting, Send while it is sending — showed its original wording forever. The text is re-read each time the pointer arrives.
• Restarting the daemon told every open tab "This session was closed". A shutdown closes the sessions it holds in memory, and the browser reported that as an error — the thread is on disk and the page reconnects to it seconds later. The event carries the reason now, and a shutdown is not announced: the status dot already shows the reconnect.
• The first message in a new, empty chat could fail with "Connection lost". A draft has no event stream on purpose — it is created by the very message being sent — and two separate checks treated that as a dead connection: the composer's "can I send?" (so a new chat showed "Reconnecting…" and refused outright), and the wait for the stream after the session was created (so on a slow link the message was dropped back into the composer once the wait timed out). Sending is gated on the daemon answering now, a live stream is required only once the session exists, and waiting for the stream orders the events without ever cancelling the send — the POST is what sends the message, and only its own failure is reported (and retried). Verified with 400-900ms of latency per request and with the event stream held open for 3-5 seconds: the message goes out every time, with no error.
• Sending while the page was reconnecting failed instead of waiting. A phone coming back from a locked screen, or a daemon that just restarted, leaves the page disconnected for as long as the retry loop takes to notice — and a send in that window bounced with "Connection lost", with the typed text only reappearing afterwards. Pressing send now asks for a reconnect immediately (instead of sitting out the retry's 3s sleep), keeps the draft on screen while it waits, and sends as soon as the daemon answers; measured end to end with a daemon restart, the message goes out with no error at all. It gives up after 6 seconds, which is the only case that still reports "Connection lost". The reconnect is also kicked when the browser reports the network back.
• The turn timer appeared a round trip after the message was sent. The composer flips to Abort the moment a send leaves the browser, but the elapsed counter waited for the daemon's status:running event to name a start time: measured at 125ms on localhost and 232ms with 150ms of latency, and longer on a phone. It now starts from the send itself and adopts the daemon's timestamp when it arrives, whichever is earlier, so the reading never jumps backwards. Steering into a running turn keeps that turn's own start.

0.31.1

Fixed

• Mobile: the keyboard closed on send and popped back up mid-request. Tapping Send moved focus from the textarea to the button — the keyboard started sliding away — and the composer only refocused the textarea after onSubmit had resolved, so the keyboard came back a network round trip later, right as the answer started loading. The composer buttons no longer take focus on press, and the textarea is refocused synchronously inside the tap, so the keyboard simply stays up. Focus also no longer ends up on the Abort button that replaces Send when the turn starts.
• Mobile: the keyboard opening left the chat scrolled away from the newest message. The on-screen keyboard takes ~390px off the transcript's height, and losing height fires no scroll event, so the view stayed where it was — 390px above the bottom, with the newest message below the fold. The list re-pins on its own resize now (the same fix covers the workspace panel opening on a desktop). A reader who had scrolled up is left where they were. The page also declares interactive-widget=resizes-content, so the keyboard shrinks the layout instead of covering it: the header stays put and the composer sits directly on top of the keyboard.
• Mobile: the persona above the composer wrapped mid-label and the path ran off the screen. The role line is one line now, and the path is truncated from the left (…/scratchpad/panel/home/proj1), since the end of it is what names the project. The full path stays in the tooltip, and a wide screen still shows all of it.

0.31.0

Removed

• Pluggable ("factory") UIs are gone. The web UI is served at / again instead of redirecting to /default/; /default/* answers with a 301 to the same path without the prefix, so old bookmarks keep working. Removed with it: ~/.cast/ui/* discovery, /ui, /ui/<name>/, /<name>/, GET|POST /api/uis, /api/uis/events, /api/settings/default-ui, the Default UI settings tab, the activeUi/defaultUi settings, the ui-factory skill, the UI template shipped in the package, and the write guard that refused agent edits to cast's own src/server/public.

Added

• The session's directory is shown above the composer, next to the persona: SENIOR DEVELOPER /home/ubuntu/pet/cast. It was visible nowhere in the web UI, so two threads in different projects looked identical. The full path is shown. The line also appears for a session with no persona set, which used to hide it entirely.

Fixed

• Web chat stopped following the stream. Two causes. The scroll handler decided "still at the bottom?" by measuring the position after a render but before the catch-up scroll, so once a streaming frame added more than 80px (the adaptive repaint rate from 0.30.3 batches more per frame) it concluded the reader had scrolled away and stopped following for good. And when the streaming block was swapped for the settled message, that message was laid out as its 120px content-visibility placeholder for one frame, so the list was pinned once and then grew by the real height underneath, leaving the view thousands of px above the bottom. Following now turns off only on an actual scroll up, ignores the clamp that comes with a shrinking list, and a ResizeObserver on the transcript keeps the view pinned whatever grows it (a realised message, a highlighted code block, an image).
• Web settings: editing the active provider lost the model. The form did /provider delete + /provider add, and deleting the active provider switches to a fallback, clears the chosen model and drops the subagent/plan slots pointing at it. There is a /provider edit <name> <url> <apiKey> now that updates in place.
• Web settings: search API keys no longer travel to the browser. /web-search-provider reports only whether a Tavily/Brave key is saved; the field starts empty and a saved key is kept when it stays empty.
• Web settings: a tab whose data failed to load rendered blank. Model, Bash and Web are built from several commands; when one failed the tab drew empty values with no error. The first failure is shown now. The model pickers also follow the saved values after every reload instead of staying on the last pick.
• Web settings: a rejected command showed no error. The tab reloads its data after every action, and the reload cleared the error slot the action had just filled, so a refused save (/turn-cap 5, an invalid threshold list) left the tab looking as if it had succeeded. The error is set after the reload now.
• The workspace panel no longer stalls the daemon, and keeps its place when you switch threads. Three things, all measured against two projects with 50 and 5 changed files:
  • GET /api/sessions/:id/diff ran git synchronously, one process per changed file, on the daemon's event loop. One request on the 50-file project held it for 1–4 seconds, and everything else waited behind it: a session switch took 1.5s instead of 30ms, the file tree 2.5s instead of 10ms, /api/config 850ms instead of 3ms — for every client, not just the one asking. The diffs run asynchronously now, ten at a time: 1.06s → 0.27s for the request itself, and the request next to it stays at ~20ms. Paths are passed as arguments instead of spliced into a shell string, so a file with a space in its name diffs too.
  • The diff was fetched whenever the panel was open, whatever tab was showing — every session switch with Files or Memory in front still ran the full git diff for nothing, and a quick run through several threads left every earlier request running to completion on the server with its answer discarded. It is fetched only while Changes is showing, and a superseded request is aborted.
  • Changes showed an empty diff for any file whose name has a space or a non-ASCII character in it. git status --porcelain wraps such a path in quotes ("has space.ts") and writes a Cyrillic name as octal escapes, and the parser took the string literally, so the follow-up git diff asked about a file that does not exist. Status is read with -z (no quoting, NUL-separated) and core.quotePath is off for the diff headers, so файл.ts is файл.ts on both sides. Renames read their old name from the -z record instead of splitting on ->.
  • The Files tree reset on every session switch — folders collapsed, root refetched — even between two threads in the same directory, where the files are the same files. It is keyed by the project now: switching threads within one keeps every expanded folder and makes no request at all; switching projects reloads as before.
• The web transcript renders markdown properly. It was a hand-rolled set of regexes, which got the common cases right and then fell over: 2 * 3 * 4 = 24 came out with the 3 in italics, `a **b** c` put a <strong> inside the <code>, every heading level collapsed to a single <strong>, and blockquotes, ---, nested lists, task lists, ~~strike~~, __bold__, ~~~ fences, 1) numbering and a fenced block inside a list item were not implemented at all (an unterminated fence also stayed raw text once the turn settled, so the view changed under you when it did). marked parses it now — it was already vendored for the file preview, so no new dependency — and every one of those renders correctly. Safety did not regress, it got a second layer: the renderer emits no raw HTML of its own (an HTML token in the source comes back escaped, and a link is only a link if its scheme is http/https/mailto — javascript: and data: render as plain text), and DOMPurify sanitizes the result on top of that. The cost is 19KB more on the first load, cached forever; time to an interactive composer did not move (307ms vs 310ms with 40ms of latency per request). The file preview no longer fetches marked and DOMPurify a second time either — the transcript needs them on first paint, so they are in the main bundle. highlight.js stays lazy, being 1MB of it.

0.30.3

Changed

• The web UI loads about twice as fast, and asks for a fifth of the requests. Measured cold (fresh browser profile, no cache, real Chromium) with 40ms of latency on every request — the case that matters, since the daemon is usually reached over a network rather than from localhost. Up to the moment the composer is usable: 56 requests and 113KB became 11 requests and 57KB, the composer was ready in 310ms instead of 470ms, first paint came at 340ms instead of 504ms, and the whole load transferred 114KB instead of 234KB. On a session with 240 messages the transcript was on screen at 636ms instead of 783ms, having parsed 913KB of JSON instead of 1569KB. Three things did it:
  • The app is bundled for production. The browser used to fetch it as 45 separate ES modules in a graph six levels deep, and every level of that graph is a round trip. The built copy is now one hash-named bundle plus a chunk per click-gated feature. Served from src/ in development the modules stay exactly as they were — unbundled and debuggable without a build step.
  • Code behind a click is loaded behind a click. The settings modal and its sixteen panels, the dashboard, the new-session and share modals, and the workspace panel with its three explorers — about 150KB — used to load before the first paint whether or not anyone opened them. They now load on demand, and are prefetched once the page goes idle, so the first click still opens instantly.
  • Fonts are woff2 instead of TTF, and immutable. The default face went from 112KB to 37KB, and its URL now carries a content hash, so it is fetched once ever instead of once an hour; all six faces together dropped from 1MB to 348KB.
• A streamed answer costs the browser about a third less work. Every repaint of the block being streamed replaces its HTML, and the browser then re-parses and re-lays-out all of it — a cost that grows with the answer while the render rate did not. Traced on a CPU throttled 6× (a mid-range laptop), one eight-second answer spent 1.1s in layout alone, with or without a transcript above it. The repaint interval now scales with the answer's length: a short one keeps the full ~12fps, a long one settles at ~4fps, where nobody is reading the tail as it lands. Measured over three runs each: 2 683ms of blocked main thread became 1 742ms, 31 long tasks became 21, the 95th-percentile frame gap 83ms became 50ms, and the frame rate went from 41 to 49. Streaming renders also no longer evict the markdown cache they share with the finished transcript — a hundred intermediate versions of one answer used to push everything else out of a 300-entry cache.
• Opening a session fetched and rendered it twice. The event stream refetches the session on connect, to catch anything the daemon did while the tab was away — but that fires on the first connect too, right after the session was just fetched, so every session open downloaded, parsed and re-rendered its whole page a second time: 460KB of JSON for a 240-message session. The first connect after a fetch now skips it.
• A stale name in the asset-version list took the whole page down. The list of modules mixed into app.js's content hash is hand-maintained; a name whose file no longer exists threw inside the static handler, so every asset 404'd — including index.html, with nothing in the log to say why. A missing entry is now just a missing version, and CAST_DEBUG_STATIC=1 prints what a swallowed static-file error actually was.
• The service worker precached the wrong files. Its shell list named /app.js and the vendored preact/htm modules — none of which the bundled page loads — and missed the bundle itself; the build now writes the list from what it actually emitted. A single missing entry also used to fail the whole install (one rejected addAll) and leave the page with no service worker at all, silently; entries are added individually now.

0.30.2

Changed

• Lists read as lists. A task list printed its source — • [ ] сделать — and now draws the box itself, ☐ and ☑, in place of the bullet rather than after it. A nested item keeps the indentation it was written with instead of a fixed two cells per level, so an item under 1. (three cells) lines up with its parent's text rather than sitting a cell short of it. And each level gets its own bullet shape, • ◦ ▪ — the old • – · made the third level look like a smaller second.

Fixed

• A --- line vanished, and the next table lost its header divider. A horizontal rule matches the same pattern as a table's |---|---| alignment row, and 0.30.1 started dropping those wherever they appeared — so a thematic break disappeared from the answer and the table after it was rendered as if its header belonged to an earlier chunk. The pipe is what makes it a table rule now.

0.30.1

Added

• Code blocks are syntax-highlighted. A snippet in a reply was one flat colour, which is where a terminal gives up on the thing it is best at — strings, comments and names carry the shape of the code, and the eye finds them before it reads the words. highlight.js does the tokenizing (through its emitter, not its HTML), across 25 curated grammars: an unknown or missing language tag leaves the block plain rather than guessing, because a wrong guess colours a snippet misleadingly. A ```diff block gets its additions and deletions coloured, so a patch in an answer reads like a patch.

Fixed

• A code block stopped being highlighted halfway down, and a table after it came out as raw | rows. The stream cuts an answer into chunks at line boundaries and promotes each separately, so a chunk routinely begins inside a fenced block — with its ```ts opener, language tag and all, left behind in an earlier chunk. Worse, a chunk that began with the closing ``` read it as a new opening fence and swallowed everything after it as flat code. The open fence (and its language) is now threaded through the chunks, in the live region and in the committed transcript alike.

• Tables are drawn as a grid. | a | b | rows became columns separated by air, and a header marked only by bold — which is nothing at all on a terminal that renders bold as a faint colour shift. Now there is a box: ┌─┬─┐, the header ruled off with ├─┼─┤, borders dim so the content stays the loudest thing in the block. It costs three cells per column and two rows, which is the difference between a table you read and a table you count columns in.

• A table streamed into the transcript came out with its alignment row as data, and two different column layouts. Column widths are computed per chunk of the answer, and the stream cuts chunks at line boundaries: a table split across two of them was laid out twice at different widths, and the chunk that began with |---|---:| had no header above it — so the alignment row itself became the table's header, --- ---: and all. A table under construction now stays in the live region until it ends, so it is always laid out whole; and an alignment row with no header above it is dropped rather than drawn, for a transcript rebuilt from a session where the split already happened.

Changed

• One separator everywhere: –. Hints used —, content labels used ·, and both appeared in the same frame. The picker and palette footers, the composer placeholder, tool rows (read src/ui/ChatLog.tsx – lines all), the MCP server – tool label, the subagent summary, the turn footer (provider – model – Ns) and the web UI's equivalents all use the en dash now.

0.30.0

Changed

• A long request wraps as you type it. The composer used to slide a one-row window sideways, so a long draft was a keyhole: no way to see the sentence you were writing. It wraps at the terminal's edge now, on word boundaries, measured in display cells (wide characters and paste chips included) — while staying bounded at three rows, which is what keeps the live region inside the terminal. ↑/↓ move between visual rows, wrapped ones included, and recall a prompt from history only at the very top or bottom of the draft.
• A prompt can have line breaks in it. Nothing was bound to insertNewline, so a multi-line message could only arrive by pasting: Shift+Enter and Alt+Enter now insert a line break, and on a terminal that reports neither (most of them send the same byte for Enter and Shift+Enter) ending the line with \ and pressing Enter does the same. ↑/↓ move between the lines of a draft and fall back to prompt history at its edges.
• /keys says how to type a line break, and recall gives back real lines. The new binding was listed as the bare id editor.insertNewline with no hint that a backslash works where Shift+Enter cannot, and Ctrl+L was missing entirely. Recalling a multi-line prompt from history handed back an opaque [Pasted 3 lines] chip that could only be deleted whole; up to three lines it now comes back as editable text (a bigger block stays a chip — the composer shows three rows).
• Tab completes file paths. Outside the / palette Tab did nothing. It now finishes a path-shaped token (one containing /, or starting with ~): the unambiguous part is committed, a directory gets its trailing slash so the next Tab descends, and when several names still match they are listed under the composer. Tab in ordinary prose still does nothing — with no popup to dismiss, a filename the user did not ask for is worse than no completion.
• The speaker's label sits on its own row. you, agent and reasoning used to ride the first line of their text, which cost every row the label's width — 11 cells of an 80-column terminal for a reasoning block — and left consecutive turns starting their prose in different columns until the labels were padded to a shared field. Now the label is a row, and the text under it starts in the same column as everything else: nothing to align, no width given up. The cost is one row per block, which the live-region clamp charges (a block it forgets to charge for is exactly how the region grows taller than the terminal).
• Typing while the agent works steers it. A plain message sent mid-turn is injected into the running turn — no /steer, no /s. That is what the message means when it is written mid-run, and it is what the web UI already did (the daemon steers anything sent into a running turn), so the two surfaces finally agree; the TUI used to refuse the line and tell you to go read about /queue and /steer. /steer stays for being explicit and for scripts. An image can't be injected mid-turn — that says so instead of dropping the picture silently. The composer's hint follows: type to steer the running turn — esc esc to stop.
• · is gone from the hint lines. Composer placeholder, the / palette footer and every picker footer separate their hints with — now.
• Every row under the transcript is one row again, on any terminal width. The composer's placeholder, and the status bar, still wrapped: at 24 columns the bar took two rows and the placeholder three, growing the live region the rest of this work exists to keep fixed; at 40 the elapsed counter painted over the tail of the model name, so test-model read test-mode0.4s. Both truncate now, with the status bar's right-hand group keeping its width. The composer's hint is also shorter and less shouty — ask cast to do anything, and esc esc to stop · /queue · /steer while a turn runs; the commands it used to spell out are in the / palette. The divider above the composer spans the full width instead of stopping one cell short.

0.29.0

Changed

• Unregistered daemons piled up. Every client — the TUI, cast run, ACP, cast server status/stop — finds the daemon through ~/.cast/server.json, so a daemon that is no longer recorded there cannot be reached by anything. Such an instance is created on purpose (a process that has already bound its port keeps serving rather than dying mid-request) and nothing ever ended one, so they accumulated: measured on one machine, four daemons at 160–250MB each, three of them unreachable. An unrecorded daemon now retires itself — but never because its clients went away, which is the daemon's whole purpose: the user closes the terminal, goes to bed, and the agent keeps working. It retires only when nothing at all is happening — no turn running, no background bash task alive, no subagent or checkpoint writer in flight, nobody subscribed — and has been that quiet for ten unbroken minutes, measured from a watermark that any event moves, not from a sampled flag (a turn that starts and finishes between two 30-second polls is invisible to sampling — measured — and must still count). Nor within the first minute after startup, because the record is written after the bind and another process may be mid-write. A --foreground daemon is never retired: the user is looking at it. Verified against the built binary: with the default 30s/60s timings an unregistered daemon exits after 60s; one with a turn in flight waits for the turn; one with a sleep 120 background task stays; one with an open event stream stays until the client disconnects; and one that still holds its record is untouched.
• The scrollback no longer disappears while you type a long prompt, queue a message mid-turn, or print a long listing. Only the streaming answer was height-bounded; the composer draft, the [Queued: …] receipts and the notice line wrapped to as many rows as they wanted, and once the live region is taller than the terminal Ink clears the screen and the scrollback on every frame — 13 full clears for one 600-character draft, 210 (1.8MB of output) for two long queued messages during a stream, one for a 30-hook /hooks listing. The composer now windows a long draft horizontally like readline, with \u2039/\u203a markers at the clipped edges; queue/steer receipts are one truncated row each, at most three plus a count; and a notice taller than three rows goes to the transcript, where it can be scrolled back to, instead of the live line. npm run e2e:tui covers all three.
• Exiting prints the command to come back. cast --resume=<id> on the way out, so the session id is not lost with the frame the exit clears (it is nowhere else on screen). Nothing is printed for a session with no turns.
• The ASCII wordmark is gone from the TUI. Seven rows of block art cost a third of a 24-row terminal before the first message, had to be reprinted on every terminal resync (and de-duplicated when that reprint left the old copy in the scrollback — a window drag stacked a wall of them), and said nothing the status bar does not. Startup prints one gradient line, cast v0.29.0. The web UI keeps the logo, where a logo makes sense.
• The TUI renders the answer instead of printing its markdown. A reply arrived looking like source: ## heading, **bold**, backticks, ``` fences, |---| table rules, > quotes — all visible as characters. Now headings, emphasis and inline code are styled, fenced blocks are coloured as code, lists get a bullet and a hanging indent so a wrapped item lines up under its own text, quotes get a gutter, links show their text and target, and tables are laid out in aligned columns that shrink to the terminal's width. Every row carries a marker in one gutter column, so the transcript has a single left edge and a wrapped paragraph reads as part of the reply it belongs to instead of starting at column 0: a coloured ▌ for a turn, a dashed ┆ for reasoning, a grey │ for the scaffolding around them — tool calls, errors, retries, the activity spinner — and ⓘ for a harness notice, which replaces the [system] prefix the text used to carry. The speaker's label rides the first line (▌ you проверь…, ▌ agent Готово) rather than taking a row of its own, with continuations indented to the same column; two rows of chrome per turn is a lot on a 24-row terminal. Two themes (nord, solarized) put muted within 1.7–2.8:1 of their background, where a one-cell bar disappears, so ThemeColors grew an optional rail colour for them — border, despite the name, is 1.3–2.5:1 everywhere and unusable as a rail. The truncation marker is drawn inside the label's field rather than appended to it: appending made every row of a clamped block two cells wider than the width it was rendered for, Ink wrapped them all, and the live region doubled in height — 63 full-screen clears in a single streaming answer, the exact failure the clamp exists to prevent. A test now renders the frame and compares its height against what the clamp charged. Tool rows are quiet scaffolding rather than a third loud element: [bash] [ok] command="git status --short" is now a dimmed grey │ bash git status --short whose bar sits in the gutter column itself, level with a turn's ▌: the transcript keeps one left edge, and the difference between a reply and its scaffolding is carried by weight and grey rather than by indentation. A thicker ┃ marks a call still running, a difference in weight rather than colour; colour is spent only on a failure (✗), where the contrast is worth something.
• The live-region clamp counts rows it rendered, not cells it estimated. The renderer wraps to the width it is given and returns lines, so the number of rows a block will occupy is exact by construction — and the same lines are handed to the view, so a frame renders once. The cell arithmetic this replaces is where a CJK answer took twice the rows it was allowed. Verified with npm run e2e:tui: 0 full-screen clears while a long Japanese answer streams.

0.28.0

Added

• ↑/↓ recall previous prompts, as in any other terminal input. They were wired to the text buffer's cursor-up/cursor-down, and the composer's buffer is one line by construction — so ↑ did nothing at all and ↓ jumped the cursor to the end of the line. Now ↑ walks back through the prompts submitted in this session (seeded from a resumed session's transcript), ↓ walks forward, and stepping past the newest entry restores the draft that was being typed. A recalled multi-line prompt comes back as a paste chip, so re-sending it reproduces the original text exactly. While the command palette is open the same keys still move its selection.

Fixed

• The context indicator's two halves disagreed. ctx <used>/<total> (<pct>%) computed the percentage against the input budget — the window minus the reply reserve, which is what compaction measures against — while printing the raw context window as the denominator. A 128k model with the default 32k reserve therefore rendered ctx 94.7k/128k (99%), where 94.7 of 128 is 74%, and a 32k model rendered ctx 94.7k/32.8k (578%). The denominator is the budget now, so the fraction and the percentage say the same thing and the percentage still means "how close am I to a compaction".
• A multi-line tool summary took more rows in the live region than it was charged. The clamp counts a tool call as one status row, and Ink's wrap="truncate" truncates the text but does not remove its newlines — a value that already fits the terminal width comes back unchanged. So a task whose assignment reads "Do X / Then Y / Report back" rendered three rows against a one-row charge, and any tool call whose streaming arguments arrive pretty-printed did the same, on every call. Enough of those and the live region is taller than the viewport, which is the state Ink handles by clearing the terminal and replaying all of its static output — on every frame. The compact row is collapsed to one physical line; committed history still shows the assignment as written.
• One backspace deleted part of an emoji. The composer's cursor moved and deleted by code point, so a family emoji (‍‍‍, four people and three joiners) lost one member per press and left a dangling joiner behind — the glyph fell apart into separate emoji on screen and took seven presses to remove. A skin-tone modifier came off its emoji, a flag lost half its pair, and an accent written as a combining mark came off its letter. Cursor movement, backspace and delete-forward now step over whole grapheme clusters, and the cursor cell renders the whole cluster instead of its first code point. The boundary lookup is windowed around the cursor because segmenting a long pasted draft costs 49ms at 100KB — on every keystroke — against 0.13ms for the window.
• A long line of CJK text overran the live region. The clamp that keeps the streaming preview inside the viewport hard-cuts a single over-long line, and it sliced that many characters against a budget counted in cells — the comment beside it even claimed this erred short. It erred long by exactly the character's width: on an 80-column, 24-row terminal a 20,000-character CJK line kept 1,280 characters, which is 2,560 cells and 32 rows against a 16-row budget. That is the one thing the clamp exists to prevent: a live region taller than the viewport makes Ink clear the terminal and replay every static row it has ever printed, once per frame. Measured end-to-end in a pseudo-terminal (npm run e2e:tui) on a 30-row window while a Japanese answer streamed: 51 full-screen clears with scrollback wipes and 209KB of terminal traffic before the fix, 0 clears and 24KB after. The cut is now measured in cells, and errs short on a cluster it splits.
• A failing callback under suspendAndRun ran twice. The fallback path there is for a suspend hook that refuses (Ink throws when the terminal is already suspended), and a callback that simply failed was indistinguishable from that: its error was swallowed and the work was retried — the second time with the terminal no longer suspended, so whatever it printed landed on top of Ink's frame. It now tells the two apart and propagates the callback's own error. The module header also described piping process.stdin into a child process, which it never did: bash runs with stdin at EOF on purpose, so a command that waits for input exits instead of hanging the session.
• A finished background task showed up as the user's own message, raw XML included. With a daemon running the daemon injects the completion notice, and the TUI appended that message to the transcript verbatim — so the notice arrived attributed to the person, with a bare </system-reminder> visible on its own line, instead of as a [system] row. Every other surface already split those blocks out; this one path (the daemon's user_message event) did not, and it is the path every daemon-injected reminder takes: background tasks, the post-compaction state block, attached-file lists. Every path now shares one function — including the follow-up injection, which is how a background task that finishes during a turn reaches the transcript: that one appended the message verbatim too, so the notice arrived as you <system-reminder>… with the raw tag on screen.
• /undo said there was nothing to undo, right after a change. With a daemon running — the default — the daemon owns the turn and appends the turn's checkpoint itself, while the TUI's in-memory session.checkpoints is only ever filled when a session is loaded. So /undo immediately after an edit answered "[No checkpoint available to undo]", and the command only started working after a restart, which is the one moment nobody needs it. It now reads the persisted list — the same table both paths write to. Verified end-to-end in a pseudo-terminal: the agent writes a file, /undo names it in the confirmation and removes it, with the repository's tracked files untouched.
• /help while the agent was working answered "use /queue, /steer, or /abort". Only five commands could be sent mid-turn, so every local, read-only one — /help, /keys, /current, /context, /rules and the /theme switch — was refused with advice meant for a prompt, and the line stayed in the composer as though Enter had been swallowed. /reasoning-display, a display toggle of exactly the same kind, was already allowed, so the gate was inconsistent as well as unhelpful. Those six now run while a turn streams; anything that changes what the running turn does (/model, /compact, /undo, /clear) still waits, with the same explanation as before.
• Terminal width was measured with a hand-rolled table that was wrong in both directions. The live region decides how many rows a streaming block needs from these numbers, while Ink renders it using string-width, so a disagreement either drops text that would have fitted or lets the region overrun the viewport — the failure the measurement exists to prevent. Checked against string-width on 33 strings, the old table disagreed on 8: an emoji built from a ZWJ sequence measured wildly wide (‍‍‍ as 11 cells instead of 2, ‍ as 5, as 4), a combining accent added a phantom cell (`école` as 6 instead of 5), and, , measured 1 cell instead of 2. Width now comes from the Unicode East Asian Width property with joiners, variation selectors, skin tones and combining marks folded into the glyph they attach to; all 33 agree, and it stays a per-code-point loop because string-width itself costs 46× more (647ms against 14ms on one 240KB line, well past a frame's 16ms).
• Pasting an image said "no image in clipboard" when the helper binary was missing. readClipboardImage composes exactly the message the user needs — pngpaste not found — install: brew install pngpaste — and two things threw it away. The TUI's paste handler collapsed every failure to null, which the composer renders as "No image in clipboard — copy a screenshot or image file first"; and the check for a missing binary tested for ENOENT while the command ran through a shell, which reports a missing binary as exit 127 and never as ENOENT. pngpaste is not part of macOS, so a Mac user with a screenshot on the clipboard was told the clipboard was empty, every time. The commands no longer go through a shell (the argv was fixed anyway), the real reason reaches the notice, and a clipboard that genuinely holds text instead of an image is still reported as "no image" rather than as a tool failure. A saved clipboard image is also written 0600 — /tmp is shared, and a pasted screenshot is whatever was on the screen.
• A command's output could forge cast's own notices. Completion notices for background tasks are <system-reminder> blocks — the channel the harness uses to talk to the model, which the TUI and web UI render as [system] … rows and the ACP adapter drops from a replay. The task's command and output were embedded in one without escaping, so output containing </system-reminder><system-reminder>… closed cast's envelope and opened its own: one notice became five reminder blocks, one of them authored entirely by the command. The model reads that block as an instruction from the harness rather than as data a command printed, and the user is shown it as a genuine [system] notice (or, in an editor over ACP, not shown it at all). Ordinary output can do this by accident — a build log echoing a prompt file — and a hostile repository can do it on purpose. The same escaping now applies to the editor buffers the ACP adapter injects as context and to the checkpoint-validation report, the other two places where untrusted text sits inside that envelope.

