shiro-neko/CHANGELOG.md

Changelog

All notable changes to this project are documented here. The format follows Keep a Changelog and the project adheres to Semantic Versioning.

[1.0.1]

Added

• Rendered, resumed history. A session restored with -r/-c or /resume now shows its saved conversation as real transcript lines instead of a blank prompt, converting the stored wire messages (user, assistant, tool calls and their results) into the same view the live loop paints.
• /undo and /redo. Every prompt snapshots the files on disk first (capped near the last 100), and /undo restores files, trims the conversation, or both. /redo reverses it. A bash command's side effects are not files and cannot be rolled back, which is stated in the command output rather than hidden.
• Parallel subagents. The task tool accepts several independent investigations under a tasks array and runs them on separate context windows at the same time, joining their reports. A single call behaves exactly as before.
• Lazy MCP tools. By default an MCP server now contributes three meta-tools (mcp_list, mcp_inspect, mcp_call) instead of one schema per server tool, so a server exposing twenty tools stops costing ~2750 tokens per request until one is actually called. Set "mcpMode": "eager" to register every server tool up front. Named servers are still listed in the prompt, and calls route through the same permission rules and guard as before.
• Hot-reloaded skill installs. A skill installed from /registry mid-session is callable on the next turn without a restart (the skill tool reads its list live, so even the first install works). Plugins and external tools still need a restart because they join the guard chain and tool registry built once at boot.

Fixed

• A resumed session rendered an empty transcript. Loading a saved session populated the wire messages but never rebuilt the on-screen history, so after -r/-c or /resume the talk was blank even though the session data was there.
• The walk behind @file completion refreshed only once per session; it now re-walks on a slow cooldown so a file created after the first @ shows up within a short window.
• A handful of plugin write tools were mutating but not gated by the permission defaults; the tool set and the mutating list are now derived from a single mutating() marker, so a tool can no longer be added to one and forgotten in the other.

1.0.0

The first stable release. Cost control, a larger tool and skill surface, custom slash commands, auto-loaded extensions, and a redesigned welcome interface, on top of the beta line's agent loop, approval model, and safety guarantees.

Added

• Spend ceiling ("maxSpendUsd" in config). Checked before each turn: past the limit the model is never called, the turn is refused naming the ceiling, headless exits non-zero, and it warns once at 80% of the limit. Unpriced models cannot be measured, so the ceiling does not apply to them.
• Cheaper subagent model ("subagentModel" in config). "explore" subagents — search, not reasoning — resolve against a configured cheaper model while "review" and "worker" keep the parent's. "/cost" reports subagent spend separately, priced against the subagent's model id.
• Twenty new built-in tools (41 total) in a new "extra" tool set, across four families:
  • line edits: insert_lines, delete_lines, replace_lines, append_file, prepend_file, count_lines
  • filesystem: tree, file_info, find_files, recent_files, changed_files
  • git (read-only, argv-spawned): git_log_file, git_diff_commits, git_show_file, git_current_branch, git_changed_in_ref
  • code and environment: find_symbol, json_query, outline, read_symbol, env_info, count_tokens
• Twenty new bundled skills (29 total), including plan, docs, api-design, ci-cd, db, docker, frontend, git-workflow, logging, optimize-sql, release, accessibility, data, i18n, deps, onboarding, ux-copy, readme, incident, perf-frontend.
• Ten new plugins, all data. Safety refusals on by default — no-force-push, no-net-pipe, no-root, no-env-write — and opt-in workflow plugins — no-main-commit, no-git-config, confirm-delete, conventional-commit, tests-first, small-diffs.
• Custom slash commands from Markdown files in ".shiro/commands/" and "~/.shiro-neko/commands/", with frontmatter "description"/"agent", "$ARGUMENTS" and positional "$1", and shell substitution passed through the guard. A custom command can never shadow a built-in.
• Auto-loaded external extensions from "~/.shiro-neko/{skills,tools,plugins}" and ".shiro/{skills,tools,plugins}". All data, never code: tools are bounded manifests (a shell template through the guard, an HTTPS fetch, or a workspace read), plugins are refusal manifests. Malformed files are reported and skipped, never fatal.

Changed

• Skills now live as Markdown files in "src/skills-md/", embedded into the compiled binary by Bun text imports, replacing the previous TypeScript string constants. A format test enforces that each parses with valid frontmatter and a real body. The eleven pre-existing skills were also deepened.
• Welcome interface redesigned into a structured dashboard: a session banner, a grouped environment panel with attention-worthy facts coloured out of the quiet layer, and a meta bar. The prompt input sits in a two-tone box with the agent and model row inside it and a split footer beneath.
• System prompt advanced with a discrete failure-recovery loop, a delegation policy, and compaction awareness.

Fixed

• Release workflow "dry_run" input is now honoured. A manual dispatch publishes only when it is unchecked; tag pushes always publish. Previously the input was declared but never read, so a manual run could never publish regardless of its value.
• Documentation drift corrected across the tool count, the bundled-skill count, the plugin defaults, and the README quickstart.

[0.1.0-beta.5]

• A dead provider item no longer ends the turn: a 404 naming a missing item rewrites the history inline and retries once.
• More tools (git_commit_message, git_branch, move_file, delete_file), the "protect" plugin, the security/perf/migrate skills, the "/mcp add" wizard, and the farewell message.

[0.1.0-beta.4]

• Compaction no longer stops the loop, and is bounded to keep the widest recent tool tail.
• The external registry for skills and plugins.
• Permission rules matched per command and path, replacing the per-tool list.
• apply_patch, web_fetch, and writable worker subagents.

[0.1.0-beta.3]

• Fourteen built-in tools with gateable tool sets.
• Streaming reasoning display, the mid-turn prompt queue, multi_edit, list_dir, read-only git tools, batch reads, @file completion, and interruptible commands.

[0.1.0-beta.1]

• The core agent loop with SDK-enforced tool approvals, endpoint fallback, and retries.
• The initial tool set, Ink interface, agent variants, skills, plugins, per-project memory, session persistence, subagents, MCP, and five-platform builds.