Changelog

PyPI releases

• Publish tagged releases through GitHub Actions using PyPI Trusted Publishing, without a stored API token.
• Check that the release tag, package version, runtime version, lockfile and changelog agree before building.
• Validate PyPI classifiers and package metadata, then upload only the wheel and source archive for the tagged version.

Async-agent diagnostics

• Report failed background runs' checkpoint errors instead of a generic failure, including provider permission and expired-model errors. Match diagnostics to the exact run, redact credentials, bound output, and keep child transcripts private.
• Reconcile nonce-owned factory workers even when OS birth timestamps differ from the launch clock, preserving PID birth checks before termination.

Startup fixes

• Remove provider token-count API calls from startup and use local approximations for unsupported counters without caching them as native counts.
• Defer user async-agent validation until the first background delegation, preserving validation before server launch and shutdown/cancellation handling.
• Skip unrelated external-server probes and bound MCP discovery without waiting for slow worker cleanup.

Project onboarding

• Add /onboard to build a persistent workspace code graph and onboarding guide with the existing Graphify parsers. Suggest the command on the home screen and include it in command completion and help.
• Add /onboard open, /onboard refresh, /onboard tour, /onboard ask <question>, and /onboard impact <symbol or path>.
• Add an interactive dashboard with Nova's Tokyo Night palette and shared block wordmark, a searchable file and symbol explorer, a zoomable dependency map, a symbol inspector, guided tours, and change-impact tracing.
• Render the onboarding guide as formatted Markdown with raw HTML disabled. Prepare Q&A commands for the existing Nova conversation and its normal tool permissions.
• Adapt the dashboard for desktop and mobile, with keyboard navigation, visible focus, and reduced-motion support. Keep dashboard assets local.
• Show an inline spinner and elapsed time while onboarding runs, and remove the indicator on completion, failure, or cancellation.
• Detect changed, new, and deleted inputs with content fingerprints. Preserve the saved analysis when parsing fails, times out, or is cancelled.
• Scale parsing deadlines with input size from two to ten minutes. Normalize Windows short paths before extraction so graph nodes and edges are retained.
• Respect Git ignore rules, reject linked storage paths, and disable repository filesystem-monitor hooks during file discovery. Keep workspace, input-size, graph-size, and Plan Mode checks in place.

Code Mode and skill visibility

• Make eval the primary Code Mode tool, with MCPCode compatibility, variables reused across snippets within a conversation, and guarded access to native tools, MCP tools, and configured subagents.
• Queue simultaneous interpreter snippets within a conversation instead of rejecting them. Keep separate conversations independent.
• Pause live interpreter execution for tool approvals and resume the same script without replaying completed actions.
• Normalize in-workspace Windows paths for nested file operations and pin the verified QuickJS integration version to prevent startup import failures.
• Show successful skill reads inline and guide the agent to announce which skill it is reading and why.
• Guide the agent to sequence edits to the same file and retry only rejected changes after checking earlier results, preserving the parallel-mutation guard.
• Keep native filesystem page text and structured tool data separate from display formatting and repeat warnings, so reads can safely feed exact edits. Preserve output limits, repeat blocks and independent parallel-read state.

Workflow and remote chat

• Replace Prime's earlier continuation loop with a supervised software factory.
• Add native Telegram approval buttons and workspace image previews.
• Render complete compaction summaries as Markdown in the compact card.
• Improve team ownership handoff and retire superseded in-process workers during updates.

Terminal interface

• Replace generic UI emojis with compact text symbols that accept theme colors, including tool activity, voice, memory, remote status, and dialogs. Preserve success, warning, and error distinctions without requiring extra fonts.
• Keep emojis in conversation content, filenames, tool arguments, and remote reactions unchanged.
• Remove the composer placeholder and focus highlights for a cleaner input area.

Remote sessions

• Request approval through Telegram and Discord for tasks started in remote chat, instead of automatically approving them. Keep terminal task approvals local.
• Reconnect previously enabled remote bridges when resuming a saved session.

Performance and caching

• Reduce background monitoring stalls and improve waiter cancellation and cleanup.
• Share the embedding model across local retrieval features and bound local caches.
• Improve request cache diagnostics and preserve reusable prompt prefixes during tool discovery and compaction, with portable behavior for unsupported routes.
• Record live network load validation results separately from offline checks; cache savings remain dependent on the provider, route, and workload.

Lite Mode

• Move built-in compression controls to /lite-mode, leaving /caveman and /ponytail available for skills.
• Show only the selected style's settings, explain strengths and options, and keep Apply and Cancel visible on small terminals.
• Remember the chosen style when disabled and preserve saved preferences and unfinished composer drafts.

Passing and continuation

• Rename the automatic project handoff mode to /passing, leaving /handoff available for the skill and retaining existing saved records.
• Stop continuation if saving the current conversation fails. Allow interrupted handoff deletion to be retried without resurrecting deleted records.
• Distinguish context snapshots from newly written handoff documents in status messages and shared events.

Skill discovery

• Isolate retrieval caches by source and metadata, and track successful skill loads in usage rankings.
• Offer relevant candidates for small libraries and without embeddings. Preserve applicability and exclusion rules in discovery summaries.
• Use task context for short follow-ups, retain trailing requirements in long requests, and allow unloaded skills to be suggested again.

Tool discovery

• Resolve tool inventories from the owning invocation, including activated skill tools, and keep concurrent searches separate.
• Search parameter names and descriptions, filter unrelated semantic results, and distinguish tools from same-named subagents.
• Bind discovered schemas using successful, correlated structured records. Older text-only discovery reports remain readable and require rediscovery.
• Bound inventory notes and remove full hidden subagent descriptions. Preserve normal approval, execution-policy, and plan-mode checks.

Maintenance

• Standardize plugin management on the singular /plugin command.
• Handle update output on legacy Windows terminal encodings.
• Add offline selection, concurrency, checkpoint, UI, and policy regressions.

Prime project memory and continuation

• Save project-scoped task, check and evidence records in the existing durable store. Share findings across linked Git worktrees while retaining each run's checkout path, revision and declared input fingerprints.
• Recall up to five relevant check summaries within a 2,000-character allowance. Keep findings as drafts until observed failure is followed by passing checks against changed code. Mark changed or missing inputs stale or unavailable.
• Add /prime tasks, /prime resume <id>, /prime checks, and locally confirmed /prime forget <id>. Preparing a task starts no agent work; continuation uses the current workspace, model, permissions and limits, with separate child runs.

Observed verification

• Define acceptance checks before normal tool execution and bind results to actual tool-call IDs from the owning run. Evaluate exit codes and literal output assertions mechanically; fabricated, missing, truncated or unsupported evidence cannot establish a pass.
• Preserve execution approvals, plan restrictions and cancellation handling. Redact and bound execution artifacts before persistence, and load detailed definitions and evidence only when inspected.
• Report unmet criteria and verification limits even when all six Prime phases have completed. Preserve inspection of older session reports.

Prime interface

• Add a compact Prime strip and an expandable, independently scrollable drawer with task history, evidence and explicit continuation controls.
• Preserve composer drafts, keyboard access, theme styling and transcript scroll position. Keep progress, confirmations and storage warnings temporary.
• Add structured Prime event IDs for shared TUI, headless and remote consumers, plus offline contract and mutation checks in the Windows/Linux CI matrix.

Ponytail compression mode

• Add an exclusive Off / Caveman / Ponytail composer selector, preserving drafts and focus without adding toggle messages to the transcript.
• Add Ponytail lite, full and ultra levels, plus review, audit, debt, gain and help commands. Settings persist across restarts and migrate existing Caveman preferences. One-shot helpers leave the selected mode unchanged.
• Preserve the pinned upstream Ponytail skill bodies and level filtering, with golden checks against its JavaScript instruction builder. Bundle the MIT license and source checksums without requiring Node at runtime.
• Apply Ponytail to main and delegated model requests without rewriting stored conversations or tool results. Existing permissions remain authoritative.
• Add an opt-in real-provider validation script for all ten compression options. The recorded DeepSeek run passed 19 of 20 checks; one ultra response omitted an exact line reference. Ponytail used more tokens on these small tasks, so token savings and identical model responses are not guaranteed.