0.27.0

Changed

• disposeSessionWorktree is gone. Nothing called it, and it removed a worktree with git worktree remove --force plus git branch -D — the two guards /worktree remove was fixed to stop bypassing. Dead code that discards uncommitted work and unmerged commits is one call site away from doing it again.

Fixed

• A share link handed over every command's output. The public /api/shared/:token view dropped the persona's system prompt and the web UI hides tool cards in that view, but the JSON behind it is unauthenticated and carried each tool call's full arguments and full result — so a "read-only conversation link" sent to a colleague was also a transcript of every file the agent read and everything every command printed, curl away. The live relay had already been fixed to hide exactly this; the saved view it was fixed to match never actually hid it. Both now redact the same way: the visitor sees that bash ran and whether it succeeded, never the payload. The <system-reminder> notices a turn carries (project memory, attached documents) are dropped from the shared view too.
• /undo corrupted the files it restored, in a project without git. The shadow-checkpoint path read a file with readFileSync(path, "utf8") and wrote it back the same way, so every byte that is not valid UTF-8 came back as U+FFFD — a 12-byte PNG was "restored" as 22 bytes of replacement characters, reported as success. Snapshots are taken and restored as raw bytes now, and a file above 10MB is recorded as un-restorable instead of being copied into the session store, with the restore saying which files it left untouched.
• /undo's confirmation listed files it was not going to delete. It compares git clean -nd output against the checkpoint's tree, but the first is relative to the session's directory (with a ./ prefix) and the second was listed relative to it too, or scoped away entirely — so from a subdirectory nothing matched and the prompt claimed the restore would delete files it in fact puts straight back, including ones the user wrote themselves. It also passed git's own "Would refuse to remove current working directory" notice off as a file. Both sides are compared as repository-relative paths now, and only Would remove … lines are read as paths.
• edit with replaceAll expanded $& in the replacement. String.replaceAll treats $&, $`, $' and $1 in the replacement as substitution patterns, so a newString containing them — sed, a regex, jQuery, shell — was written back with the matched text spliced into it. edit's single-occurrence path concatenates and always did the right thing, so one tool wrote two different results depending on replaceAll: s/x/$&y/ landed as s/x/s/a/b/y/. Same fix for the skill-template placeholders (${CAST_SKILL_DIR}, $ARGUMENTS, named arguments) and the UI factory's {{var}} substitution, where the replacement is a path or whatever the user typed.
• The SSH control socket lived in a directory anyone could own. cast multiplexes SSH connections through /tmp/cast-ssh-ctl, and a master socket there stays usable for an hour (ControlPersist=3600): reaching it is enough to run commands on the remote host as the user, with no key and no password. The directory was created with mkdirSync(…, { recursive: true }), which silently accepts a path that already exists — a directory or a symlink another local user planted in the shared /tmp first — and the chmod 700 that followed was a swallowed best-effort. Verified: with the path symlinked elsewhere, the socket landed at the link's target. The path is now per-uid and checked after creation (a real directory, owned by this user, mode 700) or refused with a message naming the problem. Exiting cast also no longer deletes the directory: that removed the live sockets of every other cast process on the machine, and an orphaned master unlinks its own socket when it times out.
• Project memory was silently amputated at 40,000 characters. One read helper served both jobs — pasting a memory file into the prompt, where a cap is right, and reading it in order to write it back, where it is data loss. MEMORY.md is the canonical store: dream merges new bullets into it, a rejected checkpoint is rolled back from it, the database is reconciled against it. So the first merge after the file passed 40,000 characters rewrote it as its own first 40,000, deleting every bullet beyond them — the file whose own code comment promises that hand edits and curated markdown survive intact. A rolled-back checkpoint and notes.md appends lost the same way. Reads that write back now see the whole file; only prompt assembly caps, and it marks the cut so the model does not read a truncation as "not in memory".
• Upgrading from the web UI killed the daemon and did not bring it back. POST /api/system/upgrade runs the upgrade inside the daemon, and the restart step signalled the recorded pid — which is that same process. The shutdown handler then closed every session and exited within seconds, so the step that was supposed to start the replacement never ran: a freshly installed cast, no daemon, and a web UI that simply went dead. The self case now hands the restart to a detached waiter that starts the new daemon once the old pid is gone, and shuts down normally so sessions still drain (verified live: old pid gone, new daemon listening on the same port). A pinned version is also validated as x.y.z before it becomes CAST_VERSION for the installer.
• cast server start failed on a machine where ~/.cast did not exist yet — a fresh install or a container image, where the daemon is the first cast command run. It opened its log file before anything created the directory and exited with an ENOENT, advising the user to check a directory that was never there.
• The web UI escaped &, < and > but not quotes. Rendered markdown is inserted as HTML and link targets are interpolated into href="…", so a URL containing a double quote closed the attribute and added an event handler that then ran in the daemon's own origin — session cookie and full API included. Markdown reaches the renderer from model output, tool results and file contents, none of which is under the user's control. Quotes are now escaped, and the renderer moved into its own module so this is testable.

0.26.1

Fixed

• One definition of "the project" for rules, memory and history search. Each subsystem answered the question differently, and a session started in a subdirectory paid for it: AGENTS.md was inherited from every ancestor, but .cast/rules was only read from <cwd> downwards, project memory was keyed on a hash of the exact cwd, and a project-scoped history search matched s.cwd exactly. In a monorepo cd apps/web && cast therefore lost the repository's rules — /rules looked empty, as though none had been written — started from an empty MEMORY.md, the file whose own template says it is "shared by all sessions", and could not find any session run from the root. The project root is now the nearest ancestor with a .git, else the topmost with a .cast/, else the directory itself, and rules, memory, history scope and glob-matched context paths all use it. A nested checkout stays its own project (its own .git says so), a subdirectory's .cast/rules stays what it is documented to be — rules scoped to that subtree — and the home directory is never a root, so ~/.cast remains global configuration and a dotfiles repository in $HOME cannot make everything under it one project. /reload re-reads the root.

0.26.0

Added

• Automatic compaction is configurable. contextWindow, maxResponseTokens, compactionThreshold, maxToolOutputLines and maxToolOutputBytes are settings rather than constants nothing could reach — /current used to show a budget the user had no way to change. Each clamps to a sane range and falls back to what the constant was, so an absent or malformed value behaves exactly as before. An explicit contextWindow now also beats the model catalog, for an endpoint the catalog gets wrong.
• Waiting out an exhausted quota. A quota error is normally terminal — credit does not come back on its own — but when the key's limit is a window (daily tokens, hourly requests) it does reopen, and an unattended run should sit through that rather than dying at 3am on a limit that clears at 4. retryQuotaWaitSeconds (default 0, off) is both the switch and the whole budget: with it set, the quota is re-tested on a 30s→5min backoff, or exactly when the provider's Retry-After says, until the budget is spent. Esc cancels the wait. retryMaxWaitSeconds (default 3600, previously a hard-coded 10 minutes) caps a single header-supplied wait; its floor is the old constant, so a broken settings file can only make cast more patient, never less.
• Dangerous-command confirmations under the daemon. The prompt existed in the TUI and was skipped entirely when the same command ran through the server, which is what the web UI, cast run and ACP all use. The confirmation now travels to whichever surface is attached, with a five-minute timeout that refuses rather than assumes.
• A session's own project MCP servers. Under the daemon only the global ~/.cast/mcp.json was connected, so a project's .cast/mcp.json was silently ignored — the servers a repository ships for itself never appeared. Project servers are now started per directory and released when the last session in that directory goes away, on every path that drops one (close, idle eviction, permanent delete, throwaway session), rather than leaking processes.

Changed

• The compaction tail scales with the window. The 10k–20k envelope was written for a 128k model, where 20k is a sixth of the budget. On a 1M model the same constant made compaction a near-total reset: it fires at 726k tokens and left about 28k behind, discarding 96% of the context in one step. The ceiling is now 20% of the input budget, never below the old 20k and never above 100k — deliberately a maximum over the old constant, so every window up to 128k is untouched. Measured on one 1.26M-token history: 64k and 128k keep 21,106 tokens exactly as before, 200k keeps 31,645, and 1M keeps 94,882.
• Rules use Cursor's format. cast reads .cursor/rules as well as .cast/rules, .mdc as well as .md, and subfolders inside a rules directory — a project that already has Cursor rules needs no second copy of them. Globs follow minimatch strictly (* and ? never cross a /), which means globs: *.ts matches only the repository root, as it does in Cursor; write **/*.ts to cover a file type project-wide.
• The TUI's command dispatch is a registry. handleInput was a 2,228-line if-chain; it is now 47 lines over a table of routes that declares, per command, whether it may be submitted mid-run. Every routed command is exercised by a test, /quit included — it was the one regression the refactor introduced and the tests caught.

Fixed

• Automatic compaction never fired on the history that needs it most: one request followed by a few enormous tool results. Three defects stacked up, each turning compaction into a silent no-op — it ran every round, compacted nothing, emitted no event, and the context grew until the provider rejected it. The tail's five-prose-message minimum cannot be met by a handful of huge tool results and nothing capped the search, so the tail grew backwards until it swallowed the whole transcript; the fixed 10k–20k tail envelope ignored the model's own window; and the cut point could only be a user turn, of which a single agent run has exactly one, at index 0. An assistant row is just as safe a boundary — tool results always follow the assistant message that declared their calls — and is now the fallback. A compaction that finds nothing to do also says so instead of staying silent.
• A 32k model reserved 32k for its reply. maxResponseTokens defaults to 32,000, which is right for a 128k model and nonsense for a 32k one: the input budget is the window minus the reserve, so a 32,768-window model got a 768-token budget and compacted on its first tool call — a live run reading a 16-byte file compacted at 8,080 tokens of context, and would have again every round. Below 32k the budget went negative, which made the compaction check unconditionally true and collapsed the tail to a single message. 676 models in the catalog have a window of 32k or less. The reserve is now capped at half the window and the budget derived in one place; a 128k model is untouched.
• Compaction summaries duplicated their file tags and invented facts. The <read-files> block is appended deterministically from the tool_calls, but the previous summary was handed to the model with the tags still on and the update prompt says "PRESERVE all existing information" — so it copied them in and cast appended its own underneath, one more copy per round, with the model's transcription then displacing the real extraction. Separately the summarizer saw only the first 500 characters of each tool result, so it recorded "no MARKER value" for a file whose marker was on the last line — a false fact that outlived the messages it came from, and that one round explained with a Grep call that never happened. It now sees head and tail with the cut marked, and both compaction prompts say not to read a cut as absence or invent how something was established.
• An oversized compaction summary grew the context. Nothing bounded the summarizer's answer, so a model that replied with a wall of text made compaction increase the context (measured: 242k characters in, 472k out) — the next turn then sat closer to the ceiling and paid for another summarization that could do the same. Clamped at 8k tokens with a note saying it was truncated.
• A provider's Retry-After was clamped to the guessed-backoff ceiling. It is not a guess — it is the provider saying when its window reopens — but it went through the same 30-second cap, so a 429 saying "retry in 150s" was retried at 30s, refused again, and the turn died on the 120-second retry deadline having never once waited as long as it was told to. The deadline now bounds only cast's own guessing; an explicit instruction moves it out. Backoff also gets 25% jitter, so parallel subagents that hit one limit stop retrying in lockstep.
• cast run dropped the retry event entirely. A retry can be a long wait — minutes to hours with a quota wait configured — and it printed nothing on either stream, which reads as a hang.
• The daemon answered from the wrong directory. A session's rules, skills, AGENTS.md, ssh hosts, project trust and MCP servers were all resolved from the daemon's own working directory rather than the session's, so two sessions in different projects saw one project's configuration. Each is now resolved and cached per session directory, and cleared by /reload.
• Rules: a globs: *.tsx line threw a YAML alias error out of every caller instead of failing as one bad rule; nested rules matched their globs against the wrong path; a rule body of any size was injected whole (now truncated at 64KB with a note); and a rule file deleted mid-session kept applying.
• /undo deleted files without warning. Restoring a checkpoint removes files created during the turn, which the confirmation never mentioned. It now names them and asks.
• Share links leaked through the live relay what the saved share view hides.
• bash: cast failed to start where node-pty's native module cannot load — a distro Node links libnode.so while the official tarball is static, so a .node built against one is not portable to the other. The module is loaded lazily and background tasks fall back to a plain pipe rather than taking the whole tool down with them.

0.25.0

Changed

• Debugging discipline in the shared prompts. Three general rules, each measured on the behavior bench rather than guessed at. (1) When a task starts from something failing, running it to see the failure is the default first action rather than opening the source to reason about it — with one exception, added after both MiniMax-M3 and mimo-v2.5 declined the rule on a single-line operator inversion and were right to: skip the reproduction when what you read leaves exactly one nameable cause. Anything vaguer ("probably the cache", "looks like a race") still gets run, and verifying after the change is unconditional. (2) Inspect the tree with the tools (ls, glob, grep, read) instead of shelling out to ls -la/find/cat, and never probe for a path's existence before calling the tool that wants it — the tool's own error is more informative than the probe. A grep hit is still a pointer, not an answer: the file has to be read before saying what the code does. (3) In plan mode, ask only when the answer changes the plan — if rival answers produce the same Steps and differ in a detail (who does it, what it is called, when), write the step and park the detail in Assumptions with a pre-decided fallback. A question that stops the turn without changing what gets written spends the user's turn for nothing. Verified by A/B with alternating runs on identical code: 30/27/35 before the prompt changes against 35/33/36 after, a win in all three pairs, and the same average on a second model (mimo-v2.5, 35.3) as on MiniMax-M3.

Fixed

• bash: the tool never said that each call is a fresh shell. Every invocation starts in the session's directory, so a cd does not carry into the next call — undocumented, and a trace caught the model losing its directory exactly that way: cd <dir> && node check.js worked, the follow-up node check.js failed with Cannot find module .../check.js. The description now states it.
• bash: a background task whose command exited non-zero was reported as the shell having failed to start — Failed to start bash ("bash"): ls: cannot access '…': No such file or directory. The spawn-failure test matched "no such file or directory" anywhere in the output, which is what any command says about a path it cannot find, so a healthy shell running a failing ls was described as never having started and its real output was buried behind the wrong explanation. Detection now requires node-pty's execvp(3) failed marker or the shell naming itself at the head of a line.
• todo_write: the link between a todo and its plan step was lost whenever the model retyped the item. planStep is carried forward by matching the previous item's content exactly, but flipping one status means resending the whole list, and models routinely shorten an absolute path in it (…/note.txt becomes note.txt). The link — the open-work gate's only handle on that step — silently went with it, so approved-plan work read as unlinked. A second matching pass compares with directories stripped off path-like tokens.
• write: a file ending in a newline was reported with one line too many. "READY\n" came back as Overwrote … (2 lines) because the trailing empty split counted as a line, telling the model it had written a blank line it never wrote — an invitation to "clean up" a correct file.
• write / edit: an exhausted disk quota surfaced as Unknown system error -122: Unknown system error -122, write. libuv has no name for EDQUOT, so it arrives as code UNKNOWN with errno -122 and slipped past every case in the error description. Hit for real on a filled tmpfs, where it also broke writes the agent had every reason to expect to work. It is now named as a quota exhaustion, with what to do about it.

0.24.0

Removed

• Plugin marketplaces. The whole subsystem is gone: /plugin and its subcommands (install, uninstall, enable, disable, marketplace add/list/remove/update), the Plugins and Marketplace tabs in the web Settings modal, the enabledPlugins setting, the /api/plugin-content endpoint, plugin-contributed skills and hooks, and the ${CLAUDE_PLUGIN_ROOT}/CAST_PLUGIN_* substitutions that existed only for them — about 2,700 lines. Installing a plugin required a registered marketplace, and registering one cloned an entire catalog repository to disk (316MB across the three defaults on one real installation) to browse packages that were never installed. Skills, which is what the catalogs were used for in practice, are better served by installing them individually: ~/.cast/skills, a project's .cast/skills, or the universal .agents/skills path that npx skills add writes to and that cast already discovers. Hooks and MCP servers stay configurable through hooks.json and mcp.json as before. An existing ~/.cast/plugins/ directory is now inert and can be deleted.

Added

• skills.sh in the TUI. /skills-sh search, list-available, install and uninstall were reachable only from the web UI; the TUI had no way to install a skill from the universal index at all. Both surfaces now run the same code — argument normalization and the npx skills call moved into core/skills-sh.ts instead of living inside the web bridge. A pasted npx skills add … line and a https://github.com/owner/repo URL are both accepted, and an -a <agent> flag is dropped because that form installs only into one agent's directory, which cast never scans — the skill would silently never appear.

Fixed

• Skills: cast now honours the Claude Code skill fields that change behaviour, not just the six-field Agent Skills spec. user-invocable: false keeps a skill out of the slash menu while leaving it loadable by the model; arguments maps named $name placeholders onto positional arguments and argument-hint is retained for autocomplete; disallowed-tools removes the named tools from the model's pool for the rest of the turn and clears on the next user message; paths limits a skill to turns where a matching file is in context; ${CLAUDE_PROJECT_DIR} and ${CLAUDE_PLUGIN_ROOT} are substituted. Inline !`command` blocks — which 194 of 5,639 installed skills use, and which cast previously handed to the model as literal text so a body reading "Node: !node --version" looked like a completed check — now run for skills the user installed themselves, bounded at 10 commands, 10s and 2,000 characters each. They run for every skill regardless of source — refusing marketplace skills wholesale would have blocked the environment probes that are nearly all these blocks do, while a skill can already tell the model to run anything in prose. What a skill body must not be is a way around the checks a plain bash call faces, so each command goes through the same two gates: plan mode's read-only rule, and the dangerous-pattern confirmation (refused outright when no confirmation callback is available). allowed-tools stays parsed but unenforced for the same reason — a restriction may remove tools, never grant them. A skill's hooks: block is registered too, in hooks.json's shape: without it a skill whose whole point is "run the formatter after every edit" was inert. They join the run's hooks for the rest of it, and once: true drops a hook after it fires without blocking.
• Skills — Agent Skills spec conformance: cast rejected skills that the published spec calls valid, so packages from anthropics/skills or npx skills add were dropped at load with a diagnostic nobody reads. name is optional per spec and defaults to the directory name (it was required); description is only recommended and falls back to the body's first paragraph (it was required); a name that differs from its directory is legal, since name is a display name (it was rejected); allowed-tools accepts a YAML list as well as a string (only the string form parsed); and boolean fields accept yes/on/1 as well as true — so a skill marked disable-model-invocation: yes, its author saying "only the user may run this", had stayed model-invocable. The skill listing now also truncates description + when_to_use at the spec's 1,536 characters, which previously only capped description.
• Skills — built-ins: arxiv declared version and platforms, fields in no spec; packaging or uploading a skill with an unknown key fails outright rather than ignoring it. They moved to metadata and compatibility. systematic-debugging told the model to use superpowers:test-driven-development and superpowers:verification-before-completion — another ecosystem's names for skills cast ships as tdd and verification-before-completion — and tdd pointed at a code-review skill cast doesn't have. A test now fails if any built-in skill names a skill that isn't shipped, or declares a field outside the spec.
• Skills: a skill invoked without arguments handed the model its placeholders verbatim. args is optional on the skill tool, and the substitution returned early when it was absent, so a body written with $ARGUMENTS reached the model as the literal text $ARGUMENTS — which reads as an instruction to substitute something that already happened. Placeholders are now always resolved, to an empty string when there is nothing to put there; the same applies to ${CAST_SESSION_ID} outside a session.
• Rules discovery: the walk that finds nested .cast/rules directories was depth-bounded but unbounded in width, and it runs at startup and on every subagent spawn. A normal project costs nothing (cast's own tree is 68 directories, 13ms), but running cast straight from a home directory walked 9,392 of them — 333ms warm, 2s on a cold filesystem cache, paid again per subagent. The pass is now breadth-first with a directory budget, so it spends its effort on the levels nearest the root where rules actually live: the same home directory now takes 101ms.
• bash confirmations: npm publish --dry-run asked for confirmation as though it were publishing. It is the command a release checklist tells you to run before the real one, so prompting on it trains the habit of confirming without reading.
• Plan mode: the read-only bash gate could be bypassed outright. An environment prefix was dropped before any check ran — the parser reports VAR=value cmd as its own node and the gate discarded those — so LD_PRELOAD=/tmp/evil.so cat file, GIT_EXTERNAL_DIFF=/tmp/evil git diff and PAGER='sh -c …' git log were all classified read-only and then executed arbitrary code (verified against the gate itself). Separately, several git options run a command rather than describing what to show: --ext-diff and --textconv invoke the driver named by diff.<name>.command / .textconv, which a repository's own .git/config or .gitattributes can define — cloning a repository was enough — while -O runs its argument directly and --exec-path redirects where git looks for its own subcommand binaries. All are refused now; locale and timezone prefixes (LC_ALL=C sort) and the safe --no-ext-diff / --no-textconv forms still pass. Fifteen tests pin the gate, eleven of which fail against the old code.
• ACP: cast's own <system-reminder> blocks were replayed to the editor as if the user had typed them. They ride on role: "user" messages because the wire format has no better role — interrupt notices, the post-compaction state block, background-task completions — and session/load sent them verbatim, so an editor showed raw XML attributed to the person using it (one real store holds 158 such messages). The web UI and TUI both stripped them already; the ACP replay now does too, and a message that was nothing but reminders is skipped entirely. The stripping itself moved into one shared helper, since the bridge, the TUI and the web client each carried their own copy of it.
• Open-work gate: steering mid-turn didn't give the gate its budget back. The gate that nudges the model when it stops with approved-plan work still open is capped "per user prompt", and the follow-up path reset that counter — but a steer did not, so a message sent after the gate had spent its two nudges left the model free to stop with the work still open, exactly when the user had just asked for more.
• write / edit: a filesystem error came back as an unexplained internal failure, and sometimes as a misleading one. Writing to a path that is a directory reported write failed unexpectedly: EISDIR: illegal operation on a directory, read — the read being the load of the previous content for the diff, so the message pointed at the wrong operation — and edit on a file the agent may read but not write threw its EACCES straight out of the tool. Both now name the actual obstacle (a directory, permissions, a read-only filesystem, no space left, a symlink loop) and the file it applies to.
• todo_write: the list had no bounds, even though it is re-rendered into the system prompt on every build-mode turn and persisted with the session — so one oversized write is a tax on every later request and survives a restart. A 500-item list and a single 100,000-character item were both accepted. At most 100 todos and 500 characters per item now, with the limit named in the error so the model can split the work. Two todos with the same content are also refused: content is a todo's only identity (plan-step links and the TaskCreated/TaskCompleted hook diffs are keyed by it), so a duplicate silently inherited the other's plan step.
• skill: a skill whose file disappeared after discovery (uninstalled, worktree switched, repo moved) reported skill failed unexpectedly: ENOENT: no such file or directory… — accurate, and useless to the model. It now says the skill's file is unreadable, names the path, and suggests continuing without it.
• memory / session_history: a bad argument came back looking like an answer. Both tools took their limit as Number(args.limit) || <default>, so limit: -3 reached SQL as a negative limit and returned a single row — reported as "Found 1 match", indistinguishable from there genuinely being one — limit: 0 silently meant the default rather than nothing, and a fractional limit surfaced SQLite's own "datatype mismatch" as an unexplained tool failure. An unrecognized scope was equally quiet: memory fell back to the current project and session_history to the project scope, so a model that mistyped sessions as session was answered from a scope it never chose. All of these are now refused with the valid values named, matching what every other tool's limit already did.
• Worktree: /worktree remove destroyed uncommitted work and unmerged commits without asking. It passed git worktree remove --force and git branch -D unconditionally, bypassing both of git's own guards against exactly that — so removing a worktree you had forgotten held unsaved edits lost them, and a branch whose commits existed nowhere else went with it. Removal now asks git nicely: a tree with modified or untracked files is refused with the path and the --force command spelled out, and a branch git won't delete is kept with an explanation. --force (or -f) on /worktree remove opts back into discarding, in both the TUI and the web UI.
• Tool calls: a tool invoked with no arguments could never run on some providers. Several OpenAI-compatible providers send arguments: "" (or omit the field, which accumulates to the same) for a call that takes no parameters — ls and plan_done both allow that — and JSON.parse rejected it, so the model got back "Tool call arguments were truncated or malformed (invalid JSON). Retry the tool call" and could only answer by retrying the identical call until the doom-loop guard stopped it. Empty arguments now mean an empty argument object, which is what they are; genuinely truncated JSON is still refused as before. The same empty string also made the Hermes-XML recovery path treat every such call as mis-serialized.
• task: removed the 10-slot subagent semaphore. It was added when a batch of task calls in one model response was executed with Promise.all, which is no longer how the loop works — task is deliberately excluded from the parallel-safe set, so sibling task calls run in order, and a subagent cannot delegate further (the task tool is only advertised when subagent prompts exist, and a child is given none). At most one subagent per session was ever in flight, so the only thing the shared, process-wide limit could still do was make one session's subagent queue behind ten other sessions'. docs/architecture.md's claim that every tool call in a message runs concurrently was stale in the same way, and now describes the read-only-only rule the loop actually applies.
• task: a subagent's completed work was thrown away if its transcript couldn't be archived. The archive write sat inside the same try as the run, so a failure there replaced the subagent's answer with "Subagent failed with an error". subagent_runs.session_id carries a foreign key to sessions, so any subagent running in a session whose row wasn't on disk yet reported FOREIGN KEY constraint failed instead of its result — verified live, an answer the subagent had produced (and the provider had billed for) was discarded. A full disk or a locked database did the same to the memory-side progress file. Both writes are best-effort now and logged when they fail; losing the archive copy no longer loses the result.
• bash: every command a session ever ran was kept in memory, with its output. Nothing removed a finished task from the background-task registry, and on the TUI and web surfaces every foreground bash call goes through that registry — so a session accumulated up to maxToolOutputBytes (64KB by default) per command for its whole life: measured 3.77MB retained after 200 commands, and hundreds of megabytes per live session for a long one running thousands. The hundred most recent finished tasks are kept (which is what bash_output can plausibly still be asked about) and older ones are dropped oldest-first; a running task is never dropped.
• bash: a command that timed out but whose process refused to die left the turn hanging forever. After the timeout's SIGTERM and SIGKILL, nothing resolved the call if the process never reported closing — stuck in uninterruptible I/O, or reaped with its exit lost. The abort path already had this net; the timeout path now does too, and returns the output captured so far. The stray timers both paths left behind (including a heartbeat interval whose body was empty) are cleared on the way out.
• edit: a fuzzily-matched block was written back at the wrong indentation. Several matchers in the chain deliberately ignore indentation when searching — that is what lets an edit land when the model remembers a block without the file's leading whitespace — but the replacement was then inserted verbatim. Verified: replacing a method body inside a Python class dedented def go(self): out of the class, changing what the program means. The replacement is now re-indented to the level of the text it replaced, in the file's own indent characters (a tab-indented file is not re-indented with spaces), and an exact match is left untouched.
• edit: a file with one very long line could exhaust memory. The block-anchor matcher scores candidate lines with a Levenshtein distance that allocated one matrix cell per character pair, so the single 200KB line a minified bundle or generated data file is made of meant billions of cells — reproduced as a hard out-of-memory crash. The distance is computed over two rolling rows and capped in input length, which answers the same "are these roughly the same line?" question at a bounded cost.
• Tests: edit's matching layer had no tests at all, despite being the code that decides which span of a file gets overwritten. It has fourteen now, covering indentation realignment, the refusal paths (missing, ambiguous, identical, empty), and the pathological-line case.
• Prompts: the shared prompts still taught the model an edit API that no longer exists. They described read as returning "hashline anchors" (it returns plain N: content), told the model to recover from a stale-anchor error the tool cannot emit, pointed at "shared anchor guidance" that isn't there, and instructed it to change several places in one file by passing "multiple ops in one edit call" — edit takes a single oldString/newString pair and would reject that outright. All six now describe the tools as they actually behave.
• Cleanup: removed the unused hashline implementation — tools/files-legacy-hashline.ts, tools/hashline.ts, tools/hashline-cache.ts and their tests, ~1,900 lines that nothing had called since edit moved to literal text. plan.ts was still invalidating entries in a cache nothing filled.
• read: the whole file was loaded into memory no matter how little of it was asked for. Buffer plus UTF-16 string plus split array costs roughly three times the file's size: measured 592MB of RSS and 1.7s to return five lines of a 200MB log, so a multi-GB log, dump or .jsonl dataset took the process down before printing anything. A file over 8MB is now streamed and only the requested window is kept — the same five lines cost 11ms and no measurable memory. Binary detection also moved ahead of the read, instead of pulling a whole blob into memory only to reject it.
• write / edit: cast's built-in-UI guard blocked writes in unrelated projects. It was a substring test for /src/server/public/ and /dist/public/ against the path alone, so a user working on their own Node app that happens to have src/server/public could not have the agent write there at all (verified). The guard is anchored to cast's own installation root now, so it protects what it was meant to protect and nothing else.
• Background actors: a long-running background actor's lease was never renewed. It was set once when the actor was created and left alone, so after 45 seconds a perfectly healthy checkpoint writer, dream or distill run — all of which routinely take minutes — looked abandoned to any other daemon process: it claimed the actor, marked it stalled and started the same work over, while the original's own final save was rejected by the owner-token check and silently lost. The heartbeat now extends the lease along with the timestamp, and a resumed actor gets a fresh expiry instead of inheriting a stale one.
• Performance: the actor watchdog re-read every historical actor row every 45 seconds, in every process. Measured on a real store: 694ms and 53MB of fork transcripts parsed per pass, all of it thrown away because the rows were already in memory. The periodic pass now asks only for actors a restart could still act on (0.2ms), and a finished actor's fork context — which nothing can ever resume, and which is the bulk of the row — is no longer read at all, so the first load drops from 694ms to 36ms and the daemon stops holding 53MB of dead transcripts for its lifetime.
• ACP: session/close deleted the conversation. Closing a thread in the editor erased that session's history from disk — and, when its cwd was the session's own throwaway sandbox, that directory with it — which is not what close means in the protocol and left the list and load capabilities this adapter advertises useless for anything the user had closed. Close now unloads: the runner is aborted, the session's own MCP connections are released, unsaved state (mode, todos, an aborted turn's messages) is persisted on the way out, and the conversation stays on disk for the next session/load. Removing a session for good is /sessions in cast itself.
• ACP: closing one session in the editor tore down the MCP servers every other open session was using. A single StartupResult — and with it one MCP connection pool — is shared by every ACP session in the process, but session/close closed that pool along with the session's own editor-provided servers, so the remaining threads went on calling tools whose connections were gone. Only the session's own servers are closed now; the shared pool belongs to the process, exactly as the code's own comment already said.
• ACP: a paged session listing could silently skip rows or loop. A cursor naming a session that no longer existed (deleted between two pages) produced an empty page together with a nextCursor computed from index −1 — the editor was handed nothing to show plus a cursor pointing somewhere else entirely. An unknown cursor now ends the listing.
• ACP: a provider error mid-turn discarded everything the turn had produced. The loop appends assistant and tool messages into the session as it goes, but only the success path persisted them, so the next session/load replayed a conversation that stopped at the user's prompt. The partial turn is saved before the error propagates.
• ACP: every approval left a live 60-second timer behind — the timeout in the permission round-trip's Promise.race was never cleared, so the process could not exit until the last one elapsed, and a session with many approvals accumulated one such timer per decision.
• ACP: the editor's open buffers were injected in full on every prompt with no ceiling, so a few large files open in the editor (a lockfile, a bundle, a long log) could exhaust the model's context on their own and fail the turn with an error the user had no way to connect to the files they happened to have open. The injection now has a character budget, cuts a buffer short rather than dropping it silently, and says how many files it left out.
• Plugins: a marketplace manifest could delete and overwrite a directory anywhere on disk. The name in a third-party repository's marketplace.json — and a plugin's name inside it — were used verbatim as a directory component under ~/.cast/plugins, on a path that is rmSync'd recursively before being written. A manifest declaring "name": "../../../something" therefore destroyed whatever was at that path during a plain /plugin marketplace add; verified live against a throwaway directory, whose file was gone afterwards. Both names must now be a single ordinary path segment: a traversing marketplace name is refused outright, a traversing plugin name is dropped from the catalog so the rest of a large third-party catalog stays usable, and the paths read back from cast's own plugin state are checked to be inside the tree they belong to before anything is removed.
• glob / grep: a result outside the working directory came back as a mangled path. Shortening an absolute path to a cwd-relative one tested path.startsWith(cwd), which is also true for a sibling whose name merely begins with cwd's — so with cwd /w/proj, a hit in /w/proj-extra/a.ts was reported as extra/a.ts, a path that resolves to nothing and whose follow-up read could only fail. Verified live before the fix. Paths genuinely inside cwd are still shortened; anything else stays absolute. The same faulty test governed which files were recorded as context files, and is fixed there too.
• web_fetch (local backend): the 5MB response cap could not actually stop a large download. The body was read with arrayBuffer(), which buffers the whole response, and only then measured — so the check reported a limit that had already been blown, and a server declaring no Content-Length (or understating it) could stream gigabytes and take the process to an OOM kill before the guard it was supposed to be caught by ever ran. The body is now read chunk by chunk and cancelled the moment it passes the cap, so at most the cap plus one chunk is ever held.
• web_fetch (local backend): the response was always decoded as UTF-8, ignoring the charset it declares. A page served as windows-1251, iso-8859-1 or shift_jis — still common outside the anglophone web — came back as replacement characters, and the model had no way to recognize it as an encoding problem rather than a broken page. The Content-Type charset is honored, an HTML document's <meta charset> is used when the header carries none, and an unknown label falls back to UTF-8 instead of failing the fetch.

0.23.0

Fixed

• Web: a queued message the daemon delivers after a turn ends (a stranded steer, a follow-up) was submitted as a detached promise with no rejection handler. submit throws for a session no longer loaded — closed, deleted, or evicted in the window between the delivery being armed and firing — and Node's default for an unhandled rejection is to terminate the process, so one undeliverable message in one session would take the daemon and every other live session down with it. The failure is now caught, logged, and reported to the session as a notice.
• Database: migrations are identified by name, not by version number. Two lines of this codebase evolved the same schema and assigned the same numbers to different migrations, so a store carrying the other line's 29-32 treated this line's 29 as already-applied and its work silently never happened — the warning added earlier could report that, but not fix it. A migration now runs when its name has never been recorded, and is recorded under whatever version number is free; on the affected store this immediately applied the migration that had been stuck since August. Every up() is idempotent, so a re-run against a schema that already has the change is a no-op.
• Database: removed messages_fts, a second full-text index over text session_history_fts already covered. The two held the same message bodies — messages_fts was exactly the user/assistant subset, and the surviving index carries role, so the same searches are answered from one place (verified identical result sets on a real store). Every message write had been updating both indexes, and the redundant copy was ~11MB of a 547MB database. Its triggers and the seq-sync repair that maintained it go with it.
• Memory: a memory's fingerprint was taken from the raw type while the row stored the trimmed one, so " fact" and "fact" produced different keys for rows that are identical once stored — slipping past UNIQUE(project_id, fingerprint) and duplicating an entry.
• Auth: the daemon token was compared with === while the web password next to it used a constant-time comparison. Both now go through the same constant-time check; loopback-only either way, but the inconsistency is gone.
• Plan mode: a command reading its arguments from a file (strings @opts, the binutils convention) bypassed the per-binary flag scan entirely. Harmless for strings itself, which has no dangerous flag, but it would have silently defeated the whole check for any binutils tool added to the read-only allowlist later.
• Web UI: the turn-finished chime played even while the tab was in front and the user was watching the turn happen — the desktop notification beside it was already gated on the tab being hidden, the sound wasn't. It also built a fresh AudioContext per turn, which accumulates against the browser's per-page limit until later chimes silently fail; one shared context is reused now.
• Sessions: dropped the vestigial checkpoint_watermark_seq plumbing. The durable watermark moved to an immutable message id in migration 19, and nothing had written or read the old column since — it was still being carried through every session insert and upsert, including a MAX() merge that could never fire.
• MCP: an MCP tool call was capped at the SDK's 60 seconds, a limit that was neither reachable nor documented — a slow but legitimate tool (a browser step, a heavy query) simply failed with a timeout the user could do nothing about. mcpToolTimeoutSeconds now sets it (clamped 5–3600, unset keeps the 60s default), read per call so a change applies without reconnecting, and documented in docs/configuration.md.
• Hooks: a matcher's . meant two different things depending on the rest of the string — a single dotted name like mcp.foo was compared literally, while Edit.*, one character longer, was a regex that matched MultiEdit. Two matchers that look alike behaved in opposite ways. A dot is now a regex "any character" in both, while a |/, list stays a list of literal names so file matchers like package.json, README.md keep working. The matcher rules — including that a regex is unanchored, and that some events have nothing to match against — are now written down in docs/hooks.md.
• Hooks: the TUI's /compact fired neither PreCompact nor PostCompact, so a guard written to protect a long transcript was honoured by the web /compact and the automatic threshold but not here, and a bookkeeping hook never saw a manual TUI compaction. Both now fire, and a blocking PreCompact stops the compaction before it starts rather than after.
• Hooks: the Notification event — declared, matcher-aware and documented as part of the supported set — was dispatched from nowhere, so a hook written to ring a bell, post to Slack or flash a window never ran. It now fires at the two moments that actually warrant interrupting someone: a turn ending (successfully or with an error) and the agent blocking on the user, with notification_type set to turn_complete or input_needed. The five events cast genuinely cannot fire (Setup, TeammateIdle, Elicitation, ElicitationResult, ConfigChange) are no longer listed in the code as implemented — the docs already said so, the module's own comment didn't.
• MCP: a server that drops now comes back on its own. Recovery used to be a manual /mcp reconnect, which closes and re-resolves every server — fine as a deliberate action, far too blunt to automate, since one flaky server would take the rest down with it on each attempt. A dropped connection is rebuilt in place instead, leaving the others untouched, with five bounded attempts backing off from one second to sixteen; after that cast stops retrying and leaves the server visibly disconnected. A connection cast closes on purpose (shutdown, /mcp disable, a manual reconnect) is never retried.
• MCP: a server dying mid-session went unnoticed — the SDK's onerror/onclose are no-ops unless assigned, and nothing pruned the connection list. Its tools stayed in the system prompt for the daemon's lifetime, so the model kept calling them and kept failing, /mcp still reported it as connected, and the only clue was a transport error. A disconnect is now detected and logged, the server drops out of the prompt and the /mcp listing, and a call to it explains that it needs /mcp reconnect instead of surfacing a raw error.
• MCP: a turn sent while the daemon was still connecting its servers in the background ran without any of their tools and said nothing about it. It now says so, naming the servers.
• MCP: two different (server, tool) pairs can sanitize to the same tool name — every character outside [a-zA-Z0-9_-] becomes _, so a server called github.api with tool x collides with github and api_x. The lookup was last-wins while the tool list kept both, so the provider received duplicate function names and calls routed to whichever server happened to connect last — different between runs, with nothing reported. The first now wins deterministically and the collision is reported as a diagnostic.
• MCP: the daemon's shutdown never closed its MCP connections, relying on stdin EOF to end stdio servers once cast exits — a server that ignores EOF survived, leaving an orphaned child process behind every restart. Every other path already closed them explicitly.
• Hooks: hookSpecificOutput.additionalContext — the field the docs document for adding context to a prompt — was parsed, merged and unit-tested but never read by any caller, so it did nothing. What actually reached the model was reason, which is only populated on block-shaped output. additionalContext is now used, with reason as the fallback, capped at 8000 characters, and with a closing </hook-context> in hook output neutralised so it can't end the block early and have the rest read as cast's own words.
• Hooks: a matcher on an event that has nothing to match against (Stop, WorktreeCreate, MessageDisplay, …) is ignored and the hook runs every time. That behaviour is unchanged — changing it would silently stop existing hooks from firing — but it is now reported once per event+matcher, since a matcher that looks like a filter and filters nothing is the opposite of what the author intended.
• Worktrees: the WorktreeCreate hook is documented as able to cancel a creation, but it fired from exactly one of the four places that create a worktree — the TUI's /worktree, the --worktree CLI flag and POST /api/sessions {worktree} all went straight to the worktree helper and never asked. WorktreeRemove likewise never fired from the TUI. Both hooks now live inside the shared creation/removal path, so every surface honours them by construction and a new call site can't quietly skip one. A hook refusing a creation from the CLI now prints what the hook said instead of a stack trace.
• Hooks: a PreCompact hook could not cancel automatic compaction, though it is documented as able to cancel compaction and the manual /compact path honoured it — the automatic path awaited the hook and discarded its answer. A guard written to protect a long transcript therefore worked everywhere except the one path that fires on its own.
• Hooks: a hook that failed to run at all — a typo'd path, a missing interpreter, no execute bit — was indistinguishable from one that ran and approved: the exit code was recorded and read by nobody. Such a hook is now reported (with its exit code and any output), while still not blocking the turn. Verified on a live daemon: PreToolUse hook exited 127 with no output — it did not block, and its result was ignored.
• Hooks: timeout was honoured only by command and http hooks. An mcp_tool hook waiting on a wedged server, or a prompt hook waiting on a stalled provider, blocked forever — and with it any tool call the hook was gating. Both are now bounded by the same timeout and reported when they hit it.
• Compaction: a summarization call that succeeded with empty content still compacted — every superseded message left the working context and was replaced by a content-free marker, while the caller reported success. Providers produce this in ordinary ways (a reasoning-only stream, a refusal emitted as an empty assistant turn, a stream truncated without throwing). It is now treated like any other summarization failure: the history is kept and compaction retries on the next turn.
• Turns: the near-the-budget reminder was pushed on each of the last four iterations rather than once on entering that stretch, spending context on near-identical system messages exactly when the turn is short of room.
• Turns: requesting a per-run iteration budget against a session whose turn is already running dropped the budget in silence. The message still steers into the running turn, but a notice now says the budget applies to a new turn rather than this one.
• Agents: creating an agent failed outright on a database carrying the multi-tenant agents.user_id column — NOT NULL constraint failed: agents.user_id — so the feature was simply unusable on such a store (found on a real one). The row is now attributed to an existing user when that column is present.
• Agents: persona and provider were stored verbatim with no validation (PATCH even accepted persona: ""), and the spawn path then resolved an unknown persona to the global default and an unknown provider to the global endpoint silently — so an agent pinned to a provider the user later renamed ran somewhere else entirely, with only a confusing provider error later to hint at it. Both are validated at save time now, with the list of valid values, matching what /persona has always done; a session spawned from an agent whose pin has gone stale fails with 409 instead of quietly running elsewhere. An unknown model is still allowed on purpose — the provider's model list is remote and may be stale.
• Steering (message loss): a steer that arrived between the loop's last queue drain and the turn going idle was stranded — nothing drained that queue again, so the message was never delivered and the "Steer queued" chip stayed up forever. Follow-ups already had a net for this; steering didn't. It now gets the same handoff, and both nets also run when a turn ends in an error, where neither used to.
• Steering (message loss): a steer already taken off the queue was thrown away when the turn hit its iteration budget — not persisted, no event, gone without trace. It's now kept in the conversation, with a notice saying it will be answered on the next turn.
• Plan mode: approving a plan now switches the session to build in the same call. The client used to resolve the approval and then separately switch the mode, so anything interrupting it in between — a closed tab, a dropped connection, a daemon restart — left the approval consumed and the session still in plan mode: the approval card gone, the model still read-only, and nothing left to approve again. Reproduced against a live daemon.
• Memory tool: asking it for an operation it doesn't have (operation: "store" — it only searches; durable memory is written for you at the end of a turn) answered with a plain empty search result, which reads as "your write didn't take". A real run took that at face value and went off editing MEMORY.md by hand. It now says what the tool does and doesn't do.
• Memory: an entry's importance/confidence were dropped when the model sent them as strings — importance: "95", which is what models routinely emit — silently replacing them with defaults, so a rule asked for at 95/90 was stored as 90/50.
• Memory (data loss): the project MEMORY.md file is the canonical store and the database rows are its projection, but the memory tool wrote rows only to the database — so everything the model ever stored was deleted by the next reconcile, the moment anyone searched memory or the file changed. Storing now writes through to the file, with the metadata a bullet can't otherwise carry (exact type, confidence, expiry) kept in a trailing <!-- cast: … --> comment that renders invisibly. Rows written before this are lifted into the file on the next reconcile instead of being dropped.
• Memory: only the first eight bullets of a memory file were ever indexed — the eight-entry cap on a single model response was also being applied to the whole canonical file, so everything below the eighth bullet existed on disk but could never be searched or injected. On this machine that was 8 of 18 bullets in one project.
• Memory: reconciling an edited file deleted every row for the project and re-inserted them, so a one-line edit renumbered every entry and re-tokenised the whole search index. It now merges: the file still decides which entries exist, but an unchanged bullet keeps its row, its id and its metadata.
• Memory: the raw file text was placed in the prompt ahead of the ranked entries it duplicates, so a small budget spent itself on unranked file content and dropped the entries that were actually retrieved. Ranked entries go first now, the file into whatever budget is left.
• TUI: a streaming reasoning block never drains into the static region mid-turn, and the live-region clamp re-measured its entire text on every frame — quadratic over the turn. Measured on a 371KB reasoning stream across 1500 frames: 1039ms of clamp work, worst frame 9.5ms; a 244KB single-line stream cost 1507ms with a 12.7ms worst frame and held 137MB of heap in the width cache. The clamp now measures from the end and stops once the remaining rows are accounted for, and width measurement gives up past the budget: 328ms / 3.9ms worst and 344ms / 3.8ms worst for the same streams, with the cache bounded so it can't retain a turn's worth of ever-changing tail lines.
• Web UI: the scroll-up page cache was an unbounded Map cleared only by /clear, so a tab left open for days kept the loaded history of every session ever visited — walking to the top of a 4000-message thread pinned all of it for the life of the tab. It now keeps the three most recently used sessions, and drops a session's pages when that session is deleted.
• Database (data loss risk): a version recorded under a different name than this build expects was skipped in silence, so whatever that migration does never happened. A real store had version 29 recorded by another line of this codebase (users-and-multi-tenant-columns), which meant this line's 29 — the one that adds the messages_fts_au trigger — was treated as applied while the trigger was missing, leaving exactly the stale-search-index bug it was written to fix. Mismatches are now reported loudly, and the trigger is restored by a repair migration under a free version number.
• Database: actor fork snapshots serialized the same transcript three times over (messages, inheritedMessages, and prefix + tail are all views of it) — 140MB of a 547MB store, the largest single row 21MB holding 7.8MB of distinct data. Only the transcript and its boundary are stored now, with the views rebuilt on read; existing rows are compacted on upgrade (140MB → 53MB here). Rows in the old shape still read correctly.
• Database: recorded session events (tool_start/tool_end/turn_end execution telemetry, reachable only through the events/history endpoint) had no delete path beyond the cascade on session delete, growing roughly two rows per tool call forever — 8377 rows and 60MB of payloads on one real store. They now expire on the same 7-day window as the rest of the telemetry.
• Performance: every message the web UI sent re-read and JSON-parsed the entire session history to check one field — the client-message-id dedup that makes a reconnect's re-send idempotent. Measured 62ms per send on a 4465-message session and growing linearly with history. It's now a bounded SQL lookup over the tail of the session (0.4ms), which is all a re-send can ever race.
• Web UI: the streaming block scheduler stored both a frame id and a timeout id in one ref and always cancelled it as a frame, so a pending throttle timer survived reset/take/unmount and fired a stale flush afterwards — and the id it passed to cancelAnimationFrame could cancel an unrelated pending frame that happened to share the number.
• Web UI: the retry-row cleanup allocated a copy of the whole loaded transcript on every token and thinking event, then usually discarded it unchanged. It checks first and only rebuilds when there's actually a row to drop.
• ACP: the editor-facing session listing loaded every message of every session off disk to build rows that only need an id and a cwd — 1.4s on a 600-session store, on every listing. It reads the same rows from the summary aggregates instead (42ms), which are also ordered newest-first, so the listing's cursor paging now walks a deterministic order rather than whatever order the rows came back in.
• Performance: deleting a session took minutes on a large store. Both message search indexes keep session_id/seq as FTS5 UNINDEXED columns and the per-message AFTER DELETE triggers delete by them — which FTS5 cannot index, so each of them scans the whole index, once per message. Measured on a real 185MB store: removing one 2786-message conversation took 241 seconds, holding the write lock the entire time, long enough for every concurrent writer to blow past the 5s busy_timeout. Deletes now clear each index with a single session-scoped statement instead, with the triggers dropped for the duration and replayed from sqlite_master afterwards: the same delete takes 0.3 seconds.
• Sessions: background sessions — cast's own working snapshots from checkpoint writers and memory dream/distill runs — were never deleted by anything. They don't appear in the sidebar or the picker, so they accumulated invisibly: 376 of 999 session rows and 23% of the stored content on one real installation. They now expire after 7 days, swept in bounded batches after the daemon starts listening (so neither daemon startup nor a concurrent writer waits on the sweep). A user's own conversations are never pruned, however old.
• Tests: a checkpoint writer is fire-and-forget, so it outlived the test that started it and reached the database after afterEach had already restored CAST_SESSIONS_DB — writing background sessions into the developer's real ~/.cast/sessions/sessions.db (358 rows had accumulated there). The two tests now await their writers, and opening the real database from a test run is refused outright, so a future leak of this kind fails loudly instead of silently polluting real data.
• API v1: a request naming a session that doesn't exist answered 400 on /mode, /plan-transition, /question and /clean-context, sharing a status with genuine bad-request errors — so status === 404, the documented contract and the only way an integration can tell a deleted session from a malformed request, never fired. It's a 404 now.
• API v1: the OpenAPI document drifted from the handlers in several places that would break an integration written against it: limit/offset on GET /sessions were undocumented and switch the response from an array to a paged object; provider/agentId on session creation, goal on chat, and multi-select answers on /question were missing; DELETE /share was declared as always ok: true when it answers ok: false for a session that wasn't shared; and the 404s on rename/pin/share/create and the 500 on chat weren't listed.
• Plan mode: the write/edit gate matched the plan file lexically (dirname + .md) and write follows symlinks, so a link planted at the plan path during an earlier build-mode turn — or by a prompt injection during one — redirected a write in "read-only" plan mode to wherever it pointed, after the user switched modes trusting nothing would be touched. The gate now resolves symlinks and refuses a plan path that is one.
• File browser: isInsideRoot, the single containment check behind every /fs/* route, was purely lexical, while every consumer (statSync, createReadStream, rmSync, renameSync) follows symlinks — so a link inside the session's cwd let the browser list, download, rename and delete outside the project, which is the one thing the check exists to prevent. Paths are now compared resolved (a not-yet-created destination by its nearest existing parent).
• Daemon: the event-recording side of onEvent ran unguarded, and loop.ts calls onEvent from around sixty places without a try/catch — including from the handler that reports a failed turn, so a database fault there escaped runAgentLoop entirely instead of just losing a telemetry row. Recording is now best-effort and logged. A failed saveSession in the message-persistence callback is logged too, rather than swallowed in silence.
• Sessions: a session killed mid-tool-call (SIGKILL, an OOM — SIGTERM/SIGINT already write aborted results) was bricked permanently. The assistant message with its tool_calls is deliberately persisted before the tools run, so it sits on disk for the whole call, and every provider rejects a history containing a tool call with no matching result — so every later turn in that session 400'd, with no way to recover from inside cast. Unanswered tool calls now get a synthetic "interrupted" result on the request path, which also repairs sessions already left in that state.
• Database: saveSession wrote the session row (bumping its version) and each of the turn's messages as separate statements with no transaction around them, so a failure partway left the row claiming a version whose messages were only half persisted. The whole save is now one BEGIN IMMEDIATE transaction, and a message is only recorded as persisted in memory once that transaction commits.
• Database: the pending-migration set was read outside the transaction that applies each migration, so two processes opening the database during the same upgrade both saw a migration as pending — the second one's bookkeeping insert then failed on the duplicate version and threw out of getDb(), taking the process with it. Several processes migrate independently (the daemon, a TUI picker, cast run, an ACP connection), and the window is seconds wide after an upgrade that rebuilds the search index. The check now happens inside a BEGIN IMMEDIATE transaction, which also means a concurrent migrator waits out busy_timeout instead of failing instantly as a deferred transaction did.
• Database: the connection singleton was published before migrations ran, so a failed migration left every later getDb() handing back a partially-migrated connection with no retry — the real cause then surfaced much later as a confusing "no such column". It's now published only after the connection is fully initialised.
• Sessions: one session row with a malformed JSON column (a partial write, a hand-edit) threw out of listSessions, hiding every session from the sidebar and the picker. The unreadable row is now skipped with a message on stderr, so the rest of the list still works.
• Settings: a settings.json with a syntax error read back as {} and the next updateSettings wrote that empty state out as the whole file — every provider entry and API key gone, no warning, no way back. It took no user action to trigger: the daemon calls updateSettings during an ordinary turn. The unreadable file is now moved aside as settings.json.corrupt-<timestamp> (with a message on stderr) before defaults are written, so its contents stay recoverable.
• Plan mode: two more writers on the read-only allowlist — file -C -m src compiles a magic source and writes src.mgc, and yq --split-exp writes one file per result regardless of -i. Also refuses ugrep's --filter/--view/--pager/--save-config, since grep is commonly a drop-in for ugrep and --filter is rg --pre by another name.
• cast run: a turn cut short exited 0 with a silently truncated answer on stdout — only reason: "error" was treated as failure, so the provider dropping the stream mid-response ("disconnected", which exists specifically to mark a cut-off answer) looked like a clean run to out=$(cast run …). Any reason but a clean stop or a user abort now exits 1 and says so on stderr. One-shot runs also dropped notice events entirely, swallowing the runaway-loop iteration cap, /goal budget exhaustion and model refusals — all of which end the turn with "stop"; they now reach stderr, as they already did on the interactive path.
• Plan mode (security): plan mode promises no code execution, but rg is on its read-only allowlist and ripgrep's --pre runs an arbitrary command per searched file (--hostname-bin runs one outright). Since plan mode also lets the model write any .md into the plans directory, rg --pre=sh q <plan>.md executed that file's contents at full user privilege — a complete escape from the read-only restriction. Both flags are now refused.
• Telemetry: every /api/* request was recorded under its concrete URL, so a shared thread's token — the only credential guarding an otherwise-unauthenticated read — was persisted into api_requests on every anonymous view and rendered in the dashboard's endpoint table. Requests are now recorded under the matched route's template (/api/shared/:token), which also stops each session id becoming its own row in the endpoint overview.
• Sessions (security): DELETE /api/sessions/:id/permanent passed the URL's id straight into rmSync(join(~/.cast/inputs, id), {recursive, force}). Node never normalizes .. out of req.url and the router's ([^/]+) matches it, so DELETE /api/sessions/../permanent recursively deleted the entire ~/.cast directory — settings with provider keys, sessions.db, keys/, skills/, plugins/, memory/ — and answered a misleading 404. Session ids are now validated as a single safe path segment, both at the delete entry point and inside sessionInputsDir itself.
• Auth (security): a discovered factory UI whose directory name matched a daemon route's first path segment disabled authentication for every route under it. mkdir ~/.cast/ui/api (a plain directory with an index.html, no createUi call and therefore no reserved-name check) made the whole API answer unauthenticated, POST /api/sessions/:id/chat and POST /api/settings included. The reserved-slug list now lives in one place and is enforced at discovery, so such a directory is never registered as a UI at all.
• Plugins: GET /api/plugin-content?id= joined both halves of name@marketplace as path segments without checking them, so ..@.. read outside the installs directory and the not-found error echoed the resolved absolute path.
• SSH keys (security): POST /api/ssh/key wrote the uploaded key to ~/.cast/keys/<name> with the client-supplied name used verbatim — no basename(), no traversal check — so a name like ../../.ssh/authorized_keys resolved outside the keys directory and turned the endpoint into a write-anywhere-the-daemon-can-write primitive. Now applies the same basename() rule the attachment routes already document.
• Reasoning: the system prompt told the model the globally configured reasoning level and supported-effort list, while the request itself carried the level resolved for that run — a session pinned to a provider with a different reasoning vocabulary read "Reasoning: high" in its prompt on every turn while actually running at "enabled". Both lines now come from the run's own resolved values.
• Server: every JSON POST route buffered the entire incoming request body into memory with no ceiling. The attachment-upload route's 25MB limit only applied after the whole (base64-inflated) body was already resolved and parsed, so a mistaken multi-gigabyte drop — or any client sending one — ballooned the daemon's heap before being rejected. Bodies past 48MB (headroom over a 25MB attachment's base64 encoding) are now refused with a 413 while still streaming, with the remainder drained rather than retained.
• Plugins: /plugin install's git clone can take seconds — a settings change from a concurrent command or another tab landing in that window was silently overwritten once the install finished, since its enabledPlugins write was derived from the settings snapshot read before the clone started. Now re-derives just the installed plugin's own enabled flag against current settings at write time.
• ACP: the ACP (editor/IDE) integration leaked a client connection reference on every session, for the life of the daemon process — closeSession cleaned up the runner, MCP connections, and open-document buffers, but never released the module-level map tracking each session's client, populated on every prompt. Any long-running ACP-connected editor (e.g. Zed) opening and closing many chat sessions over a work session accumulated these indefinitely.
• Search: compaction's marker-insertion could shift a kept message's row to a new position without updating its search-index entry (the index only synced on insert/delete, not on this seq shift) — a search hit on that message's content could resolve to the wrong row, and the stale entry was never cleaned up, silently accumulating dead rows in the index every time a session compacted. Existing databases get a one-time rebuild on upgrade.
• Dashboard: the "avg messages/session" stat ignored whatever time window was selected and always averaged over the entire database's history, shown right next to a session count that was correctly windowed — picking a short range (e.g. "last hour") could show a small, correct session count next to an unrelated all-time average from months of history.
• Telemetry: only the llm_requests table had retention pruning — tool_calls, api_requests, compactions, and memory_maintenance grew unbounded for the life of the database. api_requests in particular logs one row per HTTP request the daemon serves (page loads, polls, SSE reconnects), the highest-volume of the five. All five now share the same 7-day retention.
• Provider pinning: a session pinned to its own saved provider got silently reconciled against a completely different provider whenever the global active endpoint changed elsewhere (another session's /provider switch, the TUI, or a manual settings.json edit) — if the pinned session's model wasn't served by that unrelated provider, it got reset to that provider's default model, defeating the whole point of the pin. A pinned session's model is no longer touched by a global endpoint change that isn't its own.
• Plan mode: switching mode by any path other than the approval card's own buttons (the mode toggle, or /plan//build) while a plan question or approval was still pending left it dangling — the stale card could still render afterward, and answering it would run the approval against a session already in the other mode. Mode switches now clear any pending plan question/transition.
• Settings: the Memory, Quick Mode, Plugins, and Marketplace tabs (and Skills.sh) silently rendered an empty list when their data failed to load, indistinguishable from actually having none configured — a marketplace with an unreachable git remote, for example, looked identical to "no marketplaces added." They now show the same error banner the other tabs already did on a failed fetch.
• Model tab: the reasoning-level shown in /current (the Settings → Model tab header) was always the raw global level, even for a session pinned to a provider whose model doesn't support it — e.g. a global level of "high" next to a session pinned to MiniMax (whose reasoning vocabulary is enabled/adaptive/disabled) showed "high" even though the next turn would actually run with "enabled". The turn itself was already resolving this correctly; only the display was stale.