System One approval fixes

• Keep approval gates active when auto-approval is enabled, including custom tools, delegated actions and Code Mode. Preserve native question and plan interactions.
• Treat uncertain, malformed, low-confidence or unavailable reviews as requests for owner approval. A surfaced request cannot be silently approved or reviewed again by the TUI, headless runner or pipe adapter.
• Bind review context to the owner's actual request, reuse configured provider authentication and close owned review transports. Preserve hard policy denials and fail closed when policy or configuration loading fails.

Jev tool pruning

• Score only eligible uncached results while retaining full narrative context within the scorer's token budget. Pair tool calls and results chronologically.
• Publish scoring passes only after every batch validates; reject nonfinite and out-of-range scores. Retain bounded in-memory cache hits across runs and version persistent cache keys so earlier entries are not reused under changed semantics.
• Fit scoring context with incremental token accounting. A synthetic 80-message benchmark reduced estimator calls from 15,614 to 394 while preserving the fitted state and token count.
• Extend offline CI coverage for approval decisions, compression modes and pruning.
• Keep the cache-retention regression fixture small enough for the Windows test timeout while still exercising pruning beyond the configured budget.

Nova Prime · Deep Work

• Add opt-in Deep Work with /prime on, /prime off, /prime status, /prime report, and the --prime / --no-prime launch flags.
• Track six ordered checkpoints: define, investigate, implement, verify, challenge and deliver. Delivery records distinguish agent assessments from observed tool results and explicitly identify unverified work.
• Save Prime preferences and the last report with session metadata. Interrupted work remains paused; clearing a conversation removes its report, and late results cannot repopulate a cleared or superseded request.
• Preserve the selected model, existing approvals and execution limits.

Composer controls

• Add Prime and Plan toggles with mouse and keyboard support, preserving drafts and returning focus to the composer without starting agent work.
• Show a theme-aware Prime frame and a blue Plan Mode · Read only frame, highlighted toggles and mode indicators. Bash and approval-warning colors retain precedence; controls wrap on narrow terminals.
• Keep Prime and Plan on/off changes silent in the transcript. Explicit status and report commands continue to display their results.

Plan-mode guardrails

• Enforce planning restrictions before synchronous and asynchronous tool execution, including the main agent entering planning mid-conversation.
• Block Serena edits, memory writes, command execution and unknown operations, including calls routed through MCPTool and Code Mode. Reviewed read-only investigation remains available; auto-approval cannot override the guard.
• Preserve authoritative MCP server/tool identity. Other MCP tools must declare read-only behavior without a destructive hint to execute during planning.
• Reject traversal, directory lookalikes and escaped targets in the permitted .nova/plans/ and .nova/ralph/ write paths.

CI fixes

• Test the shared planning policy directly instead of patching a removed approval-module constant; cover both manual and automatic approval settings.
• Bring reasoning headers into view before mouse hit-testing after folding or expanding long traces, preserving all reopening and full-text assertions.
• Include Prime state, composer controls and MCP planning restrictions in the offline CI regression matrix and focused source lint checks.
• Use a native temporary workspace in plan-path tests so containment checks run against absolute paths on both Linux and Windows.
• Wait for queued keyboard focus and scrollbar-driven layout reflow in composer and Signal transcript tests before sending keys or asserting geometry.

Project rooms

• Add /rooms, a Rooms button and Ctrl+Shift+R for project channels, agent DMs and a shared activity board, while retaining existing session tabs.
• Run Claude Code and Codex through their installed CLIs and existing logins, with separate resumable conversations and attributed replies. Nova uses the shared agent loop with private checkpoints and room-scoped tools.
• Persist messages, tasks, notes and read positions in the canonical project's ignored .nova/workspace/ directory. Add a participant-bound local MCP bridge for published context, verified artifacts and structured handoffs.
• Require explicit task approval before implementation, preserve isolated Git worktrees, limit project execution to two workers and six initial task turns, and require a separate owner decision for extensions and integration.
• Keep native CLI permission controls, pause interrupted execution without replay, preserve work on cancellation, and refuse integration into dirty or changed project bases.
• Preserve room drafts, unread indicators and independent transcript scrolling; distinguish agent and file mention suggestions and support narrow terminals.
• Reject stale mention suggestions after typing or switching rooms, keeping older agent completions from replacing newer file input.
• Add explicit Markdown export of selected channel notes and display reported usage, marking unavailable usage as unknown. Validation: 33 release and room checks, all 30 room cases in randomized order, Ruff, formatting and mypy passed after the release fix; the implementation previously passed 119 focused regression tests and 29 room cases in randomized order. Tests use fake provider responses and CLI streams, temporary Git worktrees, real local subprocess/MCP transports and Textual pilots. Live Claude/Codex login and provider smoke tests remain opt-in. Broader suite failures and Windows timeouts are documented in PROJECT_ROOMS_EVIDENCE.md.

Workspace knowledge and teammate approvals

• Add a default-enabled workspace knowledge cache with source validation, isolated assistant namespaces, and /cache status|clear|on|off controls.
• Add persistent, per-teammate Auto Approve for desktop input, off by default, while retaining durable decisions, pause controls, and recovery safeguards.
• Hide the dedicated Windows QEMU console during computer and teammate startup.

Session tabs and interface layouts

• Add an opt-in experimental side-by-side diff preview in /themes, with line numbers, syntax highlighting, theme-aware change shading, and a narrow-screen fallback.
• Add a + button for opening a blank session with the home screen and focused input.
• Add close controls to extra session tabs. Dismiss tabs immediately while worker shutdown and worktree cleanup continue; restore tabs when shutdown fails.
• Preserve the banner canvas and logo position when opening or switching sessions.
• Keep session navigation at the top in every interface style, including Centered.
• Extend regression coverage across all 14 home styles at wide and narrow sizes.
• Display provider-exposed thinking and reasoning summaries across SDK formats, including completed replies and gateway metadata, without repeating streamed text.
• Request visible summaries for supported OpenAI and Azure reasoning models.
• Respect manual scrolling during thinking, tool updates, and final answers; keep expanded thinking available while the reader is scrolled away.

Installation and CI

• Constrain Parakeet to sherpa-onnx>=1.10.0,<2 to avoid missing wheels in 2.0.1.
• Quote version constraints in installation hints and retain the matching lockfile.
• Stabilize resize checks by waiting for the rendered terminal layout. Validation: focused cache, approval, computer, session, interface, installation, and release metadata checks. Parakeet wheel installation and import were verified on Windows Python 3.11; no speech model download or live transcription was required.

Local Linux computer preview

• Add an optional computer extra using Cua 0.9.0 and an explicitly selected local Linux QEMU VM with 2 CPUs and 4 GiB RAM. Check QEMU before guest download.
• Add /computer start|preview|status|pause|resume|stop with nonblocking startup and a private token-protected loopback browser preview.
• Give the local root agent screenshot and bounded desktop-input tools with observation IDs, normal approvals, plan-mode restrictions and user pause. Delegated agents do not inherit desktop tools; no host files or credentials are mounted by this feature.
• Keep screenshots and actions on the direct multimodal tool path. Attempt guest deletion on shutdown and retain failed-cleanup handles for retry.
• Document prerequisites, temporary guest files, ordinary guest networking and refreshing an existing Windows terminal's PATH after installing QEMU.

Documentation and interface catalog

• Shorten the README to setup essentials and product capabilities; preserve detailed installation, voice and workflow instructions in SETUP.md.
• Refresh FEATURES.md with landing-page copy, native Code Mode, Whistle, lightweight speech options, download progress and explicitly labeled VM preview.
• Include the previously added eight interface styles, character art and animated homes in the v1.0.99 feature reference. Validation: offline computer lifecycle, desktop tools, preview authentication, TUI controls and agent/policy compatibility checks. QEMU 11.1.0 prerequisite inspection succeeds on Windows after refreshing PATH. A real guest boot has not been verified; this release does not claim measured VM or audio performance. The Cua SDK is optional; base installations do not gain a hypervisor dependency.