0.22.31

Fixed

• Compaction: the web UI / daemon-backed path never seeded lastPromptTokens into a fresh agent run, so the automatic-compaction check was blind for every turn after a session went idle and a new one started — a large session could silently skip auto-compaction turn after turn instead of proactively summarizing, risking a raw "context exceeded" error from the provider instead. Now seeded from the session's own persisted token count on every run.
• Rules: the nested-AGENTS.md/CLAUDE.md fix in 0.22.30 tracked touched files per runAgentLoop call instead of per session — a match found in one submit could drop back out of the prompt on the very next submit once the session went idle in between. Now persisted on the session like the sticky auto-rules already were.
• Overnight/long-running web sessions never got the day-rollover reminder (<system-reminder> noting the calendar date advanced) that the standalone TUI already had — wired the same way now.

0.22.30

Fixed

• Rules: nested AGENTS.md/CLAUDE.md files (in a subdirectory the agent touches, not the project root) had the same gap as the directory-rules fix in 0.22.29 — implemented and wired into the standalone TUI, but never reaching the web UI or a daemon-backed TUI session. Now injected there too, per-turn, once a file from that subdirectory enters context.

0.22.29

Fixed

• Rules: applyMode: "auto" directory rules (glob-matched, latching once a matching file enters context — Cursor-style sticky rules) and @name-mentioned rules were fully implemented and tested but never wired into the web UI / daemon-backed session path — only the standalone TUI (no-daemon mode) actually used them. A rule authored with globs never reached the model through the web UI or a daemon-backed TUI session, silently.
• Rules: a nested alwaysApply: true rule (e.g. apps/web/.cast/rules/style.md) was supposed to only apply once a session touches a file under its own subtree, but the per-turn rules formatter injected every always-apply rule from the whole project into every session regardless of scope — contradicting its own documented behavior. Fixed at the root: the formatter now renders whatever the (already scope-gated) sticky rule set contains, instead of independently re-scanning the full catalog.

0.22.28

Fixed

• Security: the web_fetch tool's "local" backend (an opt-in alternative to the default Jina Reader proxy, /web-fetch-provider local) fetched the model-supplied URL directly from the daemon's own process with no restriction on the target — a model could be steered into fetching 169.254.169.254 (cloud instance metadata), 127.0.0.1 (the daemon's own API — though still blocked by its normal auth), or any other address on the host's private network, and get the response back as tool output. Now refuses any URL (including a redirect target, checked on every hop, and a hostname's DNS-resolved address, to catch rebinding) that resolves to a loopback, link-local, or RFC1918 private range, before ever issuing the request.

0.22.27

Fixed

• Plugins: a plugin's git clone getting interrupted (process killed, network drop) left a .git directory that existed but couldn't be fetched or pulled from — every later install attempt hit the same broken repo and failed forever, with no way to recover short of manually deleting the directory. Install now falls back to a fresh clone when updating an existing checkout fails.
• Plugins: two installs targeting the same not-yet-cloned plugin at once (two tabs, a marketplace reload racing an install) could run two concurrent git clones into the same destination, corrupting it. These now serialize per destination.

0.22.26

Fixed

• Worktree: /worktree remove <name> had nothing stopping it from removing a worktree another live session (a second tab, or another session entirely) still had as its cwd — including mid-turn, while a tool was actively reading/writing inside it. git worktree remove --force bypasses git's own uncommitted-changes guard, so this could force-delete real uncommitted work out from under a running turn. Now refuses with a clear error when any live session still points at that worktree.
• Usage/cost tracking: aborting a turn mid-stream could silently drop real, provider-billed token/cost data — a provider can send a terminal usage chunk just before the connection actually tears down on abort, and that already-arrived usage was thrown away instead of recorded, under-reporting cost for any turn aborted after usage info arrived but before the stream's natural end.

0.22.25

Fixed

• MCP: two /mcp reconnect|enable|disable|uninstall (or /reload) calls in flight at once — two browser tabs, or a fast double-click — each closed and reopened the whole MCP connection set independently; whichever finished last simply overwrote the other's result, leaking the other's freshly spawned MCP server subprocesses with nothing left referencing them to close them. These now serialize, so a second call only starts once the first has fully closed/reopened.
• Settings: /mcp, /hooks, and /skills enable/disable now read the current settings from inside the same lock they write under, instead of reading beforehand — hardening against the same class of lost-update race for any future code path that adds an await between the read and the write.

0.22.24

Fixed

• Fork: forking a session with an attachment left the fork referencing the original session's attachment file, not its own copy — an attached file's path is embedded as text in the message that referenced it, not looked up by session id at read time. Deleting the source session afterward (Delete → permanently) removed that file out from under the fork, silently breaking a reference that still looked valid in its transcript. The fork now gets its own copy of every attachment, with its history rewritten to point at that copy — a fork is now a fully independent snapshot, matching how its message history already behaved.

0.22.23

Fixed

• Files/Changes panel: a renamed file (git mv, or a rename picked up by an editor) showed up as the entire file being freshly added, with no indication it was a rename and no old path — a single-pathspec git diff has nothing to compare the new name against, so it can't detect the rename. If the rename also had further unstaged edits on top, the staged half (the rename itself plus any staged content change) was dropped from the diff entirely, silently hiding real uncommitted changes. Renamed files are now diffed against both their old and new path so git's own rename detection populates the header correctly, and the staged and further-unstaged halves are now both shown as separate entries, matching how a plain modified file's staged/unstaged diffs are already handled.

0.22.22

Fixed

• Security: clicking an uploaded attachment in the composer's attachment panel opened it in a new top-level browser tab. For an .svg attachment, that meant the browser rendered it as a full document rather than an embedded image — so an SVG containing a <script> executed with the app's own session cookie. Attachments now open through the same in-app preview modal already used for the Files panel, which renders images via an <img> tag (SVG scripts never execute there) instead of navigating to the raw file.
• Security: the file preview modal (Files panel and, as of this release, attachments) rendered a Markdown file's content through marked straight into the page with no sanitization, so a .md file containing raw HTML (a <script> tag, an <img onerror>) executed when previewed. Output is now run through DOMPurify before rendering.

0.22.21

Fixed

• Session: resuming a session outside the web daemon (the TUI without a live daemon, or the ACP integration) reset the provider it runs against but left the newly-added per-session provider name stale, pointing at whatever it had been pinned to before. Reopening the same session through the web UI afterward could silently route it back to that old pin instead of the provider actually in use.

0.22.20

Added

• Memory: both project and global memory are now always loaded in full into every session's system prompt when they have content — not just pointed at by path, and no longer left to the model to proactively decide to search for. A saved fact like "this project uses SQLite, not Postgres" or a cross-project preference like "always write commit messages in English" is now simply present from the start of every relevant session, like ChatGPT's saved memories. Bounded by the same checkpointPushCaps settings (Settings → Memory → Caps) already used for checkpoint-rebuild context, so an oversized memory file doesn't silently tax every turn. Session checkpoint/notes/task-progress are unaffected — still pull-based, fully loaded only at an actual checkpoint rebuild.

Fixed

• Memory: a preference saved to global memory got no proactive recall nudge on a fresh session in a different project — only project-scoped memory triggered the "search memory before asking" reminder. Global memory now triggers it too (on top of the always-loaded content above).

0.22.19

Added

• Web: the New Session modal's provider picker actually works now — a session can be pinned to a specific saved provider, at creation or later via /model-selection, independent of whichever provider is globally active. Previously the choice was silently dropped before it ever reached the server, and the main model's endpoint was resolved from one config shared by every session, so switching provider in any session immediately redirected every other open session's next turn too.

Fixed

• Web: two saved providers sharing a base URL (different keys) could have a pinned session silently routed to the wrong one's credentials — sessions now record which provider by name, not just by URL.
• Web: Settings panel list actions (MCP/Skills/Hooks/Plugins enable-disable-uninstall) now show per-row pending feedback instead of relying on the modal's global busy flag, which flashed too briefly to tell whether a slower action actually did anything. Memory's numeric fields (checkpoint reserved/thresholds/caps) no longer clear a typed value before the save is confirmed, so a failed save leaves it there to retry instead of silently discarding it.

0.22.18

Fixed

• Server: a second server process (e.g. a dev-mode instance started outside the cast server CLI, which already refuses this) no longer silently overwrites ~/.cast/server.json registration for an already-running daemon, and no longer erases it on its own shutdown — cast server status/stop could otherwise start reporting "not running" or pointing at the wrong process while the real daemon kept running untracked.

0.22.17

Fixed

• Web: production static assets are now actually cache-busted after a deploy. The ?v=… stamping regex required a space after from that esbuild's minifier strips, so every local JS import except new-session-modal.js silently kept serving its pre-deploy body for up to an hour; the PWA service worker's cache name was also hardcoded and never rotated, so a cached module could be served forever regardless of HTTP caching. Both now update on every release.

0.22.16

Fixed

• Web UI: sidebar session item menu now closes on scroll/resize instead of drifting from its anchor row — its position was a one-shot snapshot taken on open that never tracked the row afterwards.

0.22.15

Fixed

• Web UI: sidebar session item menu (⋮ / right-click) is rendered once at the <nav class="sidebar"> level instead of nested inside each row/session-group. Those containers use content-visibility: auto for list virtualization, which made the menu's position: fixed mis-place and clip against a later group, or — after an earlier attempted fix — forced a relayout that jumped the whole list's scroll position when opened near the bottom.

0.22.14

Fixed

• TUI: /new and /clear now repaint CAST ascii banner (onRepaintHistory full clear + Static replay) like a fresh launch; ChatLog hard-cut no longer leaks ]<]minimax[>//think> — strips <think> and advances cut to next > boundary (verified 800 positions 0 dirty, 10 clamp tests).

0.22.13

Added

• Skills: presentation-builder promoted from global to builtin (5 presets minimal/corporate/bold/technical/editorial with PNG verify gate, 166+416+138 lines) and forge-review generalized from glab-mr to all forges (GitLab glab / GitHub gh / Gitea tea with threaded reply gate, 94 lines) — 13 builtins total.

0.22.12

Changed

• Skills: replace duplicated super-research (8 heavyweight modes) with proven obra/superpowers trio — tdd (red-green-refactor, seams), systematic-debugging (4-phase root cause), verification-before-completion (evidence-before-claims gate) — all builtin prompts/skills/ with 0 diagnostics; deep-research remains single research skill, learn-everything kept.

0.22.11

Fixed

• Appearance flicker: GET /api/themes now hydrates from localStorage cast:themes instantly; fresh list overwrites in background — Appearance tab paints with 18 swatches on first frame, no Loading flash.

0.22.10

Fixed

• Settings gt/lt display: Custom CSS hint and Default UI hint now show <style id="cast-custom-css"> and /ui/<name>/ correctly via JS expression (was < double-escaped to <).

0.22.9

Fixed

• New session: provider list without auto (explicit minimax etc.), verify ↻ (POST /api/provider/verify {provider}) on any pair, stacked provider/model, sandbox default, 1100×704 modals (like dashboard) with sticky footer, · active removed, Loading compact.
• Performance: GET /api/models?provider= no longer blocks modal open (708ms → 330ms, lazy on switch), GET /api/sessions paginated 50/page (585 total 172KB → 3.5KB) with Load more + guard.
• Reasoning: showReasoning default true (parity TUI/web), LiveStreamingBlocks streaming via collapseMidWordBoundaries.
• PWA/offline: manifest.json + sw.js (shell cache, network-first for /api/), index.html manifest + register, turn_end (sse-events.js:204) Notification + 880Hz beep when document.hidden.
• Theme: Appearance Custom CSS (cast:customCss <style id> + storage sync) and cross-tab cast:themeColors / cast:ui:<name>:theme sync (factory lib/components.js).
• Settings: paddings unified 8px, loaders unified Loading (capital, no spinner, centered flex:1 min-height:120px), Updates loading centered.

0.22.8

Added

• Pluggable UI factory — reactive, no-build, agent-editable. src/server/ui-factory/template/ (Preact + htm via /vendor/*) with LAYOUT = {sidebar, THEME} and style.css tokens. POST /api/uis {"name":"my-ui"} or cp -r template ~/.cast/ui/<name> creates http://host:1337/ui/<name>/ and http://host:1337/<name>/ (also GET /ui lists). src/server/ui-registry.ts discovers ~/.cast/ui/* every request, chokidar watches ~/.cast/ui → GET /api/uis/events SSE ui_change → template auto-reload. Built-in skill prompts/skills/ui-factory (and references/*) teaches the agent to read/write ~/.cast/ui/* (files.ts:265 blocks src/server/public/dist/public).
• Settings → Updates with quick check. GET /api/system/version (current from package.json, fetchLatestVersion() with 3s race, isReleaseInstall()) and POST /api/system/upgrade (202 + setImmediate runUpgrade). SettingsUpdates (settings-panels.js) fetches on open with 4s client abort, shows Current v… / Latest v… + Check / Update to v… (only when isRelease && updateAvailable), dev — git pull hint otherwise. Lazy-loaded (settings-modal.js only visible tab).

Changed

• Base UI is now stable at /app (and /cast, /default, /base, /based, /core, /main). server.ts:2264 serves dist/public for all aliases + …/settings sub-paths, app.js:498 viewFromPath() strips prefix, navigate() preserves it. GET / stays default for compat, GET /ui lists factory UIs. Factory UIs also at /<name>/ for convenience (http://host:1337/claude-ui/).
• Install script opens firewall. install.sh:109 and install.ps1:92 now ufw allow 1337/tcp (and firewall-cmd/iptables/New-NetFirewallRule fallbacks) best-effort, so cast server --public is reachable without manual ufw.

Fixed

• Factory UIs are isolated and live-reload while open. Previously default at / could be overwritten by a factory write; now src/core/tools/files.ts:265 blocks src/server/public/dist/public and src/server/ui-factory/template, shared.ts:153 expands ~/, and server.ts serves extra UIs only from ~/.cast/ui/* with no-cache HTML.

0.22.7

Fixed

• Web UI: sending no longer hangs on "Sending…". The composer awaited the full waitForSessionStream (1.5s) + POST /chat before clearing sending, disabling the textarea and showing Sending… for the whole round trip. It now clears optimistically, debounces the Send button for 400ms only, and restores the draft only if submitMessage explicitly returns false (connection lost / upload failed). waitForSessionStream timeout is 400ms (was 1500ms) and textarea is never disabled by sending.
• Web UI: streaming renders markdown progressively. BlockView streamed plain textNode and only Message rendered markdown at assistant_message — lists, code fences and bold popped at the end with a height jump. Streaming content blocks now use StreamingMarkdown (innerHTML = renderMarkdown(patched)) on every RAF, with virtually-closed fences (odd fences → +\n\```) so code blocks appear early and grow smoothly. Final height matches settled height.
• Web UI: jump at streaming start removed. chat.css rise no longer translateY(3px) — opacity only — and respects prefers-reduced-motion.
• Web UI: turn timer starts only on SSE status:running. Previously it started on client pendingSince and jumped when turnStartedAt arrived (or disappeared after POST cleared pending). Now elapsed-timer.js ignores pendingSince and starts from server turnStartedAt (anchored Date.now()-turnStartedAt), App no longer passes pendingSince.
• Web UI: API client no longer hangs forever. api.js now uses AbortController with 15s timeout (30s for session/history) and propagates AbortError as Request timed out.
• Web UI: panel resize no longer leaks listeners. use-panel-resize.js now handles pointercancel, setPointerCapture, and cleans up on unmount; both diff and sidebar handles are robust.
• Web UI: sidebar search no longer races. Aborts previous fetch via AbortController instead of only a cancelled flag.
• Web UI: composer UX. Restores draft only when submitMessage returns false, keeps textarea enabled while sending (placeholder no longer Sending…), file input has accept filter, images get loading="lazy"/alt, tool cards are keyboard-accessible, and partitionFiles also matches by extension.

0.22.6

Fixed

• Web UI: Send→Abort switches immediately, no disabled-button dead air. The composer used to wait for the daemon's status:running SSE round trip before swapping the icon — for a beat the disabled Send button stayed on screen with the input already cleared, so it looked like the click did nothing. running is now flipped optimistically the moment the optimistic pending message lands, and rolled back on the two early-return paths (SSE not open, POST failure), so the Abort button is visible while the request is actually in flight. The TUI was already correct.
• Web UI: turn-timer no longer jumps when the daemon claims the turn. The composer clock used to switch from a client-side pendingSince (set at send time) to the server's startedAt the instant the first status:running SSE event landed — those live on different clocks, so the visible counter skipped forward or backward by tens-to-hundreds of ms each turn. The timer now captures the offset once on first server sighting and expresses startedAt in client time thereafter, so Date.now() − startMs stays continuous through the handoff. The offset is cleared between turns and on reload-mid-turn falls back to Date.now(), so reconnects still seed the counter correctly from the server timestamp.

0.22.5

Changed

• Provider reasoning protocol is auto-detected, not hand-picked. Adding a provider no longer asks you to pick a "Reasoning protocol" in the TUI — it's detected from the URL (openrouter, deepseek, qwen, minimax, …) and enriched per-model from models.dev, matching the web form. For proxy or aggregator endpoints the detector can't recognize, set it explicitly with /provider <name> reasoning <format> (or auto to reset to detection).
• /provider add just saves the provider. It no longer forces the new provider active and runs the model/reasoning picker (which made adding a second provider a surprising one-shot). It now matches the web form: verify and save; activate and pick a model later via the Model tab or /provider <name>. The only exception is the very first provider with no active endpoint, which becomes the default so there's something to talk to.

0.22.4

Fixed

• TUI input died after /reload and MCP reconnect commands. Re-resolving skills/MCP/personas could leave Ink's stdin unref'd and its readable listener dropped, so keystrokes echoed below the composer instead of entering it — only a terminal resize recovered. /reload, /mcp enable|disable|uninstall, and session switches now run a no-op suspension so Ink's resumeInput reinstates stdin (the same path a resize takes).
• No more ^[[6;1R / screen-jump on /mcp. The suspension cancels the in-flight cursor-position query (whose reply echoed as visible garbage once raw mode dropped) and no longer clears the screen, which made it visibly jump.

Changed

• Composer lost its box border. The round frame was cosmetic and could paint from a stale cursor position after resyncs, showing as a torn ╭──╭── line. It's replaced by a thin border-free ruled divider above the composer and above the status bar, and the prompt arrow sits at column 0.
• Raw console.log from core code no longer tears the TUI layout. Skill/ MCP warnings and a legacy-session warning were printed straight to stdout from code that also runs in the TUI process, breaking Ink's frame; they're now returned through the UI instead.

0.22.3

Added

• /evolve — create reusable skills on demand. Replace the old proactive auto-suggestion (which proposed saving a skill after every multi-tool turn and felt aggressive) with an explicit command. Run /evolve at any point in a session: it analyzes the conversation plus the project's typical tasks and proposes reusable skills, which you pick in a multi-select picker (TUI / web). Chosen skills are written to the project's .cast/skills/. Nothing is created without your selection.

Changed

• Stable daemon token. The loopback credential the TUI uses is now the same serverToken (persisted in settings.json) instead of a fresh random token minted on every daemon start. Previously a restart (cast upgrade, redeploy) silently invalidated an already-running TUI, so the next authenticated call — e.g. the skill-save confirmation — failed with 401 until it reconnected.

Fixed

• Settings numeric fields (web UI). The turn safety cap on the Bash tab always showed 500 even after saving; numeric fields in Settings (Bash cap + Memory numbers) felt laggy and couldn't be fully erased — a cleared field snapped back to the current value. They now show real values, edit in one pass, and number steppers are visible again.
• Memory settings labels show the default (e.g. "(default 13000)") instead of duplicating the current value that the field already shows.
• TUI elapsed timer anchors to the daemon's start time (resumes across reconnect instead of resetting to zero) and ticks at 100ms.

0.22.2

Fixed

• Settings numeric fields (web UI). The turn safety cap on the Bash tab always showed 500 even after saving — it never read the real value, so a save looked like it never happened. Now it shows the actual cap. Numeric fields in Settings (Bash cap + all Memory numbers: dream/distill interval, prompt budget, search floor, checkpoint reserved) also felt laggy and couldn't be fully erased — a cleared field snapped back to the current value. Editing now works in one pass, and number steppers are visible again. The Settings modal also stops force-refreshing the Model tab on every save (which was part of the lag).
• TUI elapsed timer. In daemon mode the status-bar counter restarted from the client's local clock on every reconnect or reload mid-turn, resetting to zero instead of resuming. It now anchors to the daemon's authoritative start time (matching the web timer), and ticks at 100ms so the counter reads continuously rather than jumping between tenths.

0.22.1

Added

• Skill suggestions after reusable procedures. After a turn that used many tools (4+) clearly following a repeatable workflow (cut a release, add a component with tests, run the dev server and verify it), cast proposes saving it as a project skill. The confirmation reuses the standard question picker in both the TUI and the web UI — pick "Save as /name" to write .cast/skills/<name>/SKILL.md, or "Dismiss". Conservative eval: trivial or one-off turns never suggest, an existing skill name is never overwritten, and declining once silences suggestions for the rest of the session.

Fixed

• Settings > Bash "turn safety cap" save. The save failed with a 400 because /turn-cap wasn't allowed in the settings command path that the settings modal uses — now it works from the UI as well as from chat.
• A daemon crash after multi-step turns. The post-turn skill eval ran fire-and-forget; an unhandled rejection inside it (cloning the message array) silently killed the daemon on Node 22. The eval is now guarded and stores a compact transcript instead of the full message list.
• Skill suggestion reliability. The eval verdict is parsed robustly even when the model inlines its reasoning before the JSON (which used to read as "not reusable"), and the "(recommended)" marker was dropped from the save/dismiss confirmation.

0.22.0

Added

• Configurable per-turn iteration safety cap. The loop's runaway backstop (a model that keeps calling tools forever could otherwise hang a turn) is now a setting: maxTurnIterations in settings.json, default 500 (range 10–10000), applied on the next agent call. Control it with /turn-cap [N|reset] (TUI + web palette) or Settings → Bash. /goal's own iteration budget still overrides it. Hitting the cap stops the turn with a warning; work done so far is never lost (persisted per tool batch).

0.21.0

Added

• /goal — bounded autonomous "work until done" mode. /goal <description> runs one turn that keeps iterating (tools → verify → fix) until the goal is met, without yielding for permission — at most one clarifying question if the goal is genuinely ambiguous. A leading number (/goal 10 fix the tests) or --steps N sets the iteration budget (default 25 model calls; each call can batch several tools). Near the cap the model is nudged to wrap up, and if it burns through the run stops with a warning — it never loops forever. Verified live: the agent fixed a bug, hit and fixed a real Node-22 node --test test/ gotcha, ran the corrected tests, and reported honestly.

0.20.0

Added

• /review — one word tells the agent to verify its own work: identify what changed (git diff / touched files), find and run the project's test and lint commands, and report honestly what was verified and what remains open. Works in the TUI and the web composer. The shared prompt carries the same honesty rule as the memory tools — the agent never claims a check it didn't actually run.

0.19.0

Added

• Live read-only share — a shared thread link (/shared/<token>) now streams the agent working in real time: tokens, thinking, tool calls, and status, with a · live badge. The visitor only ever receives display events (usage, steering, and plan state are filtered out) and there is no input surface, so the link is read-only by construction. On turn end the committed transcript refreshes.
• session_history tool gains scope=global — the agent's "second brain". Previously it searched only the current project's sessions; now scope=global searches across every project, so you can ask "when did we fix/decide X" and get the actual verbatim conversation, with the session title and date. Tool results now include that context.
• Models are told to quote history verbatim and never fabricate. The session_history and memory tool prompts now require quoting exactly what the search returned (numbers, paths, commit hashes) and admitting when a specific detail isn't in the results instead of inventing it.
• Sandbox cleanup — deleting a sandbox session also removes its throwaway folder (~/.cast/sandbox/cast-<id>) on every delete path (web, TUI, ACP). Real project directories are never touched (exact-match only), and the web delete confirmation warns when the sandbox folder will go too.