Voice model download progress

• Show separate STT and TTS progress rows above the prompt composer during first use, model warmup, and /voice download.
• Display downloaded bytes and percentages when the backend exposes a total; use an indeterminate indicator otherwise. Cached models stay quiet.
• Keep progress responsive while push-to-talk waits for transcription, reject stale pipeline/operation updates, and ignore late worker updates after cancellation.
• Share atomic streaming downloads between Piper, Parakeet, Kokoro, and sanoTTS, with timeout and transfer-length validation.
• Report failed warmup accurately instead of announcing that models are ready.

Faster speech startup

• Limit the additional spoken-summary model call, including model setup, to two seconds; use a short filtered prose fallback when it exceeds that budget.
• Play Piper sentences as soon as they are synthesized instead of buffering the complete response, and stop generating later sentences after cancellation.
• Discard replies whose voice pipeline was replaced during summarization. Keep short spoken summaries and exclude tool calls, tool results, reasoning, and subagent output.

Lightweight CPU speech options

• Add optional Kokoro 82M INT8 speech through voice-kokoro, with six English voices, CPU-only inference, and bounded inference threads. Weights and voice data download to roughly 120 MB total.
• Add optional sanoTTS through voice-sano, with four English voices and roughly 2-4 MB of weights per selected voice. The NumPy runtime needs no GPU or PyTorch.
• Configure both through /model, /settings, or /voice settings tts; preserve existing providers and the default voice selection.
• Pin optional runtimes to kokoro-onnx==0.4.9 and sanotts==0.3.0, which share the compatible phonemizer distribution. Include installation hints and updated setup documentation.
• Include the existing feature inventory document for landing-page reference. Validation: the offline voice verifier passed 166 tests with one optional-dependency skip; source type checks and new-file lint/format passed. Actual Kokoro and sanoTTS provider wrappers synthesized audio on Windows CPU in disposable environments. Physical microphone/speaker behavior, peak RAM, and universal low-resource performance were not benchmarked. Download footprints are not total runtime RAM requirements.

Code Mode for native tools

• Add a persistent Code Mode toggle below the prompt composer, with mouse and keyboard support.
• Compose ordinary registered Nova tools through JavaScript using tools.list, tools.describe, and tools.call, including sessions without MCP servers.
• Preserve existing MCPCode and mcp.* scripts. Nested calls retain argument validation, policy checks, workspace guards, tracing, and execution limits.
• Keep interactive approvals, delegation, and graph-control tools on their direct call paths to avoid replaying completed actions or losing state updates.

Whistle speech input

• Add Whistle as an optional local STT provider through the voice-whistle extra, using the Cactus runtime instead of Faster-Whisper.
• Expose Whistle in voice settings and the model picker, with lazy model loading, normalized audio input, and serialized native calls across instances.
• Install with uv sync --extra voice --extra voice-whistle, then select /voice settings stt whistle. Existing default providers remain unchanged.

Voice response fixes

• Preserve short spoken summaries while excluding tool calls, tool results, reasoning, and subagent payloads from automatic speech.
• Prevent cancelled synthesis from starting playback later, serialize overlapping speech, and preserve microphone echo suppression while speaking.
• Drop late transcripts after listening stops and recheck voice settings after asynchronous summarization or warmup.
• Share playback buffering, padding, and cancellation handling across Piper, Pocket, Orpheus, and ElevenLabs. Validation: 268 focused Code Mode tests and 131 voice tests passed. Native Whistle inference passed on Windows with cactus-needle 3.2.8. Live microphone/speaker quality and transcription accuracy were not benchmarked. Added one optional runtime dependency, cactus-needle; no default-provider dependency changes.

Preserve reply language in Wenyan mode

• Keep the user's language at every Caveman intensity unless another language is explicitly requested. Selecting Wenyan no longer asks Nova to translate replies into Chinese.
• Apply classical Chinese styling only to Chinese replies. Use matching Lite, Full or Ultra compression for replies in other languages.
• Cover all three Wenyan levels in main-agent and subagent request paths, preserving model selection and message history.
• Clarify the Options tooltip and document language behavior. Extend the optional live inference script to accept every intensity. Validation: 68 focused tests passed, plus six live English/Portuguese replies using the saved model preserved their requested languages. These probes establish language behavior for those samples, not overall correctness or token savings. No dependencies added.

GitHub-linked co-author attribution

• Add optional attribution.coAuthor.name and attribution.coAuthor.email settings so future Nova-generated commit trailers can credit an existing GitHub account.
• Apply the configured identity to model instructions and structured commit tools while preserving human authors, sign-offs, and independent commit/PR attribution switches.
• Reject malformed identities and multiline trailer injection, falling back to the existing default identity.
• Document GitHub email association, contributor eligibility, account avatars, and the limits of attribution for existing history and commits made outside Nova.
• Test persistence, prompt and tool integration, valid Git trailers, idempotence, opt-outs, and malformed identity handling. No dependencies added. Existing commits are not rewritten; GitHub account and email association must be configured separately.

Caveman skill alignment and token accounting

• Align Say less with the installed Caveman skill: default Full intensity, exact technical content, normal code/commit/PR prose, no style announcements or tool narration, and clarity overrides for warnings, irreversible actions, ambiguous sequences and clarification requests.
• Replace Nova's exact bundled response-style block in the model request rather than carrying both default and Caveman directives. Preserve custom style blocks and other instructions.
• Add Lite, Full, Ultra and the three Wenyan intensities to /caveman and Options. Persist intensity independently; save the Options draft together and discard it on Cancel.
• Give Nova-managed subagents the selected prose style without overriding their model roles or adding routing/compression utilities to local/background subagents.
• Expand /caveman audit with provider-reported output, total and reasoning tokens, plus usage observation counts. Keep estimates separate from provider usage.
• Add an opt-in paired-inference script using saved credentials and the packaged core/security prompts. Shorter visible output does not guarantee lower total usage or cost on reasoning models.
• Cover all levels, persistence, UI Save/Cancel, small terminals and subagent integration. Give the provider-cancellation regression enough setup time to reach its simulated transport before timing out. No dependencies added. Usage and audit limits: docs/caveman-mode.md.

Commit and pull request attribution

• Enable commit and PR attribution by default, with independent attribution.commits and attribution.pullRequests opt-out switches in ~/.nova/Nova.config.json.
• Give the main agent and Nova-managed subagents live attribution instructions, and normalize supported structured Git/GitHub creation-tool messages.
• Add a standard NovaCode co-author trailer while preserving human authors and existing trailers. Attribution is commit-level, using an unlinked product identity.
• Display the supplied NovaCode logo in PR attribution footers. Git commit trailers remain plain text; arbitrary shell commands follow agent instructions rather than being rewritten.
• Test persisted opt-outs, schema handling, duplicate prevention, real isolated Git commits, synchronous/asynchronous agent execution, and subagent integration. No new dependencies. Configuration and scope: docs/attribution.md.

MCP Code Mode

• Add the discoverable MCPCode tool when MCP servers are configured. JavaScript scripts can list tool metadata, inspect JSON schemas, call multiple MCP tools, filter intermediate data and return a compact result.
• Support loops, branching, dependent calls and bounded parallel execution with Promise.all, using the existing QuickJS runtime. Existing eval subagent workflows remain unchanged.
• Validate every target's arguments and preserve configured tool inventories, policy denials, session rules, optional approval-model decisions and downstream tool middleware. Unresolved manual approvals use the ordinary MCPTool path rather than replaying a script.
• Keep script state isolated per call, preserve nested trace IDs, and report the outer script's actual result. Bound code, memory, execution time, call counts, concurrency and output; cancel pending async work on interruption.
• Add offline QuickJS and stdio MCP tests, JSON property checks and a verifier enforcing coverage, lint, types and three assertion-killed negative controls on Windows and Linux CI. Usage and limits: docs/mcp-code-mode.md. This release adds no dependencies. External MCP side effects cannot be rolled back, and JavaScript number precision still applies.

Caveman mode

• Add a composer toggle, settings panel and /caveman commands for six independent features: concise replies, recoverable tool-output compression, configured model routing, script retrieval, token-waste inspection and compact web results.
• Preserve exact source recovery within the current session and keep script execution under existing permissions. No paid background cache-warming requests are sent.
• Add per-route reasoning-effort settings without changing the saved session model or effort.
• Verify the features with offline tests and nine real-inference probes using saved configuration. The probes use synthetic tool results and do not establish universal token savings.

Prompt consistency and memory

• Share built-in workflow and path guidance between the main and continuation prompts; retain explicit memory discovery and preservation instructions.
• Improve research verification, scoped output delivery, summaries and tool-schema accuracy using public first-party coding-agent sources.
• Keep main prompts package-controlled, preserve Windows and POSIX path handling, and remove stale foreign-runtime placeholders.
• Document the audit and live-check limits in docs/prompt-audit.md and docs/caveman-mode.md.

Security guardrails

• Add default-on prompt-injection handling across the main agent and built-in subagent paths. Tool results are passed as explicitly untrusted evidence, credential-like values are redacted from model-visible copies, and tool arguments that expose secret environment values are blocked.
• Add offline regression coverage, mutation checks, and a CI guardrail verification step. The focused guardrail verifier passed with 100% statement coverage for the new middleware; the configured offline CI regression suite passed (711 passed, 4 skipped, 11 subtests).
• Document the guardrail threat model and limitations in docs/security-guardrails.md. These checks validate the implemented protections and regression behavior; they are not a guarantee against every prompt-injection technique.

Fixes

• Mirror full terminal prompts to connected remote chats alongside live tool activity and streamed replies in the matching session thread.
• Attach local child-session turns to their remote threads when work starts, and include the current terminal prompt when connecting during a running turn.
• Prevent duplicate streams when a Discord connection becomes ready while a terminal prompt is being mirrored. Report prompt delivery failures without interrupting the local agent turn.
• Explain inaccessible Discord parent channels with their channel ID, API error code, permission requirements and steps to repair the saved configuration.

Verification

• Add regressions for full prompt delivery, child-session attachment, late connections, delivery failures and concurrent stream attachment.
• Verify Discord thread lifecycle, routing and unavailable-parent handling.

Features

• Add the optional Rootapp remote companion, with saved configuration, sender authorization, editable responses and session routing through Root's local DevHost.
• Give Discord sessions their own threads or forum posts, restore thread routing on reconnect and resume, and archive threads when their sessions close.

Fixes

• Reject Windows drive, UNC, device, alternate-stream and traversal escapes in virtual filesystem paths. Resolve memory and mounted paths through their actual backend and enforce canonical path denials and teammate memory-write boundaries.
• Correct saved path approval validation, root grants and Windows case handling; persist grants with restrictive atomic file permissions.
• Refuse daemon stop operations when process identity cannot be verified, tighten PID reuse checks, treat exited Linux zombie processes as stopped, and use the Windows system taskkill executable for cleanup.
• Isolate vision configuration tests and block accidental writes to live user settings.
• Update vulnerable Python dependencies and the Root companion's locked dependencies. One OpenTelemetry advisory remains constrained by the optional agent server's upstream dependency requirements.

Verification

• Validate security, remote routing, portable paths, images and daemon operations with focused regression tests, including real daemon process-tree checks on Windows and Ubuntu.
• Include the new security and daemon regressions in Windows and Linux CI.

Features

• Keep image attachments available to multimodal chat models, and add an on-demand VISION side-call for text-only models. The independent vision model can be configured in /model → Vision without changing the conversation model.
• Bound VISION calls to 30 seconds and show initialization, timeout, and provider failures in the tool result so the conversation can continue with a clear reason.

Verification

• Cover deferred image inspection, current-turn image selection, timeout reporting, and independent vision-model selection and persistence.

Fixes

• Generalize image-capability detection across routed model aliases using common vision model-name markers and provider-declared profile metadata.
• Prefer a recognized vision-capable model family over stale negative metadata from generic provider integrations while retaining explicit /vision off.

Verification

• Cover routed aliases, common profile formats, stale negative profiles, and preservation of explicit user overrides.

Fixes

• Recognize MiniMax M3-family models, including the configured M3.1 Flash model, as image-capable so Nova routes screenshots directly to the main model.

Verification

• Add regression coverage for commandcode / minimax/minimax-m3.1-flash:free.

Fixes

• Clear LangSmith optional settings when the setup form is saved blank, so a stale workspace ID can be removed and does not keep breaking authentication.
• Reset LangSmith's cached client and environment after startup credential hydration, so tracing uses the saved key and settings in the agent stream.
• Clarify that Workspace ID is optional and should be left blank unless the LangSmith workspace requires it. The interactive setup accepts clear to remove an existing optional value.

Verification

• Cover persisted startup configuration, stale-client reset, and clearing an invalid workspace value with offline tests.
• Verify a LangGraph chain and model trace can be sent and read back from LangSmith with the configured account.

Fixes

• Save LangSmith /trace setup settings across restarts. Store the API key in Nova's credential store and non-secret project, endpoint, workspace, and metadata settings in Nova.config.json.
• Restore saved tracing settings after credentials load and before the agent is created, so newly started sessions can send traces without repeating setup.
• Persist tracing enable and disable choices, and show the destination project where new prompts will appear.

Verification

• Verify saved settings restore across a simulated restart and that the API key never enters the JSON config.
• Runtime tests cover setup changes and LangGraph chain, model, and tool traces using fake credentials and intercepted uploads; live account ingestion is not verified.

Fixes

• Apply the latest /trace setup configuration inside each running agent stream, overriding stale task-local tracing settings and selecting the current SDK client and project. Close nested streams together so early exits restore the tracing and usage contexts.
• Preserve an explicit tracing-off flag when rebuilding agents. Keep the enabled flag boolean and honor the project environment when no project override is given.
• Pass the configured endpoint as the SDK's api_url argument, and propagate the optional workspace ID.

Improvements

• Add optional workspace, agent ID and agent environment fields to setup. The agent fields are trace metadata labels with the bundled SDK; project remains the destination. Keep CLI API-key entry masked and the setup form scrollable.
• Test runtime changes against stale async contexts and a real LangGraph graph containing model and tool calls. Trace uploads are intercepted locally with fake credentials; live authentication and ingestion are not exercised.

Improvements

• Base Nova's packaged standing instructions on the supplied prompts/agent.md reference: preserve memory and user work, recall plans, respect project scope, investigate before editing, verify results and communicate concisely.
• Share those instructions between the startup agent's core_agent_system.jinja and the default/continuation System_Prompt_Nova.jinja. Keep runtime tool guidance and user memory separate. The shared block is packaged and cannot be replaced by global prompt-history or activated-artifact overrides.

Tests

• Ensure both main prompt paths render the same packaged standing rules.
• Keep update-restart TUI tests offline: disable automatic background update checks while their manual update operations remain explicitly stubbed. This prevents a real update request from holding the Windows test executor open during certificate loading and teardown.

Fixes

• Require explicit parent approval for teammate file-tool writes that resolve outside the worker's project, even when auto-approve is enabled. Configured path allow rules still permit approved destinations; explicit denies win. Resolve mounted paths and symlinks before approval and recheck the destination before executing. Worktree workers use their own directory.
• Identify each teammate's assigned directory in its system instructions and prevent task text or remembered project paths from implying write permission.
• Keep the two main-agent base templates packaged with Nova. Global prompt history and activated prompt experiments cannot replace them. Global agent.md remains persistent memory rather than the source of the base system prompt.

Improvements

• Improve the default Nova coding instructions using Codex.md as inspiration: task-sized planning, meaningful progress updates, project output scope, preserving user changes, approval continuity, focused verification and honest completion reports, adapted to Nova's tools.
• Add workspace and packaged-prompt regression tests to CI on both platforms.