Fixed

• Shared links never worked for anonymous visitors: the public page loads app.js's full module graph, but only a hardcoded allowlist of static assets was public — everyone else got text/html for the modules. Every real static file is now public (data stays behind the gated /api/* routes); page routes like / still bounce to /login.
• Slow git operations no longer freeze the daemon: git worktree add, worktree remove, marketplace clone/pull/update, and plugin install now run asynchronously, so a multi-second git op doesn't stall every other session's streaming. Fast probes (rev-parse, worktree list) stay sync deliberately.

Performance

• Static asset responses are cached in memory — one app.js hit went from ~182ms (re-hash + re-brotli per request) to ~4.5ms.
• Chat POSTs are acknowledged immediately instead of awaiting the turn's async setup (provider reconcile, hooks) — measured 402ms → 0ms.
• SQLite WAL is truncated periodically while idle so it can't grow unbounded (observed at 155MB) and every later checkpoint stays cheap.
• Larger V8 young generation for the streaming daemon (fewer minor GCs).

0.18.0

Added

• Web telemetry dashboard with its own dedicated /dashboard route (and /settings as a route too, so both are navigable/bookmarkable and survive back/forward while the chat session stays mounted). Five tabs with 24h/7d/30d ranges:
  • LLM — requests, tokens, cost, cache rate, latency avg with p50/p95/p99, tokens/s throughput, and a paginated recent-requests table.
  • Memory — memory-tool search calls, maintenance runs (dream/distill), entries stored, maintenance tokens.
  • Performance — daemon API requests, latency percentiles, 5xx, per-endpoint table.
  • Reliability — retries, retry rate, moderation blocks, error-type breakdown including harness-specific doom-loop and empty-response types.
  • System — compactions, context use, file edits, and per-turn metrics (turns, tool calls/turn, tokens/turn, time/turn) plus tool usage with latency.
• Per-turn aggregation: every LLM completion and tool call is tagged with the client message id (turn_id), so one user request can be grouped into a single turn. Background maintenance (automatic dream/distill, checkpoint writer) is recorded as kind = background.
• Tool latency is measured per call (tool_start→tool_end) and shown in the System tab's tool-usage table.
• Settings and the dashboard close on Escape like every other modal.

Fixed

• /shared/* deep links were silently broken: serveStatic read req.headers["accept-encoding"] unconditionally, so the synthetic { url: "/" } request used by deep-link routes crashed into the catch block and 404'd. Optional-chaining fixes it (and unblocks the new /settings and /dashboard routes).

Internal

• Memory-maintenance pass timeout raised from 120s to 180s (matches the bash default) so a big project can consolidate without being cut short.
• New docs/dashboard.md; the builtin cast skill now documents its own TUI and web interfaces (references/tui.md, expanded references/web.md).

0.17.0

Added

• LLM error handling hardened. Moderation blocks are now surfaced as a clear "model refused the request" message instead of an empty (no response) (OpenAI content_filter / refusal field). Empty or reasoning-only replies are retried once with a doubled budget and a nudge telling the model to actually answer. OpenRouter stream_interrupted/PROVIDER_TIMEOUT and server_error codes are retried instead of failing the turn. MiMo/MiniMax gateway moderation (421) and risk-control (441) blocks are relabeled with the real reason from error.param.
• Context overflow on a 5xx is no longer retried blindly — it's routed straight to auto-compaction.
• Prompt-cache rate is visible everywhere — the TUI status bar and /current show the % cached next to tokens, plus a new Cost segment; the web status popover already showed it.
• A memory reference was added to the builtin cast skill, so asking the agent about memory in chat produces concrete answers (storage, /memory commands, how to enable/disable writing).
• Memory settings UI reworked to match the rest of the modal: themed inline inputs with a check-to-save and reset-to-default buttons, and no trailing punctuation in item descriptions.

Fixed

• Vision fallback retry was discarded — a model rejecting images got images stripped and retried, but the successful retry was thrown away and the turn still failed with the original 400. The retry now completes normally (verified against a real non-vision model).
• Concurrent checkpoint writers on the same project now serialize per project instead of racing on the same MEMORY.md (the second writer queued on the project memory lease could time out).
• Multi-message runs (steering/follow-up) duplicated earlier turn content in the persisted partial on an abort; the accumulator now resets per stream attempt.
• Thin-client TUI message send no longer keeps a stale [user · sending…] label on committed rows (Ink <Static> never re-renders them), and the resend-on-reconnect race is closed by claiming the message id synchronously on the daemon.
• Marketplace seeding no longer blocks the event loop: /plugin marketplace list|catalog (which the settings modal preloads in parallel with /memory) no longer triggers synchronous git clones on a fresh machine, which hung the Memory tab with "Loading…".

Internal

• Removed redundant per-message sending guards in both TUI and web thin clients now that the daemon dedupes by clientMessageId synchronously.
• Retry classification widened (408, stream_interrupted, PROVIDER_*, server_error, upstream wording); describeTurnError maps model_not_found, NO_PERMISSION, content-policy, and invalid_api_key to actionable messages.

0.16.0

Added

• Durable project memory now survives across sessions: project rules, architecture decisions, and cross-session facts live in plain markdown files under ~/.cast/memory/ (MEMORY.md, session checkpoint.md/notes.md/task progress, and a global MEMORY.md), with a SQLite full-text index derived from them for fast search.
• Checkpoint writers fire on context-window thresholds (default 4 × 20% up to 200K, 9 × 10% up to 500K, 18 × 5% above), clamped to the window minus a reserved safety buffer, so a fresh checkpoint exists when compaction needs to rebuild. checkpointThresholds, checkpointReserved, and per-section checkpointPushCaps are configurable and exposed in the TUI and web settings.
• Memory search covers the whole memory tree — session checkpoints, notes, task progress, spillover files, and (with memoryCcIndex) Claude Code memory under scope=cc. File-backed hits return a path plus snippet; a no-result search gives escalation guidance.
• Rebuild context after compaction is injected as bounded sections (tasks ledger, session checkpoint, project/global memory, session notes) with explicit "resume directly" framing and a tail-aware reminder.
• Claude Code memory indexing (memoryCcIndex) with frontmatter type parsing.
• A complete beginner-friendly Memory guide in docs/memory.md.

Fixed

• Checkpoint watermark is now an immutable message id, so compaction seq shifts can no longer invalidate it; a stale writer can't move the boundary backwards.
• Manual /dream and /distill now use JSON-only prompts matching what the caller applies — the real-model consolidation actually removes stale facts and packages repeated workflows instead of silently doing nothing.
• Checkpoint-writer sessions never self-compact, so a small-window run fails explicitly rather than derailing and advancing the watermark on empty state.
• Session-history search stays aligned after compaction (FTS rows now track seq shifts).
• Fork-mode checkpoint writers cover the latest turn and advance the watermark instead of stalling at the previous boundary.

Internal

• Memory is file-canonical: the SQLite index is a projection of the files, reconciled on search.
• Split dream/distill prompts into agent (file-tools) and JSON (non-agent) variants.

0.15.7

Fixed

• Disconnected clients no longer submit prompts. Web UI and TUI now gate sends on a live daemon/SSE connection, keep messages pending during outages, and retry with the same client id after reconnecting without creating duplicate turns.

Internal

• Tool tests use unique per-test workspaces. Parallel Vitest workers no longer remove one another's fixtures under test/__test_tmp__/.

0.15.6

Fixed

• The Files pane stays current after agent writes. Directory refreshes now invalidate even while the panel is closed, bypass browser caches, and ignore out-of-order responses so a late stale response cannot replace a newer file tree.
• Large attachments cannot race message submission. Send stays disabled until every document upload finishes, and deferred upload failures cancel the message instead of sending a prompt the agent cannot access.

0.15.5

Fixed

• Concurrent turns are serialized reliably. TUI, Web UI, and separate Cast processes now claim a session before starting work, preventing duplicate agent loops, interleaved history, and stale cleanup from releasing a newer turn.
• Web message retries are idempotent across reconnects. Client message identifiers, pending-message recovery, and ordered SSE updates keep prompts visible without creating duplicate turns.

Internal

• Tests now run inside per-test environments. Each test gets an isolated home, cwd, settings file, SQLite database, and daemon state; custom database paths create their parent directories automatically.

0.15.4

Fixed

• The landing page removes redundant explanatory chrome. Install commands now have accessible copy buttons with the Web UI's project icon style, and the footer is reduced to quiet GitHub and MIT License links.

0.15.3

Fixed

• The landing workspace preview now keeps its top bar focused on connection state. Removed the repeated product and repository labels, matched the connected status dot to the Web UI, and removed the duplicate persona/build footer.

0.15.2

Fixed

• Landing and documentation chrome is cleaner and consistent on mobile. Removed redundant workspace labels, session/model status noise, and repeated persona cards; themed scrollbars now apply to the Pages document and its scrollable content areas.

0.15.1

Fixed

• GitHub Pages workspace preview now matches the actual Web UI structure. Removed the misleading local-first badge, fabricated capability metrics, and empty composer; the preview now shows the real header, sessions sidebar, chat state, and interactive persona switching.

0.15.0

Added

• The GitHub Pages landing page is now a Cast workspace overview. It presents the session flow, personas, capabilities, installation commands, and documentation in a responsive desktop/mobile layout.
• Documentation code blocks now have build-time syntax highlighting. Language labels, readable dark-theme tokens, and horizontal scrolling make shell, JSON, Markdown, and other examples easier to scan on any screen.

0.14.0

Added

• Settings now has a Personas browser. Personas are grouped by source, with the existing info popover for short descriptions and the book action for reading the full persona prompt.

0.13.37

Fixed

• Web thread pagination now explains its state at the top of the transcript. Older-message loads show a visible loader, failures offer retry, and reaching the beginning is labeled explicitly.

0.13.36

Fixed

• Release archives now contain only the native PTY runtime for the detected platform and architecture. Installers select Linux, macOS, and Windows x64/arm64 assets, while old releases remain installable through a safe legacy fallback.

0.13.35

Fixed

• Session lists no longer parse every assistant message to count tool calls. Tool-call metadata is stored in an indexed SQLite flag, including a migration for existing databases, reducing list queries as history grows.

0.13.34

Fixed

• Web messages no longer disappear during session startup or reconnects. Chat waits for the active SSE stream before dispatching, keeps unacknowledged messages visible for retry, and rehydrates accepted messages when the stream is delayed.
• Message retries are idempotent. A client message id prevents a lost HTTP response or reconnect from creating a duplicate turn.

0.13.33

Fixed

• Release archives include the native PTY runtime. cast upgrade now installs node-pty and its native dependency alongside the bundle, so managed Bash background tasks work after a clean upgrade.

0.13.32

Added

• Long-running Bash commands can move to the background without a handoff. Interactive TUI and web sessions now run managed Bash tasks through PTY, automatically promote known server/watcher commands or foreground commands that exceed their grace period, and report the task id for progress and control.

Changed

• Updated Bash tool documentation and shared persona guidance for automatic background promotion, completion reminders, bash_output, and bash_kill.

0.13.31

Fixed

• Provider list now disambiguates entries that share a base URL. When two saved providers pointed at the same host with different API keys, the web UI silently treated the first one as active (the save ✓ never disabled, the chat footer showed the wrong name, and /provider list marked both as active). Lookup now matches by name (falling back to URL + key), and the provider row in Settings shows a green "active" badge for the one in use.

0.13.30

Fixed

• TUI recovers across daemon upgrades and restarts. Stale daemon connections now time out, reconnect to the current daemon, retry the message, and restore the session state over SSE.
• Web chat no longer loses the first message during SSE startup. A draft waits briefly for its active session stream, with bounded recovery when the daemon is temporarily unavailable.

0.13.29

Fixed

• Provider, model, and reasoning changes now stay synchronized. TUI and Web UI selections apply atomically, cancel safely, normalize unsupported reasoning levels for the selected model, and persist across daemon turns and browser reloads.
• Cross-surface model changes now take effect immediately. A model or provider changed in another client is picked up on the next turn without stale model metadata or transport settings.

0.13.28

Fixed

• Provider and model selections now persist together. TUI and Web UI provider switches update the main model provider, repair stale provider settings, and safely fall back when an active provider is removed.

0.13.27

Fixed

• Daemon TUI now handles injected queue events. Follow-up and steer messages are added to the transcript and removed from the pending list when the daemon injects them, instead of remaining stuck as Queued.

0.13.26

Fixed

• Follow-up handoff now waits for the runner's idle signal. TUI and daemon clients no longer depend on the timing of status or SSE events to start a queued request.

0.13.25

Fixed

• Local TUI follow-ups no longer remain stuck as Queued. Messages that arrive while a turn is settling are picked up and run after the current response completes.

0.13.24

Fixed

• cast upgrade now reports the final daemon state. After restarting a background daemon, the command verifies its new PID and identity, prints the running URL, and exits unsuccessfully if the replacement could not be confirmed.

0.13.23

Fixed

• Late daemon follow-ups now start reliably. A /queue or Web UI follow-up that arrives while the previous turn is settling is handed to a new turn instead of remaining stuck as Queued.

0.13.22

Fixed

• Resource commands now use subcommand-aware daemon gating. Read-only /mcp, /skills, and /ssh inspection remains available during a turn, while operations that change tools, skills, or SSH configuration wait until the turn is idle.

0.13.21

Fixed

• Daemon follow-up messages no longer get stranded. Queue requests that arrive just after a turn finishes now start a new turn, so /queue and the Web UI follow-up action remain reliable across the daemon API.

0.13.20

Fixed

• First-run daemon startup no longer fails without provider credentials. The daemon starts in setup mode and clearly directs users to configure a provider in the Web UI or use the terminal onboarding through cast.

0.13.19

Fixed

• Daemon restarts no longer create empty sessions. The startup-only session used to select defaults is no longer persisted, preventing one empty SQLite record from accumulating for every daemon restart.

0.13.18

Added

• Stable API v1 for daemon integrations. Alternative clients can now use the versioned /api/v1 REST/SSE contract for session lifecycle, agent control, history, files, settings, and daemon metadata without depending on private web UI routes.
• Published OpenAPI specification. Every daemon serves /api/v1/openapi.json; GitHub Pages publishes the matching checked-in snapshot at openapi/v1.json for code generation and CI validation.

Fixed

• API input failures are explicit. Malformed JSON and invalid appearance, SSH, or provider-verification fields return actionable 400 responses rather than leaking through as server errors.

0.13.17

Fixed

• Interrupted file searches stop immediately. /abort now cancels in-flight glob and grep processes (fd/rg) and their built-in fallback scans instead of allowing a search to continue after the turn was cancelled.
• Tool failures have a stable recovery contract. Every failed tool result now includes an error code, whether retrying is appropriate, and a suggested fix alongside its readable diagnostic. This is carried through the agent loop, SSE, and JSONL clients.
• Daemon abort recovery is covered end-to-end. A daemon session that aborts a stalled provider request reliably returns to idle and can start another turn.

0.13.16

Fixed

• Tool failures now tell the agent how to recover. Invalid arguments for filesystem, shell, SSH, search, and web tools are rejected before execution with the specific field and valid replacement range. Missing search paths are no longer reported as empty results.
• Destructive MCP calls now request write approval. The confirmation gate now recognizes Cast's real mcp_<server>_<tool> names, including when hooks are enabled.
• Failed background commands stay failed. bash_output now preserves timeout and non-zero-exit errors instead of displaying an ok status; bash and SSH also explicitly mark byte-truncated output.
• MCP and cancellation errors have actionable context. MCP failures identify the server and tool, while interrupted web requests are labelled [ABORTED] rather than as generic network failures.

0.13.15

Changed

• cast web is the primary browser entry point again. cast server remains a fully equivalent alias for daemon-oriented scripts and integrations, so either spelling manages the same daemon and sessions.

Fixed

• Daemon lifecycle is safe across restarts and upgrades. Cast now verifies the daemon's per-process identity before attaching to it or signalling its PID, so a stale state file cannot direct a client to — or stop — an unrelated process that reused the PID.
• Upgrades preserve a background daemon's address. cast upgrade restarts a verified background daemon on its existing host and port only after it exits cleanly. Foreground daemons are left untouched for their owning terminal to restart manually, preventing an automatic upgrade from cutting off active work.
• Long-lived daemons release inactive sessions without losing them. Idle sessions with no listeners and no active background task are unloaded after five minutes and rehydrated on demand; reconnecting clients recover authoritative pending state and report rejected control commands instead of silently losing them.

0.13.14

Fixed

• Opening a second cast while another was already running no longer strands the first on a dead daemon. Two concurrent launches used to race on the empty state file and each spawn its own daemon; the one that lost the race was never registered, and a TUI already pointed at it reported "Daemon unreachable" on its next message. Daemon startup is now serialized by an exclusive lock — concurrent launches wait and reuse the winner instead of stacking a second process.
• An idle TUI now survives its daemon being replaced. If the daemon is stopped, crashes, or is restarted by an upgrade, the next message in the open TUI re-reads the daemon state, reconnects to the new daemon, and retries — the session (owned by the central store) continues instead of erroring.

0.13.13

Added

• Live agent events are now persisted for audit/debug. Tool runs, retries, doom-loop stops, compaction failures, errors, and turn ends land in a new session_events table (readable via GET /api/sessions/:id/events/history). These are execution telemetry, deliberately kept out of the conversation history so the model never sees them as context.
• Versioned database migrations. Schema changes are now an ordered, tracked migration list (schema_migrations table) applied once each inside a transaction — the standard Flyway-style pattern — replacing the previous ad-hoc column checks. Existing databases migrate in place without losing any sessions or messages.

0.13.12

Fixed

• Stale cast web no longer becomes a phantom message. Upgrading from a pre-0.13.11 install (cast upgrade from 0.13.9 or older) used to restart the daemon via cast web start --port 0. Since the command was renamed to cast server, the new binary read web start --port 0 as a TUI prompt instead of a subcommand — a phantom [user] web start --port 0 message landed in a fresh session. cast web now prints a clear "renamed to cast server" error instead of falling through to the prompt.

0.13.11

Changed

• cast web is now cast server. The daemon was the single-writer backend every surface talks to, not just the web UI, so the name was misleading. The command, state file (server.json, auto-migrated from web.json), env vars (CAST_SERVER_*), and the settings key (serverToken, auto-migrated from webPassword) are all server now. The web UI is unchanged — it's just served by the cast server daemon. cast web is no longer accepted.
• The daemon is persistent and single-instance. It stays up after the TUI exits so background processes keep running and the web UI stays reachable; repeated cast/npm start reuse the one running instance instead of stacking orphaned processes.
• cast run and cast run --interactive now go through the same server daemon as the TUI and web UI. Sessions land in the shared store, -c/-s resume works, and JSONL commands (including /worktree, plan review, question answers) round-trip through the server's command surface.

Added

• Ctrl+L clears the composer in any state; idle Esc no longer wipes typed text (a stray press used to delete your message).
• E2E harness for the server paths: npm run e2e:jsonl (plan mode through the daemon) and npm run e2e:hooks (hooks firing on the daemon).

Fixed

• Stopping a running turn now needs a deliberate double-Esc; a single stray Esc no longer kills a long in-flight turn.
• The ASCII banner no longer disappears ~0.5 s after startup (a settle resync cleared it).
• Exiting is clean: no ^[[15;1R-style cursor-query garbage in the shell, and the last TUI frame is cleared.
• The question picker names exactly which option is missing its required value, so the model knows what to fix.
• Older session history loads a page at a time (/older or PageUp) instead of flooding the terminal scrollback on resume.

0.13.10

Added

• Older session history is paged instead of dumped. Resuming a long session no longer floods the terminal scrollback with the whole transcript (which pushed the viewport past the buffer limit and made the start unreachable). Only the most recent turns load; /older or PageUp loads more on demand.
• Ctrl+L clears the composer in any state. Idle Esc used to wipe typed text — a stray press deleted your message. Clearing now lives on Ctrl+L only, and Esc is reserved for stopping a running turn.

Changed

• Stopping a turn needs a deliberate double-Esc. The first press shows [Press Esc again to stop the turn]; a second within 2 s aborts. A single stray Esc no longer kills a long in-flight turn.

Fixed

• The banner no longer disappears after startup. settleResync (added in 0.13.7) cleared the screen ~0.5 s after mount, erasing the ASCII banner and composer frame because the banner lives outside Ink's tree. Light resyncs now reprint it.
• Clean exit: no terminal garbage after quitting. A pending cursor-position query (\x1b[6n) could have its reply echoed into the shell once raw mode dropped (^[[15;1R etc.). Exiting now cancels the query, stops polling, and clears the screen.
• The question picker reports exactly what's wrong. When a model omits an option's required value field, the error now names the offending option instead of a generic count message.

0.13.9

Fixed

• Text-only models stop receiving image attachments. When a provider rejects image_url message parts (e.g. deepseek-v4-pro on a text-only endpoint), the rejected image messages are now removed from the session — previously they stayed and every turn re-sent them, failing again. Models that don't support images now just see the file path.

0.13.8

Fixed

• Raw mode is re-asserted if the terminal drops it. Some terminals / SSH wrappers quietly restore echo and line buffering, which made typed text appear below the composer frame instead of entering it. A 2 s watchdog re-enables raw mode whenever it's detected as off.

0.13.7

Fixed

• Resumed sessions re-settle the layout. Opening an existing session replays its history, which could scroll the composer up mid-screen (input landing below the frame) with no streaming turn to trigger the usual repair. A light resync now runs shortly after mount to reposition the composer at the bottom.

0.13.6

Fixed

• A stacked display (composer rendered above the input) is now corrected. When DECXCPR scroll detection was unavailable, the cleanup resync never fired and the mis-rendered layout persisted; the resync now proceeds even without scroll detection, so the display self-heals.

0.13.5

Fixed

• cast upgrade now restarts a running daemon. Previously it replaced the binary but a live cast web daemon kept executing the old bundle until manually restarted, so fixes never reached the daemon process. If a daemon is running at upgrade time it's now stopped and restarted on the new build.

0.13.4

Fixed

• DECXCPR scroll-polling stops if the terminal never answers. A terminal that echoes the query instead of delivering it (raw mode lost, e.g. on resume) used to keep re-echoing garbage on every poll — now the poll gives up after the first unanswered query, so the flood can't recur even on a hostile terminal.

0.13.3

Fixed

• Composer input no longer goes dead on terminals that answer the DECXCPR scroll-poll slowly. The poll attached a temporary stdin listener per query, which swallowed keystrokes for up to 400 ms a time; the response is now detected through the composer's own input pipeline, and the poll skips terminals that aren't actually in raw mode.

0.13.2

Fixed

• DECXCPR scroll-poll responses no longer leak into the composer. The terminal's cursor-position replies (echoed while stdin drops out of raw mode, e.g. during a bash tool) used to land as visible garbage like ^[[67;1R or 68;1R in the input buffer. In-flight queries are now cancelled the moment the terminal suspends, and stray response remnants are dropped defensively.

Internal

• turn-runner-state tests now write their sentinel files behind a fake HOME, so a killed test run can never pollute the real ~/.cast/sessions/.

0.13.1

Fixed

• Abort is always responsive. Esc cancels a provider retry backoff immediately (no more waiting out a 30 s sleep); the OpenAI SDK's own uninterruptible retries are disabled (maxRetries: 0); a parallel tool batch closes after a 2 s grace even when a tool (e.g. a hung MCP server) ignores the abort signal — the turn always lands on "aborted".
• Turn errors stay in the transcript. A 4xx failure is committed to the chat history instead of sticking above the composer until the next turn.
• Question picker and plan/build mode work in the daemon-mode TUI. The question picker opens and answers go back over HTTP; /plan, /build, and the plan-approval dialog sync the mode to the cast web daemon so the next turn actually runs in the chosen mode.
• Provider/model switches take effect without a restart. A running cast web daemon picks up settings.json changes (made in the TUI or by hand) at the next turn, and reconciles a stale session model against the new provider's model list.
• Image files attach inline. Pasting (Ctrl+V) or attaching (Ctrl+G) an image path sends the image to the model as a real attachment instead of a bare path it must read.
• Provider retries surface in the web UI as a [Retrying (attempt N)…] row instead of a silent spinner.
• Undo checkpoints and subagent transcripts are persisted to the session database, so /undo history and subagent work survive a daemon restart.

Added

• ACP permission flow via the SDK. requestPermissionViaBridge now sends a typed session/request_permission request to the client (with Promise.race timeout of 60 s), instead of emitting a custom request_permission notification that the client couldn't reply to. The reply is the typed RequestPermissionResponse — outcome.outcome === "selected" with optionId === "allow_once" grants, anything else denies.
• Plan-mode pickers. onPendingStateChange wired through createPlanState — plan questions now surface as request_question notifications, plan transitions as request_plan_approval. Two custom extension methods (answer_question, plan_review) accept replies and resolve the pending state.
• tool_call.kind mapped to ACP constants: bash → execute, read → read, write/edit/patch → edit, grep/glob/web_fetch/web_search → search. Previously every tool reported its own name as the kind.
• available_commands_update sent once on session creation with the full slash-command list (SLASH_COMMANDS from src/ui/commands.ts). Names are stripped of leading / to match ACP conventions; input.hint is set on commands that take arguments.
• usage_update with full payload. Now sends { used, size, cost: { amount, currency } } per ACP spec — used is the current turn's token count, size is the model's context window, cost is the cumulative session cost in USD summed across all usage events.
• Multi-modal content in session/prompt. ACP v1 PromptRequest.prompt[] accepts text, image, audio, and resource blocks. text is forwarded as-is, image (base64 + mimeType) is converted to an image_url data URL and passed through cast's existing vision path (runAgentLoop already strips unsupported image_url parts — see loop.ts:1173). Audio and resource blocks are dropped with a marker note (cast has no audio/embedded-resource ingestion path through ACP yet).
• session/load and session/resume replay history. When a client opens an existing session, the bridge re-emits every persisted user/assistant message as user_message_chunk / agent_message_chunk notifications in chronological order, so the editor sees the conversation history. Replay is fire-and-forget — the session/load response is returned immediately.

Changed

• ACP bridge migrated to @agentclientprotocol/sdk. The cast acp wire transport is now powered by the official SDK (v1.3.0, zero dependencies, Apache-2.0) — all JSON-RPC serialization, schema validation, and protocol negotiations are handled by the library. The hand-rolled rpc.ts / types.ts / handler.ts / tools.ts / index.ts (≈600 lines) have been replaced by agent.ts (the typed acp.agent({ name: "cast" }) factory + handler registration) and bridge.ts (the cast-side adapter that translates AgentEvent into SDK sessionUpdate notifications and routes SDK requests into runAgentLoop). Method names now use the slash-separated protocol convention (session/new, session/load, session/prompt, session/set_mode, session/cancel, session/close, session/resume, session/list, authenticate). The old tools/list, permission/grant, permission/deny, answer_question, and plan_review methods have been dropped — tools/list was never an ACP spec method, and the plan/picker bridge (request_question, request_plan_approval) is deferred to a future iteration.
• Expanded agent capabilities. agentCapabilities now advertises promptCapabilities: { audio: false, embeddedContext: true, image: true }, mcpCapabilities: { http: false, sse: false }, sessionCapabilities: { close: {}, fork: {}, list: {}, resume: {} } — matching the structured shape editors expect instead of the previous flat boolean set.
• New ACP methods. authenticate (returns empty {}), session/list, session/close, and session/resume are now registered on the SDK agent. session/list reads from the SQLite session database and returns { sessionId, cwd, title }. session/close deletes the session and aborts its runner.

0.13.0

Added

• Single-writer daemon architecture: cast web is now the one process that owns runAgentLoop and is the only writer to the SQLite session store. The TUI (cast, no subcommand) is a thin client of it over HTTP + SSE instead of running the loop locally — on launch it auto-spawns the daemon on loopback (reusing one if already running) and renders from the same /api/sessions/:id/events stream the browser uses. A session opened in both the TUI and the browser now streams live (tokens, tool calls, status) to both surfaces, and abort/steer from either stops or redirects the turn for both. cast web stop now also disconnects the TUI's SSE stream. Set CAST_NO_DAEMON=1 to keep the TUI on the previous local-loop path (CI/headless).