Limits

• File-tool approval checks are not an OS sandbox for shell commands, Python, plugins or external MCP tools. Prose output selections are not silently converted into broad folder grants; external file writes use parent approval or configured path rules. A small filesystem race remains between the final path check and execution.

Fixes

• Stop the background dream from dying on 'charmap' codec can't decode byte 0x9d. The dream agent served its memory files with upstream deepagents' filesystem backend, whose ripgrep path decoded search output with the platform locale codec (cp1252 on Windows); a single non-ASCII character in a matched line raised UnicodeDecodeError and stopped the dream. The dream memory route now uses NovaCode's own backend, and both its ripgrep path and its Python fallback decode search output as UTF-8 with a replacement fallback instead of depending on the active code page.
• Make a LangSmith configuration entered at runtime actually take effect. LangSmith caches the environment and the client it built from it, so setting LANGSMITH_* after startup left the tracer detached. /trace enable and /trace disable now clear that cached state as well.

Features

• /trace now takes the LangSmith environment from the user and activates tracing with it. A form asks for LANGSMITH_TRACING, LANGSMITH_ENDPOINT, LANGSMITH_API_KEY and LANGSMITH_PROJECT (pre-filled with the values already in use), and the result is applied and switched on without restarting Nova. The same four questions are asked on the command line outside the TUI, where an empty answer keeps the value that is already set.
• Keep the rest of the tracing command working next to the new setup flow: /trace status, /trace enable [KEY] [--project NAME], /trace disable, /trace projects and /trace traces [--limit N].
• Add regression coverage for the encoding fix (UTF-8 files through both the ripgrep path and the Python fallback, a cp1252 file in the fallback, and a grep over the dream memory files) and for the tracing setup (the four environment variables, the cache reset that makes a runtime change visible, the TUI form and the command-line prompts).

Fixes

• Classify spawn_agent teammates separately from remote LangGraph async tasks. Team workers now use inline status lines and cannot open the remote preview that incorrectly reported "The agent server is not available."
• Keep persistent teammates marked running when the lead finishes or cancels its current turn. Team lifecycle events update the same inline line when the teammate finishes.
• Add offline coverage for real in-process lifecycle events, spawn_agent tool invocation without server startup, and team status rendering without remote-server discovery.

Fixes

• Apply the shared bounded model retry policy to built-in in-process subagents, file-defined dynamic agents, and team workers. Normal async execution allows at most two Nova retries within a four-minute model-call budget, disables nested OpenAI-compatible/Anthropic SDK retries, and keeps slow tool execution outside that budget.
• Display local subagents as plain, non-clickable status lines in the chat transcript. Update the same line on completion, failure or cancellation instead of mounting expandable cards and local task panels.
• Preserve inline task status through cancellation and isolate it between session tabs. Remote async tasks retain their existing task panel and persistent monitoring.
• Add offline compiled-graph and TUI regression coverage for request limits, stalled calls, slow tools, duplicate events, clicks, cancellation and session cleanup.

Fixes

• Bound background async model turns to four minutes including retry delays, with at most two Nova retries. Disable nested OpenAI-compatible/Anthropic SDK retries and set their request timeout to two minutes without changing the selected model or shared foreground clients.
• Keep monitoring long-running async tasks instead of silently dropping them after 30 minutes. Warn after five minutes, report repeated server connection failures and recovery, and allow monitoring to restart after setup failures. Limit concurrent status requests rather than entire task watches so slow agents do not block completion notifications for later tasks.
• Add offline regression tests for actual SDK request counts, stalled-call cancellation, client isolation, delayed task completion and monitoring recovery.

Maintenance

• Updated release metadata following the agent mention routing audit.
• Verified existing in-process, file-defined, and background-only agent invocation with 28 offline invocation and async-startup checks. Runtime routing remains unchanged in this release.
• Known limitations: dual-mode agents default to in-process delegation through plain @name; built-in async names require matching agent files for mention recognition.

Fixed

• Team spawn_agent builders now pass Nova's shared store into both in-process and separate-process graphs. Learning-enabled teammates previously failed before their first model call with 'NoneType' object has no attribute 'aget'.
• In-process teammate records now report the selected model identity instead of leaving the model field unset.
• Added a five-teammate regression using real LangGraph execution and learning middleware, and extended process-worker probes to exercise the same store dependency. CI now includes team runtime and usage-accounting checks.

Validation

• Reproduced all five failures with the exact reported error before applying the fix; synthetic-model probes verify successful completion, nonzero model calls, and populated model reporting afterward.
• No new runtime dependencies or changes to the existing task delegation path.

Fixed

• Updated the root uv lockfile to match the package release version so Linux and Windows CI can install with uv sync --locked.
• Release regression checks now verify the lockfile package version and matching changelog alongside package metadata and public version displays.

Validation

• Checked lockfile freshness and release metadata locally; GitHub Actions is rerun on the pushed commit.

Improved

• Council web workspace now follows the supplied workspace reference with session presets, Synthesized consensus and Full debate views, advisor/model cards, and a live three-stage pipeline.
• Code Audit, Architecture, and Creative Debate presets change web-only specialist perspectives while retaining configured provider/model overrides. Saved Council settings and planning behavior remain unchanged.
• Advisor states, completed responses, valid ballots, and elapsed time reflect actual SSE events. Hardware statistics and confidence percentages are not simulated.
• Full debate displays specialist analyses side by side on desktop; the synthesis view keeps the chairman's streamed and final answer prominent. Clarifications, failures, stop controls, and user approval remain available.
• Clear view removes displayed messages while retaining discussion context. New discussion resets context. Added keyboard-accessible view tabs and responsive controls.

Validation

• Added preset immutability/model-preservation tests, real HTTP/SSE preset routing checks, and browser checks for view switching, pipeline stages, metrics, clear behavior, keyboard navigation, and mobile layout.
• Reviewed desktop and phone screenshots with synthetic streams. No new runtime dependencies.

Improved

• Web Council advisors now stream independent analyses in parallel, followed by peer ballots and a dedicated chairman synthesis stage.
• The configured judge seat acts as the web chairman, using its provider/model override or inheriting the session model. Matching member model overrides are reused.
• The chairman receives public analyses, vote reasons, tally, clarifications, and failed-member information. Its instructions require reconciling disagreement, identifying unsupported claims, retaining minority concerns, and proposing next steps.
• Web debates show streaming synthesis before enabling final approval. Ballot totals remain advisory; a failed chairman produces an explicit error instead of presenting a vote as consensus.
• Added bounded parallel stream buffering, worker cleanup on cancellation, and off-thread search execution. Follow-up history includes the consolidated answer.
• Planning Council behavior and model routing are unchanged.

Validation

• Synthetic-provider checks cover simultaneous advisor starts, cancellation cleanup, chairman inputs and streaming, failure handling, model reuse, HTTP SSE synthesis, and final browser approval.
• Existing Council UI, settings, and planning regression checks remain covered. No new runtime dependencies.

Improved

• Cowork now matches Council's slate and sea-glass palette, editorial welcome typography, and refined conversation, question, permission, and activity panels.
• Each Cowork sidebar tab uses one keyboard-scrollable region, including folder controls, grants, tasks, and activity. Tabs, section headings, and workspace status remain fixed.
• Council and Cowork sidebars use slimmer scrollbars, stable scrollbar spacing, and contained scrolling. Long session identifiers no longer crowd out sidebar content.
• Refined mobile spacing and retained workspace permissions, chat, cancellation, and session controls.

Validation

• Added browser coverage with 35 granted folders and 30 tasks on short desktop and phone screens, including keyboard scrolling and access to the final items.
• Existing Council/Cowork browser and Cowork server checks cover the shared layout and preserved behavior. No new runtime dependencies.

Improved

• Refined the Council web workspace with a slate and sea-glass palette, clearer decision brief, editorial welcome typography, and polished advisor, question, verdict, and composer treatments.
• Added Council settings to the web header with all controls from the inline editor: six member identities, judge, personality templates, system prompts, and provider/model overrides with session inheritance.
• Web settings use the same validation and saved configuration as inline Council. Templates, resets, and seat changes remain private drafts until Save; Cancel discards them. Active discussions retain their configuration.
• Added responsive settings navigation, keyboard focus handling, model ID suggestions, and clear labels for the planning-only advisor and judge.