0.12.28

Fixed

• Web sidebar: search showed "No sessions match " on every non-empty search, hiding the matches above it. The empty-state check compared the wrong list (the full session list, which is empty when a search is active) instead of the filtered list. Now the banner only appears when the filter actually returns nothing.
• Web Changes tab / Files tree: external file edits in the session cwd (IDE save, CI hook, touch, etc) now refresh the diff and the file tree in real-time. Previously the only source of refresh was the next agent tool_end. A non-recursive chokidar watcher on the cwd root fires an fs_change SSE event after a 500ms debounce while the session is idle, gated so it never races a running turn. Top-level and subdir paths both work; .git, node_modules, dist, build, and other noise directories are ignored. The native fs.watch path had an inotify max_user_watches ceiling that silently killed the watcher on real-world cwds — chokidar's pooling avoids it.
• Web sidebar footer: showed "No model selected" for a frame between mount and the /api/config response arriving. The sidebar now renders "Loading…" until the model has actually been fetched.

0.12.27

Added

• TUI: /reasoning-display command to hide reasoning blocks by default. The setting is persisted to settings.json and survives restarts.
• Web: reasoning-display toggle in Settings > Appearance, synced with settings.json.

Fixed

• Web streaming reasoning block: the 1200-character cap from v0.12.21–v0.12.25 is restored. An earlier v0.12.26 commit had removed it, which let long reasoning streams disable the TUI scroll guard and produce occasional "jumps" in the visible content. The cap keeps the cursor-below-viewport invariant that useTerminalResync depends on.

Internal

• Several experimental TUI reasoning-display tweaks that landed on master after v0.12.26 (1-row live preview redesign, \n flattening in live/settled history, hidden-think-block clamp accounting) have been reverted. They never shipped in a release.

0.12.26

Fixed

• Sidebar / picker row listing was slow on big DBs — listSessionSummaries and searchSessionSummaries previously built each session's summary by SELECTing every user/assistant content_json row, JSON.parsing the whole conversation, and counting turns in JS. On a 218-session DB that meant 9 MB of allocations and 9000+ JSON.parse calls per listing. The new path aggregates in SQL via covering indexes: user count and assistant count via idx_messages_role, the with-tool-calls slice via PRIMARY KEY + JSON filter then subtracted to preserve the old "exclude intermediate tool-call-only steps" semantic, and the first user message via a MIN(seq) JOIN on the primary key. Field-level semantics of the row's msgCount and firstUserMessage are unchanged. Measured on 57.131.129.41 with 218 sessions: TTFB on GET /api/sessions dropped from 448 ms to 138-163 ms (3x faster).

0.12.25

Fixed

• 400 context window exceeded now auto-recovers from the agent loop instead of killing the turn. When the LLM rejects a turn with a context-overflow, the loop now drops the largest tool result in history (any read/grep/web_fetch whose output is already anchored in the conversation and was being re-sent on every retry), replaces it with a short placeholder that names the tool_call_id, the size that was dropped, and how to re-fetch with a narrower scope, and appends a <system-reminder> so the model re-issues the call with offset/limit instead of asking for the same content again. The new path runs once per turn; if the in-place shrink wasn't enough the existing LLM-based compaction path tries next, so the user only sees a raw error after both options have failed. tool_call_id is preserved across the swap so the conversation stays wire-valid for the next retry.

0.12.24

Fixed

• TUI streaming flicker on every token: ThinkBlockParser.parseContent / flush returned the entire accumulated buffer on each chunk, but the StreamChunk contract is delta-only — downstream does content += chunk.content. The cumulative return made each per-token redraw re-render every prior line, so the assistant visibly typed "line by line" with each previous line reprinted before the next arrived. The parser now tracks an emittedBufferLen offset and returns only what's new since the last yield, slicing the underlying buffer with [emittedBufferLen, …]. The buffer is compacted only when the already-emitted prefix grows to a meaningful fraction of the total length (keeps amortised cost flat on long streams without shifting the offset). Covers both the think-block and content branches and the trailing-tail flush. Web UI streams ride the same parser, so the web client picks up the fix for free. Regression test added in test/vendors.test.ts.

Added

• Web UI file preview: copy-to-clipboard button next to the existing download icon. For text/table previews it copies the rendered content once it has loaded (disabled until then); for image/PDF it copies the preview URL. Brief check-mark confirmation via the existing icons.check for ~1.5s. Falls back to a hidden textarea + document.execCommand("copy") if the modern Clipboard API isn't available, and swallows denied-permission errors silently so the modal stays usable.

0.12.23

Added

• Web UI: cast web status is now reachable from inside the running browser session — new "Server" tab in Settings shows whether the daemon is running, its pid, host:port (with a "reachable from other machines" note when bound to 0.0.0.0), start time and uptime. Same info as the CLI command; the panel calls the new GET /api/web/status endpoint, which reads the daemon state file via readLiveWebState so a stale entry (process gone) is auto-cleaned on read.

Fixed

• TUI: a long reasoning stream (SPLIT_REASONING_CHARS = 1200) could render as N [reasoning] sections instead of one. appendTextBlock forced continued: false on the split-off chunk and on the previous block when a different kind took over, so the [reasoning] prefix in ChatLog rendered again on every mid-run chunk and on the tail at the kind boundary. The split-off chunk now inherits the source block's continued flag (block.continued ?? false) and the kind-boundary settle now preserves last.continued ?? false instead of forcing false — so only the very first chunk of the run carries the prefix, every later chunk is a silent continuation. Data is unchanged (still no loss across splits); the active tail stays bounded by the scroll-guard cap. stream-blocks.js is browser-neutral, so the same fix tightens the web UI's collapsed reasoning output for free.

0.12.22

Fixed

• Web UI: clicking a thread closed the sidebar immediately and highlighted only the newly-selected row, instead of waiting for the /api/sessions/:id fetch to land and glowing both old and new at once. setSidebarOpen(false) now runs at the start of selectSession (right after setSelectingId) so the drawer collapses instantly on big-thread clicks that take a second or two to load. The chat area's "Loading…" empty-state already takes over during the same window, so the user sees a clear "switching" state instead of a stale list with a mute click. The dual-highlight bug — isActive = s.id === activeId || selecting matched both the previous active row AND the new selecting one during the transition — fixed by switching to isActive = selecting || (s.id === activeId && !selectingId) (added selectingId as a prop so the formula can tell "this row is the picker target" from "some other row is the picker target"). Bootstrap / popstate paths don't go through selectSession, so their old "wait for response" timing is preserved.

0.12.21

Fixed

• TUI: long reasoning streams could trigger a rare scroll jump when the user scrolled up mid-stream. A single still-streaming thinking block grew unbounded and pushed the live region past the viewport, which disabled useTerminalResync's DECXCPR cursor poll (the natural cursor-below-viewport position looks identical to a user scroll). With the poll off, Ink's CUU + erase redraws landed at the wrong rows on user-initiated scroll and the visible content jumped. appendTextBlock now caps the active reasoning block at 1200 chars (SPLIT_REASONING_CHARS) — the older portion moves into a settled (continued: false) sibling that drains to <Static>, the active block keeps the tail. The live region stays within the viewport, the poll keeps running, and the scroll guard works as intended. Content and tool blocks are unaffected (content already drains via splitCompleteLines, tools stay compact).

0.12.20

Fixed

• First-run reasoning picker for MiniMax: buildReasoningParams for format "minimax" funneled every non-adaptive, non-disabled value (including "off" and stale levels like "low"/"medium"/"high"/"max" that can land here from a saved reasoningLevel set against a different provider) into { reasoning_split: true } with enabled: true. For "off" that meant picking "off" was a no-op — the server's always-on default still ran reasoning. Reorder the switch so off / disabled map to thinking: { type: "disabled" } with enabled: false (verified live against api.minimax.io), adaptive stays its own branch, and the always-on fallback serves only true "on" levels. Hotfix on the reasoning dialect ladder that landed in 0.9.10.

0.12.19

Added

• /undo command: rolls back the last turn — restores files from the turn's checkpoint (shadow copies of files the agent touched) and drops the last user message and everything after it. Refused while the agent is running (use /abort first). No-op when there's no checkpoint (very first turn, or /clear already rolled the session back). Web UI shows a [Undone: ...] notice when triggered from the client.
• /undo requires src/core/checkpoint.ts — shadow file storage + a marker on the parent commit for any new files added during the turn, restored on demand.

Fixed

• Web UI marketplace install: button no longer reappears after a successful install. The panel was reading data.plugins from its own props (always undefined — parent passed only data.marketplace), so the installed-plugin check silently failed and the row kept showing "Install" after install. Now the parent passes the installed list as a separate prop and refreshes it after every /plugin command.
• Web UI marketplace install feedback: per-row pending state with a spinner mid-flight plus a brief installed ✓ label on success. The modal's global busy flag only flashed for ~100ms, which read as a no-op click.
• Web UI marketplace block: stray horizontal scrollbar suppressed. .plugin-catalog-list had overflow-y: auto, which implicitly makes the x-axis auto too; long descriptions triggered a horizontal scroll where only vertical should exist. Explicit overflow-x: hidden keeps vertical scroll, kills horizontal.

Internal

• Biome warnings on new /undo and worktree code: removed unused imports (copyFileSync, realpathSync, sep, samePath in checkpoint.ts; createCheckpoint in commands.ts; AppConfig type in bridge.ts); hoisted a hot-path regex literal in commands.ts to a module-level constant.

0.12.18

Fixed

• Web UI settings modal layout on mobile: form fields stack vertically instead of cramming 3 inputs into one narrow row; select dropdowns (Web tab search/fetch) are full-width instead of clipped at 180px; marketplace plugin names truncate with ellipsis instead of overflowing the card with horizontal scroll.
• Web UI settings dom warnings: password inputs wrapped in <form> elements; API key field given autocomplete="off".
• Web UI model pickers streamlined: removed "(reasoning)" suffix from model names, removed "— @ provider" tags from section titles, sub-agent and plan-mode provider pickers now show "openrouter (default)" instead of duplicating the active provider in the dropdown list.
• Web UI composer: placeholder simplified to "Type a message…", max-height raised to 150px to prevent scrollbar on mobile.

Changed

• Web UI settings reasoning section: "Reasoning — current: off" simplified to just "Reasoning".

0.12.17

Fixed

• Web UI composer placeholder simplified to just "Type a message…" — the previous context-sensitive hints ("↑↓ to navigate, Enter to pick" / "Type your answer…") were truncated on narrow mobile screens and added no value since the picker UI is self-explanatory.
• Web UI composer textarea no longer shows a scrollbar on mobile when the text wraps past two lines. max-height raised from 100px to 150px, and overflow: hidden removed (it was blocking the JS auto-resize on iOS).

Internal

• 69 inline regex literals hoisted to module-level const declarations across src/ (biome performance/useTopLevelRegex), including all core modules (frontmatter, hooks, mcp, plan, plugins, rules, session, skills, tools/, llm, vendors, startup, upgrade), all UI modules (commands, keys, stdin-buffer, input-parser, word-nav, useTerminalResync, App), and all web modules (app, composer, message-submit, reasoning-split, sidebar-utils, tool-card, new-session-modal, server, bridge, commands).
• 16 noAwaitInLoops warnings suppressed with explicit engineering justification — all are genuinely sequential operations where Promise.all is semantically wrong or unsafe: the main agent turn loop, SSE streaming, MCP cursor pagination, provider probe retry, filesystem traversal (EMFILE risk), sequential file upload, and interactive SSH key/picker prompts.
• Removed one unused GITHUB_URL_PREFIX const in bridge.ts.
• text-replace.ts regex consts repaired after a broken replaceAll in an intermediate commit self-referenced one const and left three others unused. Tests back to 1508/1508.

0.12.16

Added

• /worktree <name> slash command — switch the running session into an isolated git worktree from inside the TUI. Behaves identically to the existing --worktree <name> CLI flag: creates the worktree at <repo>/.cast/worktrees/<name> on a fresh cast-<name> branch off HEAD (or reuses an existing one), switches session.cwd so subsequent bash/read/write/edit see the worktree path, and leaves the main checkout untouched. A new state event's cwd field reflects the change so headless consumers can observe it. Branches off findCanonicalGitRoot, so /worktree nested invoked from inside a worktree still anchors the new one at the main repo's .cast/worktrees/ dir — no linked-worktree-of-a-worktree.
• cast run --interactive (JSONL protocol) now accepts a command action that pipes a slash command through the same handleInput the TUI uses, so evaluators and headless agents can drive /worktree (and any other slash command) end-to-end without a real TTY. {type:"command",name:"worktree",args:" foo"} is the canonical shape. notice events forward transient toasts; state events carry cwd = session.cwd ?? result.cwd so cwd changes are observable.
• --worktree <name> / -w <name> (also on cast run) runs the session inside an isolated git worktree. The worktree is created (or reused) at <repo>/.cast/worktrees/<name> on a fresh cast-<name> branch off HEAD; bash, read, write, and edit all see the worktree path, and the main checkout is left untouched. Two --worktree runs in parallel never collide. Add .cast/ to your .gitignore. The worktree and branch are left on disk on exit — remove them with git worktree remove .cast/worktrees/<name> and git branch -D cast-<name> when done. Requires being inside a git checkout with at least one commit; both --worktree foo and --worktree=foo are accepted.

Changed

• cast -c / cast --continue is now scoped to the current working directory. Previously it resumed the most recent session globally (whatever project was last touched on the machine), which silently dragged the agent into an unrelated project when the user cd'd somewhere fresh. It now resumes the most recent session in the current cwd and exits 1 with a clear error if no session exists there. The "no session" check runs before provider-model fetch and MCP setup, so the failure path is fast (milliseconds) instead of waiting on a 15-second model probe first. --resume=<id> still works globally — the lookup by explicit id is not cwd-bound, since the user already knows which session they want. Mirrors claude -c's behaviour (an upstream tracker for the same bug is anthropics/claude-code#35226).
• Web UI: preact, preact/hooks, and htm are now served from /vendor/*.mjs instead of https://esm.sh/.... On a remote network with non-trivial RTT to esm.sh this removes 3 round-trips from the critical render path (~900ms saved on a 100ms-RTT connection, where each preact fetch takes ~400ms); on localhost the improvement is invisible because the round-trips are sub-10ms. CSP also drops https://esm.sh from script-src and connect-src since no code path needs it anymore. The google-fonts preconnect hints are downgraded to dns-prefetch since the only font load is user-initiated (Settings > Font) and the DNS resolution cost on every page load was wasted for the 99% of loads that never switch.
• Web UI composer submit no longer refetches the whole session list after sending a message. The previous loadSessions() round trip was redundant — the server pushes session_update SSE events with the new message count and auto-derived title after every turn — and it stalled the optimistic feedback loop so the user saw nothing change in the sidebar until the round trip landed.

0.12.15

Added

• Web Settings → Model tab now exposes a 3-state thinking control for MiniMax-M3 (Enabled / Adaptive / Disabled) instead of a single always-on toggle. The wire format matches the live OpenAI-compatible API: Enabled is the default (no field), Adaptive sends thinking: { type: "adaptive" }, Disabled sends thinking: { type: "disabled" }. The Web UI now surfaces the saved level in the section header (previously hard-coded to "off" because the web /current endpoint was not returning the field).

Fixed

• Web Settings → Provider tab no longer freezes the modal: SettingsProvider was calling useRef without importing it, so the click on the tab threw ReferenceError during render and Preact dropped the pane subtree. The picker now renders the saved providers, edit/delete buttons, and the add form.
• Web Settings → Model tab reasoning picker mirrors the saved level after apply. The dropdown previously snapped back to "Pick a level…" after a successful apply, which made the selection look lost; it now stays on the just-applied value and the ✓ button returns to its gray state when the picked value matches the current one.

0.12.14

Fixed

• Web UI theme picker now wraps long theme names inside the swatch button so the full label is visible instead of overflowing the card.
• Open-work gate no longer leaks the user-facing "falling through to the user" notice into the model transcript: it is delivered only through the open_work_gate_exhausted event, so a resumed session does not re-read the orphan reminder.

0.12.13

Fixed

• TUI question picker now forwards the user's free-form answer to the model instead of a literal (custom — see above) placeholder, and the web bridge accepts any value (not just model-supplied options), so a custom answer typed in the composer no longer gets dropped.
• Web question card now shows an inline textarea under each option group so the user can type a custom answer alongside the model-supplied options; the textarea is styled to match the option buttons.

0.12.12

Fixed

• Preserved Web UI tool card state (expanded result, open image preview) across the rest of the turn: a tool the user opened no longer collapses when another tool's tool_start / tool_end event arrives, and stays open through the final assistant_message swap from the live stream into the settled message.
• Added Content-Encoding: gzip for /api/sessions/:id and other JSON responses above 8KB; large agentic threads open noticeably faster on slow links (the /api/sessions/:id payload typically drops 5-10x with the repetitive tool output these threads contain).
• Added a (session_id, role, seq) index on the messages table to back getHistoryPage's boundary lookup and existence check.

0.12.11

Fixed

• Preserved in-progress Web UI reasoning and tool blocks across page reloads, including deterministic ordering while a tool is running.
• Reconciled active streaming snapshots with persisted assistant messages to prevent duplicated or reordered reasoning and tool cards after reconnects.

0.12.10

Fixed

• Fixed TUI and Web UI question pickers so multi-question flows do not reopen duplicate pickers or remain visible after answering.
• Fixed plan approval options to render vertically and removed duplicate plan decision notices.
• Fixed TUI plan mode so plan_done remains available after switching from Build mode, including providers that require explicit tool parameters.
• Added provider request timeouts and a bounded LLM retry deadline so Settings and stalled provider calls no longer remain in loading indefinitely.
• Updated question answer summaries to use the compact Question: … Answer: … format.

Changed

• Split token scoreboard metrics into input/output percentile columns and removed obsolete Commit and Consistent columns.

0.12.9

Fixed

• Fixed Web UI startup after the recent client modularization by restoring the resource-load and modal-focus hooks used by the root application.

Changed

• Split Web UI settings panels, message submission, panel resizing, and SSE handling into focused modules without changing the TUI or Web UI behavior.

0.12.8

Added

• Added a themed web sign-in page with HttpOnly, SameSite session cookies, SQLite-backed web sessions, disabled API caching, and failed-login rate limiting.
• Added provider-aware reasoning configuration documentation and built-in references for providers, web access, and project configuration.

Fixed

• Project-local hooks now participate in the project trust prompt even when .cast/hooks.json is the only local resource.
• Existing sessions now derive missing sidebar titles from their first user message, while explicit blank titles remain unchanged.
• Updated plan, MCP, hooks, skills.sh, tool, and eval documentation to match the current runtime and CLI behavior.

Changed

• Simplified the shared Cast prompt so configuration guidance has one source of truth in the built-in cast skill.
• Removed the obsolete prompt-secrecy rule from the open-project harness discipline.

0.12.7

Added

• Added a behavior evaluation bench covering planning, tool use, task execution, and other core interaction contracts, with a certification "Model Scoreboard" published on the docs site (--scoreboard on the eval runner records each model's per-case pass rate across at least 3 attempts per case).

Fixed

• Completed web planning transitions so plan decisions consistently reach the intended next state.
• grep: aligned glob paths across the ripgrep-backed and built-in fallback implementations, and fixed the fallback failing to match when the search path names a single file instead of a directory.
• Rendered escaped Unicode in tool results as readable text.
• Stabilized web settings and session interactions.
• Plan mode's read-only command check rejected safe commands like ls -la 2>&1 or cmd >/dev/null 2>&1 — fd-duplication and null-device redirects were caught by the blanket output-redirection guard even though neither writes a persistent file.
• bash: background tasks (run_in_background: true) no longer get killed by a default timeout — they're open-ended by default (dev servers, long builds) and only get a kill timer when the model explicitly passes timeout. A timeout of 0 or negative is treated as "no timeout" rather than firing almost immediately.
• /continue and starting a new session now restore the full session state (reasoning settings, turn metadata, title, pinned flag, todos, share token) instead of a partial subset, and reset SSH host resolution and provider/model validation consistently when switching sessions or projects.

Internal

• Added plan, task, and skill judgment cases plus single-tool core contract coverage; eval cases now support an isolated per-case working directory so a case's synthetic scenario can't be second-guessed against the real repo.
• Fixed a fixture race condition in the eval runner's --repeat mode where concurrent attempts of the same case corrupted each other's on-disk fixture state, and wired --baseline regression comparison into --repeat runs (previously single-run only).
• Synchronized evaluation and tool documentation with the current behavior bench and background Bash behavior.

0.12.5

Fixed

• Planning flow: complex build-mode tasks now consistently request planning before implementation, while an explicit user choice to continue in Build is preserved across subsequent turns.
• Web UI: plan-mode entry and plan approval now use the same choices as the terminal UI, including refine, immediate implementation, fresh-context implementation, and manual Build handoff.
• Web UI: every plan-mode decision is saved as a persistent system card in the chat history, so the selected path remains clear after reload.

0.12.4

Fixed

• Web UI: settings remain responsive when adding or removing Skills.sh skills, including when Settings is opened from a fresh root draft with no visible session.
• Tool output: valid JSON containing Unicode escape sequences now renders as readable text in both the web UI and terminal UI.
• Web UI: font previews are local and stable, so the picker shows each typeface immediately without late-loading flicker.
• grep: directory-component globs now match relative to the requested search path consistently whether ripgrep is installed or the built-in fallback is used.

0.12.2

Fixed

• Web UI: hover tooltips were silently broken on message rows after the mid-word boundary-merge rework — the PAD constant the tooltip layout depended on had been removed alongside the dead hover-cancel code path. Restored; tooltips on user / agent / reasoning rows, tool cards, and MCP tool rows are back.
• Web UI: when a streaming reply was truncated by max_tokens inside a model-emitted draft answer (i.e. reasoning had already closed and the model was emitting real content for the user when it ran out of budget), the partial answer was being discarded. The last accumulated content is now flushed into its own [agent] block — same way the answer-after-reasoning case was handled in 0.12.1.
• Web UI: mid-stream mouse movement no longer cancels a hover tooltip before it appears. The previous mousemove → cancel handler kept the tooltip code technically alive but fired on every cursor wiggle and never let the 500ms hover-intent timer complete. Removed; tooltips open on the intended timer and only the standard mouseleave / scroll / modal-open paths dismiss them.
• Web UI: the browser's native tooltip is stripped the moment the cursor enters the trigger element. Otherwise both tooltips render and the native one wins the race on leaving the page, briefly showing the plain title text over the styled bubble.
• Web UI: custom hover tooltips are suppressed on coarse-pointer / touch devices, where they have no interaction model and were firing on tap-and-release.

Changed

• Built-in cast configuration skill: split the 397-line SKILL.md into a short index + seven references/*.md topic files (personas, skills, marketplace, mcp, rules, hooks, commands). The skill now follows the agentskills.io progressive-disclosure convention — only the frontmatter + topic map (~1.6 KB) is loaded every time cast is invoked for a config question, and the matching reference file is read on demand. For a focused question (e.g. "how do I add an MCP server?") the model pulls just references/mcp.md instead of every topic.

0.12.1

Fixed

• Web UI: when a reasoning block ended with a markdown heading (a truncated answer draft that the parser flushed into reasoning because the model ran out of max_tokens inside <think> without emitting a close tag), the post-heading tail is now rendered as a separate [agent] block instead of sitting inside [reasoning] next to a blank agent area. Applies to live streaming, settled turns, and reload from disk.
• Web UI: when the model's <think>...</think> boundary landed mid-word (observed on MiniMax-M3 emitting </think> inside the Cyrillic word "Сейчас", so reasoning ended "...Сей" and content started "час уточню..."), the trailing word fragment is now glued back onto the agent's content. The user sees the model-intended continuous word — "Сейчас уточню текущую погоду в Астане." — instead of two halves separated across blocks. Same-script check (Latin↔Latin, Cyrillic↔Cyrillic) guards against false merges across alphabets; sentence-ending punctuation inside the fragment stays in reasoning.

0.12.0

Added

• Per-persona allowlists for tools, skills, MCP servers, and subagent types. Each persona's frontmatter now supports four knobs that all share the same shape (omitted = no restriction, [] = explicitly nothing allowed, exact names or *-globs):

  • tools: — built-in tool names (existing). tools: [read, grep, ls, plan_*, web_*] narrows the persona's builtin reach.
  • skills: — skill names invokable via the skill tool. skills: [research, deep-research] hides every other skill from the catalog and the runtime.
  • mcp: — MCP server names (not individual tool names). mcp: [postgres, playwright*] keeps only those servers' tools callable.
  • subagentTypes: — narrows subagents: true further. subagentTypes: [explore, review] is the only set this persona can spawn via task.

  Enforced at runtime (not just in the prompt text) — a disallowed call gets the same "not available" / "not found" / "Unknown subagent" message the model already gets for any hidden tool, so these actually isolate a persona's zone of responsibility. skills: / mcp: restrictions also forward to anything the persona delegates to via task, so the restriction can't be routed around by spawning a subagent.

  Default persona is now senior (the previous coding persona was a strict subset and is removed). coder-with-subagents-force-review is also removed — its review gate now lives in coder-with-subagents's own validation pattern.

0.11.1

Fixed

• cast web <typo of stop|status> no longer silently starts a new server daemon — any unrecognized subcommand now errors instead of falling through to the default "start" behavior.
• cast upgrade --<typo of --force> no longer silently attempts to upgrade to a "version" named after the mistyped flag — unknown flags now error before that logic runs.
• /ssh <typo of add|remove> (terminal UI) no longer silently falls back to listing hosts — unrecognized subcommands now error.

0.11.0

Fixed

• Skills.sh: installing via the web UI now actually lands where cast scans (~/.agents/skills/) — installs used to silently vanish depending on which agent flag was used.
• Skills.sh: pasting skills.sh's own "npx skills add ..." command into the install field now works, not just the bare owner/repo --skill name args.
• Skills.sh: the installed-skill list now shows the real source repo (read from the skills.sh lockfile) instead of a mis-parsed label that was always empty.
• Skills.sh / SSH: command output no longer leaks raw ANSI escape codes (cursor show/hide sequences) into the UI.
• Settings modal: a failed action no longer leaves every button in the modal permanently disabled.
• Diff/Files panel: a manually resized width now survives a page reload.
• Hooks: a hook that force-stops the turn no longer silently drops updatedInput/additionalContext contributed by other hooks in the same run.
• Hooks: a PostToolUse/PostToolUseFailure hook that blocks with no output of its own no longer has its block silently dropped.
• Hooks: two identical hook groups from different sources (e.g. a plugin and a project file) no longer share an id, so disabling one no longer disables the other.
• Hooks: a malformed hooks.json now surfaces a parse-error diagnostic in Settings and /hooks instead of silently loading as empty.

Changed

• Web UI: Marketplace tab browsing merged into one flat, searchable list across all configured marketplaces instead of per-marketplace tabs.
• Web UI: Skills.sh tab dropped the "list available" (browse-a-repo) field and the network-backed search box.

0.10.1

Fixed

• Hooks: ${CLAUDE_PLUGIN_ROOT} substitution in command strings so plugins shipped with Claude Code's marketplace (e.g. hookify, ralph-loop) load and execute unmodified.
• Hooks: case-insensitive tool-name matching in if conditions so if: "Bash(git commit:*)" matches payloads where the tool name is lowercase "bash".
• Skills: skill tool description in /skill-instructions now explicitly tells the model to call the skill tool (not read) and to load skills FIRST when the request matches a description.
• Personas: every persona's Tools section mentions the skill tool with a generic description (no skill-name examples, to avoid locking in a specific subset).

Changed

• Skills prompt listing now includes whenToUse alongside description (formatted as description — whenToUse) for richer model matching.

0.10.0

Added

• Hooks: full implementation matching the Claude Code protocol — shell/HTTP commands fire on lifecycle events to validate/block a tool call, log activity, or keep the agent working before it stops. Configure via .cast/hooks.json (project) or ~/.cast/hooks.json (global); manage with /hooks, /hooks enable|disable <id>, /hooks help.
• Web UI: Settings → Hooks tab, mirroring /hooks (per-source grouping, enable/disable toggle).
• Skills: dedicated skill tool replaces the model reading SKILL.md via the generic read tool — validates the name, enforces disable-model-invocation, and performs argument substitution in one call.
• Skills: $ARGUMENTS, $ARGUMENTS[0]/$0, and ${CLAUDE_SKILL_DIR} substitution in skill bodies, plus a when_to_use frontmatter field surfaced in the skill listing as description — whenToUse.
• Web UI: marketplace tabs with a plugin catalog browser (alphabetically sorted tabs and plugins, full descriptions).