Validation

• Browser checks cover settings drafts, templates, model overrides, save errors, persistence requests, reset, cancel, and narrow-screen layouts alongside existing streaming and decision controls.
• HTTP checks verify shared persistence, validation, provider metadata, cross-origin save rejection, and preservation of the main session model. No new runtime dependencies.

Improved

• Council decision briefs support up to eight options and explicit criteria.
• Advisors can ask clarification questions with suggested choices or a free-text answer before presenting independent recommendations, risks, and next steps.
• Decision ballots vote for actual options. Invalid ballots abstain, ties remain unresolved, and the user approves, revises, or rejects the recommendation.
• Added a stop control, SSE heartbeats, bounded buffering, disconnect cancellation, pending-question cleanup, and a single terminal event after history is recorded. Dropped browser streams close explicitly instead of retrying a new debate.

Validation

• Added model-free clarification, option-voting, abstention, HTTP answer-token, heartbeat, cancellation, and end-to-end SSE clarification checks.
• Existing discussion mode and responsive Council/Cowork browser regressions remain covered.

Improved

• Council now has an advisor sidebar on the left and a dedicated conversation area on the right, with discussion controls and question suggestions.
• Cowork uses the same conversation layout, with workspace permissions, tasks, and activity accessible through tabs in the left sidebar.
• Mobile sidebars open as drawers with keyboard focus handling and Escape to close. Both pages use a compact header and a persistent chat composer.
• Added browser regression checks for streaming, follow-ups, approval, workspace grants and revocation, questions, cancellation, and mobile navigation.

Improved

• Redesigned the artifact collection with responsive cards, file-type accents, version and update metadata, and visible artifact IDs to distinguish repeated titles. Added search by title, type, or ID, sorting, and empty states.
• The collection uses no external assets and keeps artifact content isolated inside the existing full-preview sandbox.

Fixed

• /share artifacts and /share all now use the same hosting path as artifact creation, fixing the unexpected server keyword error.
• Artifact hosting requires Cloudflare Tunnel and reports a missing cloudflared installation while retaining local artifact access. It no longer silently falls back to ngrok.
• Added integration coverage for automatic hosting, both share commands, tunnel reuse, updates, restored artifacts, session cleanup, and startup failures.

Changed

• /share now supports artifact previews only. Removed sharing of Council, Cowork, and Create, along with the generated share dashboard. Legacy generated dashboard artifacts are removed when their session is restored.

Added

• Artifacts are automatically hosted with free Cloudflare Quick Tunnels, with ngrok as a fallback. Council, Cowork, and Create retain their existing local server behavior; manual /share remains available for those pages. Artifact hosting resumes with a restored session, while /clear revokes that session's hosted artifact page.

Fixed

• Temporary sharing checks that each local page accepts connections before Nova starts a public tunnel, and reports the exact local address if it does not. This avoids publishing a link that immediately returns ngrok 8012.

Added

• /share all starts temporary shares for Artifacts, Council, Cowork, and Create, then provides one responsive dashboard with links to each page.
• Sharing pages individually refreshes the dashboard when the Artifacts share is active. The dashboard marks pages that are not currently shared.
• Dashboard links open outside the artifact preview sandbox so each shared app retains its normal browser behavior.

Fixed

• Temporary sharing works with current ngrok agents by avoiding the removed --web-addr flag. Nova disables ngrok's local traffic inspector for its managed tunnels, so multiple shares do not compete for its default port.

Verification

• Added a regression test for the ngrok startup arguments and URL discovery.

Added

• Temporary public sharing for Artifacts, Council, Cowork, and Create through /share, with commands to list and stop active shares.
• Responsive mobile layouts for the shared web interfaces.
• Artifact restoration when resuming a saved session. Switching sessions now loads that session's artifacts without retaining artifacts from the previous session.

Fixed

• /share without arguments once again uploads a session gist without raising UnboundLocalError.

Added

• NotebookEditTool for inserting, replacing, and deleting Jupyter notebook cells without executing code. Edits preserve unrelated cells and metadata, clear stale outputs from changed code cells, and use atomic file replacement.
• Workspace-bound notebook editing with approval checks, Cowork write grants, and plan-mode restrictions.
• Optional native bfs traversal and ugrep content search, with ripgrep and Python fallbacks. Imported agent definitions recognize GlobTool and GrepTool aliases.
• Animated terminal-title spinner while the active session is working, including single-session mode. The plain title returns when work finishes.
• CI coverage for notebook editing, native search, and terminal-title activity.

Fixed

• Python grep fallback now matches basename globs in nested directories, searches only the requested file, treats literal patterns literally, and skips binary data.
• Renamed CI documentation so GitHub displays the main NovaCode README.

Verification

• 266 focused regression tests passed before the version bump, with one optional native-search test skipped on Windows. Real bfs and ugrep checks passed on Linux.
• Broader session tests still have pre-existing banner-layout failures.

Changed

• Separated remote session labels, progress, plans, and recent tool activity into readable sections, with bounded previews of long plan items.
• Made long Telegram diff previews collapsible while retaining the patch text.
• Rendered Telegram tables as stacked records for phone screens, preserving links and inline formatting.
• Rendered Markdown task lists with completed and pending checkboxes.

Fixed

• Made desktop sleep regression tests explicitly cover Windows, Linux, and macOS commands instead of assuming the host is Windows.

Added

• GitHub Actions CI for Windows and Linux regressions, release metadata checks, focused lint, and Windows package installation and updater checks.

Verification

• 116 release version, Telegram, remote status, streaming, and bridge tests passed; live Telegram client rendering remains unverified.
• All three hosted CI jobs passed after the portable desktop sleep test fix.

Added

• Generic MCP discovery and execution with bounded results, server allowlists, and approval checks on the underlying tool.
• Separate cron create, delete, and list tools using the persistent scheduler.
• Optional context inspection and terminal panel capture tools behind feature gates.
• Regex and BM25 tool search variants alongside the existing hybrid search.
• Provider-aware strict tool schemas and raw argument validation, with documented capabilities and fallbacks for all 18 configured providers.
• Essential tool documentation covering discovery, feature gates, and strict mode.

Changed

• Removed the GitHub trending, Hacker News, LinkedIn jobs, Reddit posts, and package info tools from the agent tool inventory.
• Made desktop sleep discoverable on demand instead of loading it by default.
• Retained shell and Bash for their distinct interpreter support.

Fixed

• Applied shell approval policy to Bash commands.
• Hardened scheduler startup, persistence failures, and loading large job lists.
• Preserved MCP metadata through strict schema binding and rejected invalid raw argument types before tool execution.

Verification

• Focused coverage includes local MCP execution, cron persistence, feature gates, search variants, strict validation, provider adapters, and subagent integration.
• Provider capabilities were checked against documentation and local adapters; live inference across all providers was not tested.

Fixed

• Fixed async subagent dispatch rejecting requests that combined Nova's run context with deepagents' redundant parent-thread configurable. Parent lookup continues through the child thread metadata.
• Preserve unrelated configurable values and omit Nova context for those runs to avoid LangGraph's mutually exclusive configurable and context request fields.

Verification

• 18 async model context tests passed.
• 15 configured async subagents accepted and completed through an isolated local Agent Server using scripted models.
• 78 in-process and 78 dynamic subagent checks passed.
• Ruff formatting, focused lint and git diff --check passed.

Added

• Essential SendMessage(recipient, content) tool for plain-text messages between connected project tabs, using existing queued delivery and linked replies. list_sessions is also always available for recipient discovery.
• Essential EnterWorktreeTool(name) and ExitWorktreeTool() for moving the current local agent's file and shell tools into a fresh Git worktree and back. Exit keeps the worktree, branch, commits and uncommitted changes.
• Workspace transition guards for parallel tool calls and cancellation, normal approval handling, and plan-mode restrictions.
• Usage documentation and real Git, shell, agent-graph and mutation checks.