Changed

• Web UI: Settings panel restyled — MCP/Skills/SSH intro text switched from a collapsible <details> to an always-visible summary line; item rows, plugin catalog entries, and theme/font swatches share a consistent card/hover treatment; Plugins tab renamed to Marketplace, settings tabs sorted alphabetically (opens first tab by default).
• Web UI: font swatches load their Google Fonts stylesheet so every option previews in its own font instead of falling back to the system font.

Fixed

• Case-insensitive tool name matching in hook if conditions.
• ${CLAUDE_PLUGIN_ROOT} substitution in hook command strings for plugin compatibility.
• Hook protocol parity — missing payload fields and output formats now match Claude Code's.
• MCP/Skills/SSH settings tabs now work while the agent is running.

0.9.14

Fixed

• Vision error fallback now catches 400 status codes in addition to 404, so provider image-rejection errors (e.g. oversized base64) trigger image stripping and retry instead of surfacing a raw 400 to the user.
• Per-file image read cap lowered from 25MB to 5MB to match provider limits, preventing images from being embedded only to get rejected at the API.

0.9.13

Internal

• Zero biome lint warnings/errors project-wide.

0.9.12

Changed

• todo_write is now guidance-based — the hard gate that blocked non-todo tool calls after 4 work actions is removed. The model decides when to use todo_write based on task complexity, same as opencode's todowrite.

0.9.11

Fixed

• Web UI: the Inputs tab loading state now uses the same "Loading…" style as every other panel instead of an inconsistent title-sized label.

0.9.10

Fixed

• Web UI: the Inputs sidebar no longer shows a stale "No files attached" flash when re-fetching after a document upload or during agent-response re-renders.
• Web UI: attached documents in a draft session (before the first message was sent) now work — the upload is deferred to submitMessage after commitSession creates the real session, instead of blocking with "send a message first".
• Web UI: a double commitSession call when drafting a session with pending documents created two separate sessions — files landed in the first, the message in the second, so the Inputs tab was empty while the chat showed the files. A single id variable now flows through both blocks.
• Web UI: the sidebar's "No sessions match" empty state no longer flashes during initial load before the session list arrives.

Changed

• Web UI: tightened chat vertical spacing — smaller gap, leaner padding, and reduced line-height for denser messages.

0.9.9

Added

• Session search (TUI and web) now runs on a SQLite FTS5 index over full message history instead of a JS fuzzy scorer — same relevance ranking in both interfaces, and a multi-word query now matches across different messages in the same conversation instead of only within one.
• web_fetch gets a second backend: "local" fetches the URL directly (no third party sees it) and converts HTML itself, with a Cloudflare-challenge retry, a 5MB response cap, and content-type checks that reject binaries. Switch with /web-fetch-provider jina|local (default stays jina).
• Web UI: an "Inputs" tab (right sidebar, ordered Inputs/Files/Changes) for a session's attached documents.
• Web UI: the composer's attach button now accepts documents, not just images — non-image files upload to a session-scoped directory and the model gets told their path via an invisible reminder on send. Executable/binary formats are rejected; archives and ordinary documents are allowed.
• cast web's MCP servers now connect in the background after the HTTP server starts listening, instead of blocking startup on every configured server (npx spawns, browser launches, remote handshakes) — the server accepts requests immediately, and connected tools become available in any open session automatically once the connect finishes.

Changed

• Web UI: the "Tools" settings tab split into three — Bash, Web, Quick Mode — each loading only the data it needs instead of five settings commands on every open.
• web_fetch: one retry on a transient network failure or 5xx (never on an intentional abort or a 4xx), and truncation now prefers the nearest paragraph break over a mid-sentence cut.

Fixed

• web_fetch now rejects non-http(s) URL schemes (file://, data:, ...) before ever making a network call.
• cast web status/"already running" could report a server as up before it was actually accepting connections — the daemon state file is now written only once the HTTP server is truly listening, matching its own documented contract.

0.9.8

Fixed

• Web UI: tooltips display as a single horizontal line instead of wrapping into a narrow column due to max-width and word-break constraints.
• Web UI: assistant_message handler now uses event payload (content/thinking/toolCalls) as fallback when streaming blocks are empty, preventing silently dropped messages on SSE interruptions.

0.9.7

Added

• Web UI: custom tooltip system — themed bubbles with fast appearance, viewport-aware positioning, no truncation.
• Web UI: keyboard shortcuts icon (heroicons-compatible outline style).
• Web UI: all settings tabs now have collapsible help sections (Model, Tools, MCP, Skills, SSH, Plugins).
• Web UI: SSH settings now support password authentication (requires sshpass).

Changed

• Web UI: Settings modal widened from 620px to 820px for better readability.
• Web UI: help sections in Tools and Model tabs now use inline hints after each section title instead of a single collapsible block.
• Web UI: theme swatches redesigned with grid layout — dot left-aligned, label centered.
• Web UI: every theme now carries its own background palette (bg, bgSurface, bgRaised, bgHover, border, borderActive) with improved contrast between UI layers.
• Web UI: 6 themes (Nord, Solarized, Catppuccin, GitHub, Dracula, Gruvbox) use official background colors from their design specifications.
• Web UI: reasoning blocks and turn-meta footer now use --text-dim for better readability.
• Web UI: chevron icon in collapsible sections replaced from CSS triangle to genuine Heroicon.

Fixed

• Web UI: loading spinners now centered in settings pane, diff panel, and file previews.
• Web UI: Tavily and Brave Search input fields aligned to equal widths.
• Web UI: SSH hosts form reordered — password field before key field.

0.9.6

Internal

• Removed unused formatActiveRulesPrompt — the per-turn rules path has used formatRulesForTurn (single combined <rules> block) since it was introduced; the legacy two-part formatter had no callers outside its own tests.

0.9.5

Added

• Two new built-in personas: researcher (web-search-driven investigation, cites sources) and assistant (general-purpose everyday help — advice, quick lookups, drafts — that reaches for tools only when a task actually needs them).
• Web UI: the Files panel's .md preview now renders through a real markdown engine (headings, lists, tables, links) and code files get real per-language syntax highlighting, both vendored for fully offline use. The Settings → Skills "read full content" view got the same treatment, in the same size modal as the file preview.
• Web UI: every finished agent reply now shows its own "provider · model · Ns" footer, persisted per-turn — a thread with several exchanges shows a footer under each one, not just whichever was most recent, and it survives a full page reload.

Fixed

• Web UI: a disabled plugin's skill still worked as a native slash command and stayed listed in the composer palette — both now correctly disappear.
• TUI: /plugin silently cloned three GitHub-hosted default marketplaces on first use with no way to tell where they came from. They're back as permanent, always-present catalogs (labeled "built-in" in the web UI), but non-removable and no longer a surprise — /plugin marketplace add is the documented way to add your own.
• Web UI: Chinese trigger phrases removed from three built-in skill descriptions; the command palette now truncates a long description with an ellipsis instead of letting it overflow the row.
• Web UI: clicking a file's icon or the empty space in its row (not just the filename text) now opens its preview, matching the whole row's hover/click-target styling.
• Web UI: fixed the Files preview's markdown spacing (was inheriting the chat's pre-wrap styling, doubling up as huge line gaps), added Escape-to-close, and removed a raw-then-rendered flash on a slow connection.
• Web UI: the stale "provider · model · Ns" footer and elapsed-time counter from a just-finished session no longer bleed into a brand-new session.
• Web UI: centered "Loading…" states that were pinned top-left instead of filling their container (Settings tabs, Status popover, Files panel's initial load).
• Web UI: a hand-approximated chevronUp icon path was fixed to match its actual Heroicons source.

0.9.4

Added

• A loaded skill can now be invoked as a native /<skill-id> slash command in both the terminal and web composer — it shows up in autocomplete with its own description, no /skill:name prefix needed. /reload (and enabling/disabling a skill in the web Settings modal) refreshes the list immediately.

Fixed

• Web UI: Settings could only be opened once a session existed — the gear icon did nothing on a brand-new draft thread. It now always opens; tabs that need a session (Model, MCP, Provider, etc.) show a hint instead of hanging on "Loading…" until one exists.
• Web UI: removed the redundant close button on the Changes/Files panel — the topbar toggle already closes it.
• Web UI, mobile: opening the sidebar while the Changes/Files panel was open (or vice versa) used to leave the one you just opened hidden behind the other, forcing a manual close-then-open. Opening either drawer now closes the other automatically.

0.9.3

Added

• Web UI: the Files panel now shows a live preview when you click a file — text/code renders as-is, images render inline, PDFs open in the browser's own viewer, and CSV/TSV render as a real table (auto-detecting the delimiter — semicolon, tab, or pipe, not just comma).
• Web UI: files and folders in the Files panel can be renamed in place, the same inline-edit as renaming a session in the sidebar.
• Web UI: the Files panel now refreshes on its own — a write/edit that lands while it's open shows up without collapsing and reopening the folder, and the diff/Files panel's open state and active tab now survive a page reload instead of resetting.

Fixed

• Web UI: the Changes/Files panel used to only mount once a session actually existed, so opening it on a brand-new draft thread reserved its column and left the space empty instead of showing anything — it now always renders, with a "No session yet" state instead of a gap.
• Web UI: the Settings tab strip on narrow/mobile screens scrolls but gave no hint that SSH/Theme/Tools were reachable further right — added a fade at both edges.
• Web UI: .modal-status, .modal-confirm, and .modal-share were silently stuck at the same 480px width as every other modal — a stylesheet ordering bug meant their intended (smaller) widths never actually applied.

0.9.2

Added

• Web UI: threads can now be shared as a public, read-only link (/shared/<token>) — no login required to open it, and it can be revoked at any time. The shared view never includes the persona's system prompt, only the conversation itself.
• Web UI: a "Quick session" button next to "New session" starts a fresh thread on a configurable default persona and a clean sandbox directory in one click, instead of going through the persona picker every time. The default persona is set in Settings → Tools.
• The favicon and browser tab title now match the app's actual identity — the tab reads "Cast" instead of "cast web", and the icon is the same pixel-block mark used in the app's own logo instead of a plain letter.

Fixed

• Web UI: the sidebar's session menu (rename/share/delete) no longer opens off-screen for a thread near the bottom of a short or scrolled sidebar — it now opens upward when there isn't room below.
• Web UI: markdown links ([text](url) and bare URLs) in replies are now rendered as real clickable links instead of plain text.
• Web UI: the persona picker under "New session" is no longer clipped with no way to scroll to the rest of the list at high page zoom or with many personas — it now shares one scroll region with the session list instead of a second, cut-off one of its own.
• Web UI: the "Apply" checkmark next to a model/provider picker in Settings no longer stays active when nothing was actually changed, matching how every other picker in Settings already behaved.
• Web UI: a stopwatch tick during every running turn was re-rendering the entire app ten times a second, visible as flicker across the whole page; it's now isolated to just the composer's own elapsed-time display. Settings' model pickers also no longer flash between a cached and a freshly-fetched list on open.
• Web UI: the "not a git repository" message in the Changes panel no longer renders as one lopsided centered line — it's a proper two-line message now.

0.9.1

Added

• Web UI: the final reply now shows a small, muted line with the provider, model, and response time — so a model switch is easy to confirm, and it's clear which model actually answered before deciding whether to switch again.
• The "Coder with subagents + forced review" persona was renamed to "Coder with mandatory review" for a more natural label.

Fixed

• Web UI and TUI: providers that interleave content/reasoning deltas out of order mid-turn (observed on MiniMax-M2) no longer render as broken alternating "agent"/"reasoning" blocks with a word split across the seam — same-kind text now merges back together across the interruption.
• Web UI: switching the model (/model) now updates the sidebar immediately and becomes the default for every session created afterward — previously a new session always reopened on whichever model was active when the server started, no matter how many times you'd switched since.
• bash, ssh, and background bash now cap output at true UTF-8 bytes instead of JS string length, matching how read already worked — for non-ASCII text (e.g. Cyrillic) the old comparison let through roughly double the configured byte limit. The default cap was also raised from 64KB to 128KB.

0.9.0

Added

• Build mode: a todo_write tool for tracking multi-step work as a checklist — persisted separately from the message history (survives compaction and process restarts), re-injected into the system prompt every turn, and enforced by the harness: after several tool calls with no list started, every further tool call is refused until todo_write runs. Not available in plan mode, which already has the plan checklist for the same job.
• Every persona's tool list now describes todo_write in its own voice — from qa's "one item per check in your verification pass" to architect's "rarely central here", matching how each persona already describes the rest of its tools.
• Web UI: code blocks in the chat now have a copy button (top-right of the block) that swaps to a checkmark on successful copy.

0.8.32

Added

• Web UI: an MCP server row in Settings now has a Reconnect button (next to the pause/resume toggle), so a server that was fixed on disk (new URL/token) doesn't need a full server restart to pick it up.
• Web UI: the sidebar's message-count badges now update live for every thread, including ones you don't currently have open, instead of only refreshing on a full page reload.
• Web UI: the status popover ("i") now shows the active provider and how many tokens were served from cache.

Fixed

• Web UI: numbered/bulleted lists with a blank line between items (common in model output) no longer render every item as "1." — each used to become its own single-item list.
• Web UI: runs of 3+ blank lines in a reply no longer render as an oversized gap between paragraphs.
• Web UI: opening a long thread no longer occasionally leaves the view short of the very bottom — the scroll-to-bottom jump is instant instead of an animated scroll that could lose a race with content still loading in.
• Web UI: streaming replies re-render at most once per animation frame instead of once per token, cutting the worst-case main-thread stall during a long, tool-heavy reply roughly 4x.
• Web UI: the status popover ("i") could fail to open entirely while the agent was running (reading the active provider was wrongly gated behind the same "must be idle" check as switching it).
• A turn cut short by the backend restarting no longer tells the model the user interrupted it — the reminder now says the server restarted instead of misattributing it.

0.8.31

Added

• Web UI: sessions can now actually be deleted — the sidebar row's rename/close icons were replaced with a single ⋮ menu (also opens on right-click) offering Rename and a real, permanent Delete. Previously the × only unloaded a session from memory; it stayed on disk regardless.
• Web UI: a themed confirmation dialog now appears before closing/deleting a thread, matching the rest of the app instead of nothing at all.
• Web UI: new sessions default to a fresh sandbox directory instead of the project root — using the actual project root is now the deliberate choice.
• Web UI: the empty-thread "cast" banner is now a crisp SVG logo (larger than before) that recolors with the active theme, replacing the old ASCII-art text render.

Fixed

• Web UI: closing a thread no longer leaves it as the fallback session when reopening the app with no ?session= in the URL.
• Web UI: the Tavily/Brave Search API key fields are now masked, the "Save & use ..." button label no longer renders literally as &, and a low-contrast hint line was removed.
• Web UI: the tool-call result expand/collapse arrow is now a proper icon instead of a tiny text glyph.
• Web UI: the streaming response no longer shows a blinking cursor (the composer's input caret is the only one now).

0.8.30

Added

• web_search supports Brave Search as a third optional backend alongside DuckDuckGo (default) and Tavily. Unlike Tavily's AI-search aggregation, Brave is an actual general web index — a more direct drop-in replacement for DDG. Configure with /web-search-provider (TUI) or the Tools settings tab (cast web).

0.8.29

Added

• web_search supports Tavily as an optional backend for anyone hitting DuckDuckGo's scrape rate limit (~4 requests per IP before a CAPTCHA blocks further searches) — Tavily's free tier is a recurring 1000 requests/month instead. Configure with /web-search-provider (TUI) or the Tools settings tab (cast web); DuckDuckGo stays the zero-config default.
• Web UI: tool call results are now expandable — click a tool card to see its full output (previously request-only), lazily rendered and capped at 64KB.
• Docs: a new research-grounded page on why persona/role framing changes agent behavior, linked from the personas doc and the landing page.

Fixed

• web_search: an empty query or one over Tavily's undocumented 400-character limit no longer fails with an opaque HTTP 400 — empty queries are rejected with a clear message, over-length ones are truncated so the search still runs.
• web_search: the tool's advertised parameters now match the active backend — region/time (DuckDuckGo-only) are no longer offered to the model when Tavily is active, where they silently did nothing.
• GitHub Pages landing page and README: the ASCII banner no longer overflows or visibly snaps to size on narrow mobile viewports — replaced with a static SVG that scales like any other image.
• Docs: corrected two fabricated author citations in the persona-research motivation section.

0.8.28

Fixed

• Web UI: reasoning text no longer mixes into the answer (with stray leading blank lines) when a provider streams <think>...</think> tags that split across chunk boundaries (MiniMax-M3 and similar) — the tag parser now buffers across chunks instead of scanning each one in isolation.
• Web UI: the composer's elapsed-time counter is now legible (accent color, larger) — it's the only signal that a still-running request is alive.
• glob: ** now recurses into subdirectories instead of matching only the top level.
• grep: the no-rg fallback now matches --glob directory components correctly instead of only comparing basenames.
• edit: no longer corrupts CRLF files into mixed line endings; multiple insert_after/insert_before ops sharing one anchor now apply in the model's listed order instead of reversed.
• write: byte count in the tool result now reflects real UTF-8 byte length instead of JS string length.
• read: limit: 0 is no longer silently treated as "no limit"; output is now also capped by byte size, not just line count.
• ls: symlinked directories are now classified as directories; missing/non-directory paths return a friendly message instead of a raw error.
• web_search: a cached query no longer permanently caps maxResults for later, larger requests against the same query.
• web_fetch: a request whose abort signal was already aborted before the fetch started is now aborted immediately instead of running to completion.
• ssh: a failure to spawn ssh/sshpass no longer crashes the whole process.
• Background bash tasks: a spawn failure no longer gets silently overwritten with a bogus "exited" status.
• The task tool no longer discards a subagent's usage/cost accounting when the subagent's loop throws.
• Ink TUI: the tool-call summary line now counts insert_before edits (previously always showed "+0 -0" for them).
• Plan mode: plan_check reliably matches real, markdown-formatted plan steps, including a step's own nested sub-bullets, regardless of exact wording.
• Plan mode: the "write a plan first" error from plan_done no longer references the removed plan_write tool.

Changed

• Plan mode: writing, editing, and reading a plan file now goes through the normal write/edit/read tools (gated to the plan file's path) instead of dedicated plan_write/plan_edit/plan_read tools — one less parallel implementation to keep in sync.

0.8.27

Fixed

• The super-research skill's description exceeded the 1024-character limit, logging a warning on every startup — it is now trimmed to a concise summary. Added a test that guards every builtin SKILL.md description against the limit so it can't regress.

0.8.26

Added

• Web UI: Settings > Provider — a "Verify credentials" button probes the entered URL + key on demand, and credentials are now always verified before a provider is saved; invalid ones are rejected with the reason (auth / unreachable) shown inline. Backed by a new POST /api/provider/verify endpoint, matching the CLI add wizard's probe.

Fixed

• Web UI: switching the active provider no longer leaves stale state — the model list refreshes immediately (no page reload needed), and the subagent/plan pickers no longer show a misleading "(inherits …)" hint for a model that isn't on the new provider. Selected models (main / subagent / plan) are reset on a provider switch since those ids belonged to the old endpoint.
• Web UI: the Model tab pickers now show a consistent "Pick a model…" placeholder for every slot, and the model name is no longer duplicated in the section titles.

Changed

• Web UI: the Provider tab is now a clean list (add / edit / delete). The provider a model slot uses is chosen in the Model tab next to each slot, and subagent / plan now clearly inherit the main model's provider ("same as main") rather than referencing a vague "active (default)" concept. /provider add makes the first-added provider the active default so the main model works without a manual switch.

0.8.25

Fixed

• Web UI: chat no longer flickers/remounts when toggling the diff panel, reconnecting, or reloading — an SSE reconnect effect was tearing down and rebuilding every message's DOM node on every diff-panel toggle and on every page load.
• Web UI: the saved theme now applies before first paint instead of flashing the hardcoded default accent while /api/themes is in flight.
• Web UI: personas/commands/themes/config are fetched once per tab instead of being re-fetched (and visibly re-flashed) on every SSE reconnect.
• Web UI: trimmed the cold-load waterfall — dropped an unused Inter font import that was blocking the whole JS bootstrap behind an external round trip, added preconnect hints, and a reload landing on ?session=<id> now fetches that thread in parallel with the session list instead of after it.

Added

• Web UI: Settings > Font — pick from 10 monospace and 10 sans-serif fonts (sans only affects interface text; code/tool output/tables stay monospace) plus a text-scale control (85%–150%), both applying instantly with no server round trip.

Fixed

• Web UI: picking a persona for "+ New session" no longer creates a session on the backend right away — it stages a local draft and only creates the real thread on your first message, like ChatGPT's new chat. Abandoned drafts no longer leave permanent "0 msg" entries in the sidebar.

0.8.22

Fixed

• Sandbox ("new") sessions now create their scratch directory under ~/.cast/sandbox/cast-<id> instead of /tmp/cast-<id>, avoiding tmpfs permission and quota issues. The sidebar button is renamed from "tmp" to "new".

0.8.21

Fixed

• Opening the directory picker after choosing "tmp" in the web UI sidebar no longer shows an ENOENT error — the picker is now only reachable for real, existing paths. The scratch directory for tmp sessions is created server-side at session-creation time and named after the session id (/tmp/cast-<session id>).

0.8.20

Fixed

• New-session directory picker in the web UI sidebar now shows the current directory and the "tmp" option as a single segmented control, with the active choice highlighted — clearer than the previous cramped label+path+button row.

0.8.19

Added

• "tmp" button next to the directory picker in the web UI sidebar — creates a /tmp/cast-<id> directory for throwaway sessions.

0.8.18

Fixed

• Web server now defaults to ~ as the session working directory instead of the directory where cast web was launched. Use the directory picker in the UI to choose a project directory per session. TUI mode still uses the current working directory as before.

0.8.17

Fixed

• Web UI Changes panel now shows all file types including untracked files (previously only tracked-file diffs were visible).
• git diff --no-index exit code 1 no longer silently drops untracked files from the diff response.

Added

• Web UI Changes panel groups files by status: New files, Staged, Modified, Deleted, Renamed — each with a colored dot indicator and section count badge.

0.8.16

Fixed

• Reasoning models that consumed the full max_tokens budget on thinking alone would silently fail. Now retries with doubled budget.
• Model validation incorrectly rejected reasoning models that return reasoning_content instead of <think> blocks.

Added

• SQLite-backed session persistence — sessions survive restarts.
• Web UI scroll-up pagination for long conversations.
• Turn-accurate message counts in session metadata.
• Full session history preserved across context compaction instead of being pruned.

0.8.15

Fixed

• Large tool results (big file reads, web fetches) could push a session past the context-compaction threshold mid-turn and only get caught reactively once the next model call overflowed. A new guard now compacts right after such a tool result lands, before the next call is made.

Internal

• Unified the three compaction call sites (turn-start check, mid-turn guard, overflow retry) behind one shared helper to keep their message-splicing and event-emitting behavior in sync.

0.8.14

Added

• Shared prompts adapted from an upstream terminal agent: Doing tasks, Executing with care, Tone and style.
• Cast context prompt — all personas now know about cast-specific commands, rules, skills, and plan mode.

Fixed

• Removed duplicate Action safety section from harness-discipline (now covered by Executing with care).
• Renamed cast from "coding agent" to "agent harness" to reflect all persona types.

0.8.13

Added

• New builtin skills from an upstream terminal agent:
  • arxiv — search, read, cite academic papers from arXiv
  • deep-research — parallel sub-agent research with cited reports
  • frontend-design — UI/UX design guidance
  • learn-everything — interactive learning from documents/PDFs
  • super-research — autonomous research experiments
• Updated cast skill with nested rules, apply modes table, and full commands reference.

0.8.12

Fixed

• Web UI: <system-reminder> blocks (compaction, date-rollover, interrupt reminders) now render as styled warning messages instead of raw XML tags after session reload.
• Web UI: SSE reconnect — full state sync from server, stale streaming blocks cleared, auto-scroll to latest messages, visibility change detection for mobile tab switching.
• Web UI: message count in sidebar now shows only user and assistant messages (was inflated by hidden tool/system messages).
• Web UI: header "cast" text replaced with themed status dot indicator (green=connected, yellow=reconnecting, red=offline).
• Web UI: ASCII banner no longer overflows on vertical mobile screens — added white-space: pre and max-width: 100%.

0.8.11

Fixed

• Mobile: ASCII banner no longer overflows on vertical phone screens — font-size reduced to 0.6rem on viewports ≤768px.

0.8.10

Added

• Multi-provider per-model-slot selection: each model slot (main, subagent, plan) can now use a different saved provider. New commands /subagent-model-provider and /plan-model-provider. Web UI Settings shows cascading provider → model dropdowns for all three slots.
• Web UI: skill/plugin full content reader — book icon loads SKILL.md from disk and displays in a centered popover with scroll. Info icon shows short description.
• Web UI: skills grouped by source (Built-in, Global, Project, Plugin) with plugin ID shown for plugin-sourced skills. MCP servers grouped by source (Global, Project).
• Web UI: markdown table rendering in chat messages.
• Web UI: SSH key paste support — paste private key content directly in the SSH form, saved to ~/.cast/keys/ with 600 permissions.
• Web UI: provider edit support — edit button pre-fills URL/API key for modification.
• Web UI: user_message SSE broadcast — user messages from one tab appear in all other tabs viewing the same session.
• Web UI: new block-char ASCII banner (░▒▓█) for both TUI and web.

Fixed

• /reload skips MCP reconnect when config unchanged — 2.7s → 27ms (100x faster).
• /queue-reset / /qr now clears pending queue badges in the web UI.
• ESC key closes info popovers before settings modal (proper layered close via stopPropagation).
• Markdown tables now render as <table> elements in web UI chat.
• Provider tab no longer crashes with i.push is not a function (htm && → ternary fix).
• Models load instantly in Settings via /api/models/cached (no network call on open).
• All icon buttons use unified cyan hover accent; focus outlines removed.
• Pending steer (cyan) and queue (amber) items color-differentiated above the composer.

Changed

• Web UI Settings modal: fixed height with scroll (no size jumping between tabs).
• Web UI: all text buttons replaced with verified Heroicons v2.1.5 icons with title tooltips.
• Web UI: GET /api/models/cached returns cached models instantly; GET /api/models?provider=<name> fetches from a specific provider.
• Web UI: SSH form fields stacked vertically with key paste textarea.
• Web UI: plugins show plugin name + marketplace as meta; skills show name + source/pluginId as meta.

0.8.9

Added

• Web UI: real-time sidebar updates — status, title, and message count changes are now broadcast to all connected browser tabs via SSE session_update events, eliminating the need for manual refresh.
• Session summary index expanded with persona, model, title, pinned, and createdAt fields — cold session sidebar rows no longer require parsing full session JSON.
• JSONL session persistence — messages are now appended incrementally to .jsonl files instead of rewriting the entire session JSON on every mutation. Legacy .json sessions are auto-migrated to JSONL on startup.

Fixed

• DECXCPR cursor-position queries (\x1b[6n]) no longer leak as visible escape sequences when stdin is not in raw mode (e.g. during suspendTerminal, tmux focus-out).
• <Static> items now use stable WeakMap-based keys instead of index-based keys — messages no longer disappear after compaction, steering injection, or session switch.
• TUI: StatusBar extracted into its own component with local 200ms tick — elapsed-time updates no longer re-render the Composer area.
• TUI: ChatLog wraps useWindowSize in its own component — resize events no longer cascade re-renders through the Composer.

Changed

• Web UI: session_end SSE event carries usage and message count — the frontend only refetches the full session when message counts diverge (reconnect recovery), skipping the full GET /api/sessions/:id on normal uninterrupted runs.
• TUI: /model, /plan-model, /subagent-model, /provider use refreshMeta() instead of refresh() — no unnecessary message rebuild when only config metadata changes.
• toDisplayMessages uses O(M) Map lookups instead of O(N×M) messages.find() for tool result matching.
• TUI: maxFps reverted from 60 to 30 — double write frequency increased desync/flicker odds on slow terminals (SSH, tmux, mobile emulators).

0.8.8

Fixed

• Web UI: page refresh during a running agent turn no longer loses the final assistant message — the end event now merges server-persisted messages into the client state.
• Web UI: pre-run save ensures the user's message survives a mid-run process kill (SIGTERM timeout, OOM, crash).
• Web UI: elapsed timer pauses when the SSE connection drops instead of counting up with a stale connection.
• Web UI: status event on SSE reconnect now refetches messages if the run completed while the client was disconnected.
• Web UI: fetch() and EventSource URLs now use window.location.origin explicitly to avoid cross-origin issues behind reverse proxies.