Verification and limits

• 80 focused worktree, tool-discovery and messaging regression tests passed; all three targeted behavioral mutants were detected.
• Three release metadata, version banner and real CLI version checks passed.
• Messaging connects tabs within one NovaCode TUI instance. Independently launched terminal instances and standalone headless runs are not connected.
• Worktree switching requires a local Git repository with a commit. External MCP servers, existing jobs and remote agents retain their own workspaces. Active workspace switches are not restored after resume or agent rebuild.
• Full-suite collection remains blocked by the installed deepagents API mismatch (create_sub_agent is absent). Five upstream startup-version scan tests also fail against missing installed deepagents internals. New files pass Ruff; no dependencies were added.

Added

• Agent teams and autonomous swarm switches in /settings under Experimental. Swarm requires teams; both remain disabled by default. Settings apply at the next prompt without changing the model or clearing the conversation.
• Usage examples for manual teams and worktree swarm tasks in the agent teams guide.

Fixed

• Refresh team feature gates when rebuilding an existing session, including the swarm scheduler on a reused coordinator.
• Preserve ownership of existing workers when disabling teams. Running workers are not cancelled, new swarm assignments pause, and re-enabling teams restores access to the same coordinator.

Verification and limits

• 83 focused settings, invocation and team tests passed offline. A final 36-test rerun also passed with a strengthened running-worker lifecycle regression.
• Type checks passed for configuration, invocation and team bootstrap. No new Ruff findings were introduced; existing formatting debt remains in the settings screen and its older tests.
• No new dependencies or paid calls. Live provider and container execution were not evaluated; agent teams and swarm remain experimental.

Added

• Experimental agent teams, disabled by default: persistent in-process teammates, fork/worktree workers, a configured container adapter, durable scoped inboxes, versioned task claims, approval forwarding and separately gated swarm scheduling.
• Editable built-in specialists shipped as flat agent definition files and seeded once into the global agents directory without overwriting user definitions.
• Automatic memory-wiki consolidation behind time, session-count and ownership gates, with a restricted background dream agent and /dream controls.
• Request-local snip/collapse strategies before model compaction, recoverable offloaded results, and context accounting based on schemas actually sent.

Fixed

• Project agent definitions override global namesakes before execution-mode filtering, consistently across lookup, synchronous/background rosters and HTTP listings. New definitions use <project>/.nova/agents/<name>.md or ~/.nova/agents/<name>.md; existing directory definitions remain supported.
• Root TUI sessions and session workers refresh changed definitions before their next turn while retaining the model, checkpoint, workspace and policy settings.
• Background-only mentions route to start_async_task; async: true retains both synchronous and background invocation under the same name.
• Context displays distinguish estimated category shares from provider input usage, account for deferred tools and identify MCP schemas by server.
• Prompt guidance names background tools only when their server is usable.

Verification and limits

• The retained invocation/session/team regression passed 275 checks. Pre-push checks across 41 test files, using isolated groups and reruns, finished with 520 passing cases, one skip and three UI failures reproduced on unchanged baseline: todo collapse, long-list scrolling and the responsive-layout mock. A timing-sensitive stream check passed on rerun; a bounded UI batch's remaining cases were run separately. This is not a green full-suite result.
• A fresh staged-source wheel includes all 14 built-in agent files and the new modules, and excludes the removed specialist modules and review captures.
• Team/container behavior remains experimental. Live Docker/provider execution, real-model task quality and resumable reconnect are unverified. Recovery is cleanup-only; shared file-read caching remains deferred.
• Earlier broad-suite failures/timeouts and two baseline runtime typing errors are documented in the agent-team and invocation evidence. No new dependencies or paid model calls were required.

Added

• Nine providers in /auth and /model: Azure OpenAI (v1 API; endpoint in /auth or AZURE_OPENAI_ENDPOINT), Amazon Bedrock (optional [bedrock] extra; Bedrock API key or any AWS credential), Mistral, Groq, Cerebras, xAI, Hugging Face, Kimi For Coding and MiniMax. Model lists come from the cached models.dev catalog, curated ids first.
• Session history is a tree in one append-only tree.jsonl per session. /tree browses every branch, filters by message type, bookmarks entries and continues from any earlier point without losing the old branch.
• /export [file] writes a self-contained HTML page of the session tree, with token-shaped secrets masked. /share uploads it as a secret GitHub gist (after a confirmation) and prints a link that renders it.
• /nova shows a pixel avatar above the composer that reacts to what the agent is doing. Frames are a 64-pixel sprite sheet drawn with octant glyphs, or half-blocks where octants are unavailable.

Fixed

• The /mcp dialog's buttons sit in two rows of three, so Close is no longer cut off on terminals between about 90 and 120 columns.
• A refused MCP OAuth registration (403) now says why. For Figma's hosted server, which only admits approved clients, it points to the figma-desktop preset. Connection errors are unwrapped from task-group exception groups.

Removed

• The native Windows avatar overlay window (128-pixel RGBA frames). It crashed Windows Terminal; the character-cell avatar is used on every platform.

Validation and limits

• Focused runs passed: 86 tests across sessions, avatar, providers, MCP and status-line controls, then 12 MCP tests including a button-fit check at 90, 100 and 120 columns.
• Live calls to the nine new providers were not made (no keys available). Kimi For Coding may restrict its plan to approved coding agents.
• uv.lock adds langchain-aws and boto3 for the optional bedrock extra only; the base install is unchanged.

Added

• /statusline opens a checkbox picker with a live preview, Save, Reset and Cancel. Saved field choices persist across launches and apply across designs.
• /auto-approve [on|off|status] controls the current session's approval mode. An amber composer and explicit label indicate automatic tool approval. Child tabs and Telegram topics retain independent approval preferences.
• A provider reasoning-support report documents supported controls and limits.

Fixed

• /effort preserves the current provider, model and shared steering list when rebuilding, instead of falling back to the globally saved model. default removes the override; the command describes model-specific limitations.
• OpenCode's Claude route forwards thinking settings. OpenRouter receives its unified reasoning control, and Command Code/OpenCode DeepSeek V4 models receive low/high effort settings.
• Session switches refresh status details and preserve per-session effort and plan-scoped approval state. Explicit approval choices survive remote shutdown.

Validation and limits

• Focused runs passed: 143 provider/UI tests and 145 session/worker/TUI tests. Final checks passed 42 worker/control tests and 17 provider-wiring tests, including serialized HTTP-body checks with an offline mock transport.
• New picker modules and tests pass Ruff lint/formatting; picker modules pass mypy. Diff whitespace checks pass. Existing broader lint issues remain.
• Live authenticated model calls were not run. Supported reasoning controls still depend on the model and route; off can mean minimum effort.
• No dependencies were added. Personal configuration and unrelated local files are excluded from this release.

Fixed

• Follow-up messages in the main terminal, session tabs and Telegram reach a running agent at its next model step. Input received during a final response can continue the same turn, and unread late input remains available for a subsequent turn. In-flight model and tool calls finish before pickup.
• Model switches and MCP reloads preserve the shared live-input queue.
• Closing or sending input to a child session no longer cancels another session's turn. Input retains its intended session across tab switches.
• Model routing actions use a responsive grid so Cancel and the other buttons remain visible and clickable on smaller terminals.

Validation and limits

• 211 focused steering, session, remote and TUI regression tests passed. The broader run also detected a user-config change at teardown; subsequent 45-test and 21-test runs passed with the config guard clean.
• Router regressions passed at five terminal sizes. Live model and Telegram service calls were not run. No dependencies were added.

Added

• Figma, Vercel and Higgsfield MCP presets use the providers' official hosted endpoints with browser OAuth and Nova's existing secret-backed token storage.
• A Figma Desktop preset connects to the enabled local Dev Mode server. Figma's remote service currently restricts access to approved clients; desktop use requires an eligible seat. Higgsfield requires a paid subscription.
• The landing site includes a redesigned home page, verification page, custom 404 page, responsive navigation, motion effects and local assets.