0.8.7

Fixed

• Web UI static files (HTML, CSS, JS) now ship in release installs — cast web was returning 404 because dist/public/ wasn't included in the archive.
• cast web --foreground correctly uses the specified --port instead of always defaulting to 1337.

0.8.6

Fixed

• cast web daemon spawn now works in release installs (no longer requires tsx or TypeScript sources).
• cast web --foreground runs inline instead of spawning a child process.

0.8.5

Added

• cast web now detects already-running instances and refuses to start a duplicate (instead of silently spawning a second server on the same port).
• cast web --public / --host 0.0.0.0 — bind to all interfaces for network access (prints a security warning).
• cast web stop gracefully shuts down open sessions (SIGTERM), escalating to SIGKILL after 3s. Detects and cleans up stale state when the process is already gone (crash, OOM, kill -9).
• cast web status auto-heals stale PID files — reports honestly instead of claiming a dead process is running.
• Built-in skill-creator skill (user-invoked): reference for writing predictable skills, based on Matt Pocock's methodology (invocation modes, information hierarchy, leading words, pruning, failure modes).

0.8.4

Added

• New shared prompt section (verification-discipline.md) instructs the agent to verify changes against the real running interface rather than trusting tests alone — appended to every persona and subagent prompt.

Fixed

• Search tool (grep, glob) no longer blocks the Node event loop while fd/rg run — switched from sync to async subprocess execution, which matters under concurrent tool calls.

Internal

• Eval harness restructured into benches/ (basic, hashline, mutation) + lib/ (runner, fixtures, results, trace-view).
• Eval runner now supports model comparison (--compare, --compare-x3) and trace replay (--trace).
• Added mutation bench for measuring tool robustness against prompt perturbations.
• Added eval methodology doc (docs/eval-methodology.md).

0.8.3

Changed

• All persona prompts now consistently mention conditional tools (ssh, background bash) via the "go by your actual tool list" note — coding.md and sre.md were missing it.

0.8.2

Changed

• Persona prompt tool lists no longer hardcode ssh — they now point the model at its actual tool list, so tools that are only conditionally available (ssh, background bash) aren't advertised when absent.

0.8.1

Added

• Background bash tasks: the bash tool gains a run_in_background parameter (web and TUI only). Setting it to true spawns the command without blocking and returns a task id immediately. Completion arrives automatically as a <system-reminder> — no polling needed. Two companion tools (bash_output, bash_kill) let the agent check progress or terminate a task early. Background tasks survive across turns and are session-scoped; they're reaped on session close.

0.8.0

Added

• Web UI (cast web): browser-based control room for managing background agents. Creates sessions with different personas, streams responses token-by-token, shows tool calls as terminal-style cards, and includes a resizable git diff viewer. Settings modal covers model/reasoning, theme, web tools, bash confirmation mode, and MCP/skills/plugins/provider/SSH management. Non-blocking slash commands (/help, /current, /usage) work while the agent runs. Keyboard shortcuts reference (Ctrl+/ / ⌘/) for sidebar, diff, new session, and clear-context. Auth with auto-generated password. Same sessions persisted to ~/.cast/sessions/ as the TUI.
  • cast web — start in background (daemon)
  • cast web stop / cast web status — manage the server
  • cast web --foreground — run inline for dev/debug
  • Default port 1337, configurable via --port or CAST_WEB_PORT

0.7.12

Fixed

• Ink incremental rendering enabled (incrementalRendering: true) — only repaints lines that actually changed, reducing terminal traffic and eliminating flicker on frequent redraws. Frame rate cap raised from 30 to 60 FPS for a more responsive composer.

0.7.11

Fixed

• Removed focus-reporting mechanism (\x1b[?1004h) that triggered a terminal resync on alt-tab: some terminals send focus-in reports unprompted, causing spurious screen clears that wiped the banner and broke the viewport. Focus in/out sequences are still silently dropped by the input parser so they never surface as stray characters.

0.7.10

Fixed

• Autoscroll breaks after Alt+Tab: switching away from the terminal and back no longer leaves the viewport stuck — resync respects the current scroll position instead of force-resetting it.

Changed

• Shift+Tab keybinding removed from Composer — simplified input handling, removed dead code from input-parser and keybindings.

0.7.8

Fixed

• Terminal rendering corruption on Termius (mobile) and similar terminals: Ink's per-line erase sequence (\x1b[2K\x1b[1A repeated) is now coalesced into a single combined cursor-up + erase-to-end-of-screen before writing, preventing orphaned top-border fragments from stacking on every keystroke.

0.7.7

Added

• /continue slash command — resumes the most recent session without leaving the current one. In-session equivalent of cast -c.

Fixed

• Streaming output no longer overflows the viewport when the composer grows taller than the static budget estimate: ChatLog now shrinks its live-region budget reactively based on the actual last-frame overflow, so one bad frame self-corrects instead of repeating every frame.
• Composer ghost rows (streaks, duplicated borders) after deleting multi-line input: the frame now uses a sticky max height and pads back on shrink instead of letting Ink leave stale rows on screen.
• Synchronized-output flash on terminal resync (clear + replay): both writes are now wrapped in CSI ?2026h/l so the terminal buffers and swaps atomically.
• Resync no longer fires immediately after an aborted turn (Esc): the disruptive full clear + scrollback wipe lands on the next turn that actually completes instead.
• Reasoning and content block labels ([reasoning], [agent]) no longer repeat on every split-off line of the same streaming run.
• Edit tool results no longer shown inline in ChatLog (same treatment as read).
• Composer re-renders on every stdin chunk even when nothing changed (DECXCPR responses, focus reports, partial escapes): now skipped unless the buffer value or cursor position actually moved.
• DECXCPR poll rate adapts: 200ms during streaming or when a resync is pending, 1s at idle to reduce unnecessary terminal traffic.
• Spinner render cycles reduced ~35% (120ms interval vs 80ms) with no visible quality loss.

Internal

• splitCompleteLines drains completed lines from the trailing streaming block incrementally, giving the final answer the same steady commit cadence reasoning already gets.
• useTerminalResync scroll flags (scrollUp, scrollUpStale) reset after a resync clear, so the next Ink frame isn't swallowed by the scroll guard.
• Vitest NODE_OPTIONS=--no-deprecation suppresses the punycode warning from openai -> node-fetch -> whatwg-url.

0.7.5

Added

• Personas travel with the thread: each session remembers the persona that drove it, and resuming (-c, --resume, /sessions) restores it — same rule as plan/build mode. The global setting remains the default for new sessions; a deleted persona falls back to the current one with a notice.
• Switching to a different persona (/persona) in a non-empty thread now offers to start a new session, so the previous persona's context doesn't bleed into the new role; "Continue here" / Esc keeps the current thread.
• Four new built-in personas rounding out the IT-company role set: architect (trade-off analysis, ADRs, module boundaries), analyst (requirements from vague asks, contradictions, API contracts), sre (incident response, blameless postmortems, SLOs), and product (hypotheses, success metrics, prioritization — distinct from the ticket-writing Project Manager).
• Built-in persona coder-with-subagents-force-review (Coder · forced review): same delegation as coder-with-subagents, plus a mandatory review gate — every code change goes through an independent review sub-agent (fresh context, diff-based input, execution-confirmed findings, exactly one round) before being reported done. No "too trivial to review" exception for code.

0.7.4

Fixed

• Provider requests fail on Node 24 with "Cannot connect … (invalid content-length header)": the OpenAI SDK sets an explicit content-length header, which is a forbidden fetch request header — Node 24's undici rejects the request outright (Node 26 silently ignores it). cast now strips it and lets the runtime compute the value; model selection/chat work on Node 24 again.

0.7.3

Fixed

• Windows: cast upgrade no longer crashes on exit with Assertion failed: !(handle->flags & UV_HANDLE_CLOSING) — the hard process.exit() right after the release-check fetch raced libuv's handle teardown; the command now returns and lets the process exit naturally.

0.7.2

Fixed

• "Cannot connect to " errors now include the underlying network detail (ECONNREFUSED / ENOTFOUND / certificate errors, including ones buried in undici AggregateErrors) — DNS, dead-endpoint, and TLS-interception failures need different fixes and were indistinguishable.
• Windows: the Git Bash registry probe no longer leaks reg.exe's localized stderr into the TUI as mojibake when the GitForWindows key is absent.

0.7.1

Added

• Fuzzy search in the session picker (--resume, /sessions): type to filter by project path, session id, or any user/assistant message text in the thread; substring matches rank above subsequence (typo-tolerant) matches. Esc is the only cancel key while searching — q goes into the query.
• write replies with a line diff vs the previous content (plus trailing-newline notes) instead of a byte count; new-file and identical-content cases are reported explicitly.
• write and edit warn when the resulting file contains consecutive identical lines — the classic symptom of a duplicated-line botch.
• edit auto-recovers a stale anchor that matches a run of contiguous byte-identical duplicate lines (they're interchangeable), instead of dead-ending with "multiple lines match".
• Windows: the bash tool locates a native Git Bash (CAST_BASH env override → GitForWindows registry key → known install paths incl. no-admin and scoop → derivation from git on PATH) instead of picking up the WSL shim from PATH, which loses output. Falling back to PATH bash warns at startup and in the first tool result.
• Session summary index (~/.cast/sessions/index.json): the picker lists hundreds of sessions from an mtime-validated cache (~5ms warm) instead of parsing every session file; the full session is parsed only for the one you pick. Self-healing — safe to delete.
• cast -c finds the most recent session by file mtime and parses only that file (was: parse everything).

Fixed

• Prompt-cache markers (cache_control) no longer leak into saved sessions: applyCacheControl works on request-only copies, and loading normalizes sessions damaged by older builds — fixes opaque 400s ("Can only get item pairs from a mapping") when resuming after a provider switch.
• Resuming a session created on a different provider falls back to the currently configured model (with a notice) instead of sending requests to a model the new provider doesn't serve.
• Tool-call arguments that are valid JSON but not an object (e.g. a bare array) are wrapped before sending, so providers whose chat template iterates arguments as a mapping don't reject the whole history.
• Stdio MCP servers inherit cast's full environment (config env wins) — shell-exported API keys now reach servers; the SDK's whitelist default silently stripped them.
• Remote MCP servers that only speak the legacy HTTP+SSE transport now connect: Streamable HTTP is tried first, then one SSE retry on rejection. SSE JSON-RPC POSTs run on a dedicated connection pool — the long-lived /sse stream otherwise serializes them behind itself in Node's fetch and the handshake hangs forever.
• SKILL.md / persona / rules frontmatter survives a UTF-8 BOM (Windows Notepad, Out-File); previously the whole frontmatter was silently discarded.
• Plugin marketplace commands report "git is not installed or not in PATH" instead of a raw spawn git ENOENT; staging directory names derived from Windows local paths no longer contain \ or :; marketplace install retries rm/rename against transient Windows EPERM/EBUSY locks.
• getMostRecentSession skips a corrupt (half-written) newest session file and falls back to the next one.
• bash tool reports a clean error when the bash executable itself can't be spawned (e.g. a wrong CAST_BASH), instead of hanging.

Changed

• Docs: provider credentials are configured only via ~/.cast/settings.json / /provider — the PROVIDER_BASE_URL / PROVIDER_API_KEY environment variables were documented but never read; the docs no longer claim otherwise.
• Minimum Node.js version raised from 18 to 22 (required by undici 8.x used for MCP SSE transport).

0.7.0

Added

• After compaction (auto or /compact), cast injects a separate trailing <system-reminder> user message with edited files and a TODO list of open plan steps. Steps come from - [ ] checkboxes when present, otherwise from ### headings under ## Steps (common in real plans). Omitted when there is nothing actionable; summary text stays reminder-free.
• Turn-end open-work gate in build mode with an active plan: if the model stops without tool calls while plan steps remain open, cast injects a <system-reminder> and continues sampling (up to 2 times per user prompt, then falls through with an exhausted notice).
• After a mid-stream /abort (Esc) with no tool-result abort signal, cast appends a <system-reminder> ([Request interrupted by user]) so the next turn’s model sees that the prior turn was cut off.
• Overnight sessions get a one-shot <system-reminder> when the local calendar date advances past the last announced day (persisted per session).
• Built-in explore and review subagents for task (read-oriented tool allowlists). coder-with-subagents steers mapping to explore and validation to review; worker remains the default catch-all for everything else.
• Marketplace plugins (Grok/Claude-shaped): /plugin marketplace add, /plugin install name@marketplace — installs contribute skills from ~/.cast/plugins/.
• /skills and bare /plugin open multi-select toggles (same UX as /mcp); disabled skill names persist in disabledSkills.
• Default marketplaces auto-seeded once: Codex (openai/plugins), Claude (anthropics/claude-plugins-official), Grok (xai-org/plugin-marketplace).
• /plugin slash palette lists install / marketplace / toggle subcommands; builtin cast skill documents plugins + toggles.
• Bare /plugin uninstall opens a picker + confirm (typed name@marketplace still works).
• /skills uninstall and /mcp uninstall — interactive picker + confirm (or typed name); removes global/project skills and mcp.json entries, clears matching disable flags, hot-reloads.
• Uniform /skills / /mcp / /plugin surface: list, enable/disable, help; toggle cancel shows [Cancelled]; no-op toggle skips reload; typed uninstall confirms; /plugin marketplace remove cleans settings + reloads skills.
• Skill discovery loads skills.sh universal paths: .agents/skills/ (project, trust-gated) and ~/.config/agents/skills/ / ~/.agents/skills/ (global), so npx skills add … -a universal works without copying into .cast/skills/.
• /skills, /mcp, and /plugin pickers/lists sort entries alphabetically by name (skills were previously discovery-order, so plugin skills clustered at the bottom).
• /skills labels plugin skills with their pack id (plugin · name@marketplace). Skills from a disabled pack stay visible but locked (muted) until /plugin re-enables the pack.
• /skills uninstall lists plugin skills as muted/locked (remove the pack via /plugin uninstall); Enter on those rows is ignored.

Fixed

• read tool rows show the correct 1-indexed line range (was off-by-one when offset was set).
• Live-region task rows stay one-line (truncate) while streaming so parallel tasks remain visible; full wrapped assignment still shows once promoted to history.
• Committed task tool rows show the full subagent report (wrapped), not a 500-char truncated line.
• Session rebuild/resume restores tool [error] via persisted castIsError on tool results (was always [ok]).
• Trackpad scroll during an active agent turn no longer fights Ink redraws: while the live region fits the screen, cursor-position polling stays on (and short CUU frames cannot clear the scroll-up guard); tall streaming frames skip that poll so a false scroll latch cannot swallow redraws and scramble scrollback.
• Sync task subagents honor parent --no-skills / --skill (they previously always loaded global/builtin/plugin skills and ignored CLI skill paths).

Changed

• Docs spell out hot-reload vs /reload: /skills / /mcp / /plugin toggle and install/uninstall apply in-session; /reload is only for on-disk file drops/edits (same chat, no restart).
• /skills / /mcp / /plugin pickers put the full description on the focused second line (wrap), not truncated into the label.
• task UI shows the delegated assignment text (not raw JSON key=value args). Non-default subagent names are prefixed (explore · …).
• Subagent final-answer extraction ignores empty placeholder turns ((no response)); the worker prompt requires a standalone closing report.
• Sync task subagents now receive the same environment grounding as the parent: Current System State (cwd/date/platform/model), always-apply + lazy rules, skills catalog, MCP server list, and SSH hosts.
• --no-skills help/docs clarify that plugin skill discovery is skipped too (behavior unchanged).
• coder-with-subagents (and the task tool description) steers harder on user cues like “parallel” / “independently”: split into same-turn multi-task calls instead of solo exploration.
• Shared prompt append adds Agent discipline (action safety, parallel tool calls, preamble-with-tools, prompt secrecy) for all personas and subagents.

0.6.12

Changed

• Renamed the file-search builtin from find to glob (same glob-pattern behavior). Legacy find calls and tools: [find, …] allowlists still work.
• Shared file-tool guidance steers named-file tasks to read first; short glob results remind the model to read a hit instead of another search/ls.
• edit insert_after accepts anchor EOF to append at the end of a file (alongside existing 0: for the top).

Fixed

• edit recovers unique hash-only anchors when the model omits the line number (local:chunk instead of 22:local:chunk), and accepts ASCII -> gutters the same way as →.
• Shared file-tool guidance (all personas and subagents) now spells out the read→edit workflow: known path skips glob, one edit per file, copy the full three-part anchor, retry from tool-returned anchors instead of re-searching.
• When read/edit miss a path, cast runs a basename glob under the hood and lists real matches so the model can retry the correct path without starting its own search loop.

0.6.11

Added

• Persona and subagent frontmatter support tools (builtin allowlist; exact names or *-globs like plan_* / web_*) and agentsMd (default true). Omit tools for all builtins; MCP tools are never filtered by the allowlist. Session gates (plan/build mode, web toggle) still apply on top.

0.6.10

Fixed

• edit returns edited regions with fresh anchors on success, so a follow-up edit on the same file no longer needs a re-read after lines shift under prior anchors.
• read output was switched from the two-part <LINE>:<HASH>→ anchor format to the three-part <LINE>:<LOCAL>:<CHUNK>→ format (introduced during the 0.6.9 cycle). The three-part form gives finer-grained movement detection when lines shift around, and the stale-anchor error path now returns a fresh anchor instead of failing blind.

0.6.9

Added

• edit now accepts insert_before to add new lines above a target anchor (in addition to the existing insert_after). Useful when the natural reference is a heading you want content to sit above rather than below.
• Successful edit operations now return the edited regions with fresh anchors, so a follow-up edit doesn't need a re-read even when prior anchors shifted.

0.6.8

Changed

• Hashline anchor format switched from <LINE>:<HASH> to <LINE>:<LOCAL>:<CHUNK> for read/edit/grep output. The three-part form gives finer-grained movement detection when lines shift around, and the stale-anchor error path now returns a fresh anchor instead of failing blind. Anchors emitted under 0.6.7 are no longer valid; re-read the file to get anchors in the new format.

Fixed

• parseAnchor now ignores any content past the → separator, so pasting a read gutter line (with its arrow and trailing content) into edit produces the correct anchor instead of a malformed one.

0.6.7

Changed

• read output now carries hashline anchors in the form <LINE>:<HASH>→content so a line reference made in one assistant turn still points at the same line after a re-read; edit accepts replace / insert_after / write operations keyed by those anchors and validates the whole batch atomically against the current file (stale anchors return fresh anchors instead of failing blind).

Internal

• Per-line hash computation for read/edit/grep is now backed by an in-memory LRU (default 20 entries, ~4 MB worst case). Entries are re-validated against file mtime on every access, so cache hits silently invalidate after external edits.
• Lru exposes a size getter so the test-only hashlineCacheSize no longer reaches into a private field.

Internal

• read/edit now emit and accept hashline anchors (<LINE>:<HASH>→…) so line references in the conversation survive re-reads; edits are validated atomically against the file as it stands at edit time
• In-memory LRU (default 20 entries, ~4 MB worst case) caches per-line hashes for read/edit/grep; entries are re-validated against file mtime, so cache hits silently invalidate on external edits
• Added a public size getter on the LRU so hashlineCacheSize no longer reaches into a private field

Changed

• /current model line shows the configured model and the live plan model together when plan mode swaps in a separate one, so the discrepancy from the status bar becomes visible instead of silently different.

Internal

• /current rendering moved into formatValue on each registered status bar segment — adding a new segment now needs one place instead of two.
• applyProviderSelection extracted from /provider activate — the post-save flow (selectModel → selectReasoningLevel → refresh) lives in one helper. /provider add keeps its own notice wording and stays inline.
• /current and /usage reuse abbreviateTokens and formatContextPct from App.tsx — local fmtK (no M-branch) and a duplicated context-percent formatter are gone.
• Hermes XML strip is a single function (stripHermesToolCalls) shared by core/llm.ts and the streaming path — the previously duplicated private copy was deleted.
• ensureConnectionAlive now writes the full providers array (not just legacy providerUrl/apiKey); the regression test was tightened to assert exactly what gets persisted, including that existing providers survive a reconnect prompt.
• New test/statusbar.test.ts covers defaultStatusBarConfig, the SEGMENT_MAX_WIDTH overflow map, and the empty-data paths of the registered renderers; new formatValue tests cover the plan-mode model divergence.

0.6.5

Added

• Multi-provider support — /provider now opens a picker to switch between saved providers; /provider add adds a new provider (name → URL → key wizard); /provider delete removes one. Providers persist in settings.json and the active one is remembered across sessions.

0.6.4

Fixed

• Hermes tool-call recovery — XML <function=…> blocks in assistant prose (e.g. the model describing the feature itself) are no longer mis-parsed as live tool calls, preventing 400 Param Incorrect loops on the next request. Recovery and dedup-strip now gate on actual tool names from the current session.

0.6.3

Fixed

• Streaming dedup — Hermes models that emit both XML <tool_call> blocks and native function-calling in the same response no longer produce duplicate tool invocations

0.6.2

Added

• /statusbar command — toggle, reorder, and reassign status bar segments between left/right sides via an interactive picker. Config persists across sessions. Useful on narrow/mobile terminals where the full bar overflows. Default: persona, mode, model (left) and elapsed (right); toggle others via /statusbar.
• /current command — show all status bar data in a list, including disabled segments

0.6.1

Fixed

• Terminal resync — resize and focus-regain now use a light clear that preserves scroll position; theme changes and streaming desyncs still do a full scrollback wipe
• lineChurn — O(m·n) fallback for large edits uses Set-based comparison instead of raw block count; identical large texts no longer report false positive changes
• Input parser — DECXCPR cursor-position responses (\x1b[row;colR) explicitly dropped to prevent accidental keybinding matches

Internal

• displayWidth extracted to src/ui/display-width.ts with per-session cache
• Test directories isolated to prevent parallel test collisions

0.6.0

Added

• SSH tool — run commands on remote hosts via SSH; hosts configured in ~/.cast/ssh.json (global) or .cast/ssh.json (project)
• /queue-reset alias — shortcut for clearing the command queue

0.5.8

Added

• MCP server toggle — /mcp now opens an interactive multi-select picker to enable/disable individual servers mid-session. Disabled servers are hidden from the model and persisted in settings.
• <available_mcp> block in the system prompt — the model sees only enabled MCP servers and their tools, and will not attempt to call disabled ones.
• Hermes XML tool-call parsing and recovery
• Terminal desync tracking with automatic resync on focus return

0.5.7

Added

• Enhanced search functionality with permission handling and output notes
• Improved tool name sanitization to prevent doom loops

0.5.6

Fixed

• Terminal tools (plan_done, plan_enter) now force-end the turn — prevents the model from keeping runs alive by rewording summaries to dodge the doom-loop detector
• plan_done no longer echoes full plan content into model context, which invited endless "refinement" loops

0.5.5

Added

• Changelog page with version history from 0.1.0 to 0.5.4
• Sequential prev/next navigation on all documentation pages (reading loop: Getting Started → ... → Changelog → Getting Started)
• /usage command documented in README and interactive commands reference
• Plan mode refine option uses the regular composer (multi-line and image paste supported)

Fixed

• Improved provider error classification — OpenAI SDK APIConnectionError cause chain is now fully traversed for accurate error reporting

0.5.4

Fix: ensure non-negative token counts in usage tracking and streaming.

0.5.3

Fix: /usage now correctly shows sub-agent token breakdown.

0.5.2

Added

• /usage command — show cumulative session token/cost usage
• /exit command — alias for /quit

0.5.1

Changed

• Repositioned cast as a "role-based agent harness" — 13 built-in personas, same tools, different judgment

0.5.0

Added

• Plan mode — /plan enters a read-only exploration phase; the agent studies the codebase and writes a structured execution plan with a checklist
• Plan tools: plan_write, plan_edit, plan_read, plan_done, plan_discard, plan_enter, plan_check
• Per-phase model support — /plan-model sets a separate model for planning vs building
• Plan files persist as markdown in ~/.cast/plans/; survive compaction and session restarts
• Approval dialog: implement now, clear context + implement, approve for later, or refine
• E2E smoke test for plan mode

Changed

• Comprehensive documentation overhaul — all features now documented in docs/

0.4.7

Added

• Improved picker viewport handling with scrolling and index clamping
• 8 new dangerous bash patterns (fork bombs, shutdown, npm publish, killall, etc.)

0.4.6

Changed

• Enhanced dangerous command detection in permissions

0.4.5

Changed

• Removed interactive command checks from permissions (simplified)

0.4.4

Added

• Web tools — web_search (DuckDuckGo) and web_fetch (Jina Reader) for internet access
• Web tools are off by default; toggle with /web (persists to settings)

0.4.3

Added

• Doom loop detection — blocks a tool after 3 identical consecutive calls with the same arguments

Fixed

• Streaming viewport clamping and scroll position issues

0.4.2

Added

• /copy command — copy last assistant response to clipboard

Fixed

• Scroll position not resetting on resync while user is scrolled up

0.4.1

Fixed

• Atomic writes for session and settings files (prevents corruption on crash)
• Session listing and MCP connect timeout hardening
• Clear error on missing required prompt files
• Persona sorting uses label instead of name

Changed

• Split tools.ts into per-tool modules (bash.ts, files.ts, search.ts, web.ts, task.ts)
• Centralized prompts directory resolution

0.4.0

Added

• Multi-source personas — project-local, global, and builtin with priority ordering
• Sub-agent support via the task tool — delegate work to isolated sub-agents
• coder-with-subagents persona

0.3.17

Added

• Brace expansion in glob patterns
• Enhanced gitignore handling

Changed

• Agent loop and UI performance tracking improvements

0.3.16

Added

• Non-interactive mode — cast run sends a single prompt, streams to stdout, exits
• --format json for structured JSONL output

0.3.15

Added

• /repo command — show cwd, git branch, dirty state, remote, and HEAD
• Multiple color themes (16 total)

0.3.13

Added

• Theme support — /theme picker, persisted to settings

0.3.12

Fixed

• Made node-pty optional with pipe fallback for release bundles

0.3.11

Added

• PTY for bash commands — captures interactive prompts (e.g. npm init)

0.3.10

Fixed

• Live bash command reveal only when waiting for input

0.3.9

Added

• Re-pick model when provider token changes at startup
• Custom model id entry in picker
• Surface actionable turn errors (revoked key, quota exceeded, no access)
• Recover from dead provider connection at startup
• Esc stops the running turn; Ctrl+C exits with confirmation

Fixed

• Provider key persistence on re-entry
• Distinguish aborted, disconnected, and completed turns at stream end

0.3.8

Changed

• Streaming and rendering logic overhaul for chat messages

0.3.7

Added

• StdinManager for handling interactive input in child processes

Changed

• Streamlined session handling

0.3.6

Fixed

• Inline model context windows map (removed external JSON file dependency)

0.3.5

Changed

• Documentation updates

0.3.4

Fixed

• Message sanitization and tool call handling

0.3.3

Fixed

• /steer behavior when idle (now submits as normal prompt)

0.3.2

Added

• Paste chip functionality in Composer
• Command aliases: /s for /steer, /q for /queue
• Nested context file resolution (AGENTS.md in subdirectories)

0.3.0

Added

• Rules system — Cursor-compatible .cast/rules/*.md with always/auto/lazy/manual modes
• @rule-name mentions in messages
• Chat log display improvements (clampTailToRows)

0.2.3

Added

• System state block in system prompt (model, reasoning, cwd, git branch)

0.2.1

Added

• /keys command — list all keybindings

0.2.0

Added

• Multi-source personas (project > global > builtin)
• Built-in skills
• Cast meta-skill for self-configuration

0.1.4

Fixed

• Token count abbreviation in status line (8.7k, 1.2M)

0.1.3

Added

• /model highlights current selection in picker
• Honest reasoning display

0.1.2

Fixed

• reasoning_content field support
• Resize reflow
• Tool call summaries
• /steer and /queue validation

0.1.1

Fixed

• ThinkBlockParser off-by-one
• Added QA personas and vendors tests

0.1.0

Initial release. Ink TUI, 13 built-in personas, OpenAI-compatible provider, session persistence, context compaction, MCP servers, skills, parallel tool execution, sub-agents.