Improved

• HTTP presets skip local package installation and unnecessary input prompts. CLI installation explains how to authenticate through /mcp.
• The README is condensed around setup, essential commands and optional capabilities, with brief instructions for the new integrations and a Classic terminal preview. The original Nova logo is retained.

Validation and limits

• 74 focused MCP preset, authentication, session and tool-discovery tests passed. Preset/test lint and formatting, changed-line installer lint and preset typing checks passed. Account authorization and live provider tool calls were not run.
• All three landing pages passed a local Chrome smoke check at desktop and mobile widths with reduced motion: no JavaScript errors, failed assets or horizontal overflow. Local asset/link/anchor checks and application JavaScript syntax passed. This is not a full accessibility or browser compatibility evaluation.
• Python dependencies are unchanged. The static site includes local GSAP, ScrollTrigger, SplitText and Lenis browser libraries with their bundled notices.
• FEATURES.md, private credentials and local review artifacts are not published.

Improved

• Explicitly approved plans are saved in the project's .nova/plans folder and mirrored to the global archive. Automatically approved plans stay global. recent_plans lets the agent find and read both stores for the current project.
• /dream maintains a linked memory wiki with compact indexes, topic maps, related pages, backups and broken-link checks. It recognizes habits-only and project-scoped notes, preserves stable habit checklists and defers writes in plan mode. Memory overflow retains recoverable originals.
• Main, planning, memory and review prompts now agree on delegation, bounded waiting, instruction scope, plan locations and wiki navigation. Responses can follow the requested format without a fixed four-line limit. Desktop sleep requires a user request or applicable standing instruction.

Validation and limits

• Release checks passed: 135 memory/wiki tests and 142 prompt, planning, approval, async-task and agent integration tests. The memory engine/tool retained 99% coverage; five focused runtime files passed mypy. Detailed evidence is in scripts/PROMPT_AUDIT.md and scripts/memory_wiki/EVIDENCE.md.
• The memory-wiki engine/tool previously achieved 99% branch-aware coverage; three isolated manual mutants were rejected. These checks establish structural contracts, not live-model reasoning or consolidation quality.
• The full suite is not claimed passing: a background handoff timeout was also reproduced on the baseline. Existing typing errors remain documented.
• No new dependencies, model changes or paid provider calls. Personal memories, credentials and prompt overrides are not included in this release.

Improved

• Startup resume, /resume, and reopening saved tabs share a searchable session browser. Search tasks, projects, models, or session IDs while preserving the correct session selection.
• A scrollable details pane shows the saved task, project, model, status, blockers, and next step. Legacy sessions clearly indicate when their original model cannot be restored.
• Resume dialogs follow the selected design and color palette. Compact layouts keep search, actions, and the selected session visible while preserving the current draft.
• The resume-mode dialog explains the existing summary-first and as-saved choices.

Validation and limits

• 79 focused regression tests passed, covering resume choices, saved-model restoration, saved tabs, session clearing, and design preferences. The final nine UI tests also passed after the compact-selection adjustment.
• The new dialog and its tests pass Ruff and formatting checks; the new dialog passes mypy. Headless previews were reviewed at desktop and compact sizes.
• No new dependencies or live provider calls. Native terminal rendering was not manually tested.

Fixed

• /effort on Claude Sonnet 5.5 (and other Claude 4.6+ and Fable models) failed with "thinking={"type": "enabled", "budget_tokens": ...} is not supported". Nova now sends adaptive thinking with output_config.effort to those models and keeps budget_tokens for older ones. "off" is the lowest effort, since disabled thinking is rejected by Opus 5.5, Sonnet 5.5 and Fable.
• OpenAI: /effort reaches every reasoning model (o-series, GPT-5 and later), not only names containing o1/o3, and is no longer sent to models that reject it (gpt-4o, gpt-4.1, *-chat, o1-mini/preview). "off" is "low", since "none" and "minimal" are not accepted by every model.
• Gemini: 3.x and later get thinking_level (Gemini 3 Pro has no medium), 2.5 gets thinking_budget within each model's limits ("off" is 0 on Flash and the 128 minimum on Pro), and 2.0 gets no thinking setting.

Validation and limits

• 34 tests cover each model family, including the requests langchain builds for Claude, OpenAI (both APIs) and Gemini 3; the model-build, NVIDIA and TUI effort tests pass.
• Not tried against the live providers.

Added

• /update has an Update now button: it saves the session (stopping a running turn after asking), installs the update in the same terminal, restarts Nova and reopens the session, continuing an interrupted turn. A failed update restarts the current version.
• /claude-review and /codex-review: Claude Code or Codex reviews the changes headless and read-only; Nova verifies the findings and reports them. Both resume with resume and report progress to Telegram.
• /claude-plan resume and /codex-plan resume continue a planning stopped with Esc or /stop.
• Settings shows Claude Code and Codex usage (5-hour and weekly windows) as progress bars, with a Check Claude now refresh.
• Message queueing, interrupt-and-redirect (/redirect, also from Telegram), pulling a queued message back with Up, and Up/Down input history.

Changed

• nova update shows animated stage progress and a finish screen without clearing the terminal. On Windows it runs in the foreground (the running launcher is moved aside), so the shell prompt returns only when it is done.
• Per-call tool schemas are 55% smaller (45 tools / 57k characters to 25 / 25k): most-used tools are ranked on the last 30 days, the async agent roster is one line per agent, rarely called tools load through search_tools, and long descriptions are shorter.
• The NOVA wordmark shows in windows narrower than the full banner and in windows from 17 rows tall, instead of disappearing.
• wait_for_task is a short look of at most 10 seconds, once per user message.

Validation and limits

• Focused suites for updates, planners, reviews, banners, tool search, queueing and the TUI pass; the full suite was not run.
• Update now and the in-place Windows update were tested with stand-ins and a throwaway uv tool, not yet on a real Nova install.
• Only the main session is reopened after an update; extra session tabs are not.

Fixed

• Start approved TUI plans in a fresh execution conversation with the complete plan text, including plans from /plan, /claude-plan, /codex-plan, and main-agent self-planning.
• Import implementation steps and verification checks into the execution todo list before starting. Reject todo updates that remove or rename imported plan items, and report items left open after execution.
• Stop the handoff if the approved plan cannot be loaded, preserve the planning backend until plan resolution, and remove plan-debug chat messages.

Validation and limits

• The focused plan, command handoff, agent stream, middleware, path, and archive suite passed 82 tests.
• Ruff, formatting, and mypy checks pass for the new plan execution module; git diff --check passes.
• The full suite timed out before producing a final report. Existing legacy modules retain lint findings. No new dependencies were added.
• Todo tracking does not prove semantic completion by a model. The existing done gate nudges once when items remain open, and the TUI reports remaining items.

Improved

• Added Centered, Banner, and Minimal interface styles in Settings alongside Dashboard and Classic. Styles apply immediately and preserve the conversation and multiline draft.
• Extended Banner and Minimal styling to conversations, tool output, task panels, terminals, status indicators, and modal dialogs, including /model and nested confirmations.
• Unified modal tabs, lists, fields, buttons, and backdrops with the selected style and color theme. Minimal uses compact inputs and borderless panels; Banner uses subtle frames.
• Removed the user-message hover background and fixed terminal text colors that ignored the selected theme.

Fixed

• Apply interface styles on every screen change, including modal screens that open without a resize event.
• Ignore periodic home refreshes after layout widgets have been removed during shutdown.
• Preserve existing Dashboard/Classic preferences when no new interface style is saved.

Validation and limits

• The focused home, question, subagent, terminal, and reference-screen run passed 83 checks and exposed one shutdown refresh failure; that failure passed after the fix.
• Subsequent focused runs passed the modal styling, keyboard navigation, nested confirmation, live switching, form control, and removed-layout regressions.
• Visually inspected Banner and Minimal model and settings dialogs. Home presentation and preference tests pass Ruff; home presentation passes its focused mypy check. The wider TUI retains existing lint findings.
• Tests used isolated user profiles. The full suite and live model providers were not exercised. No new dependencies were added.

Improved

• Added a persistent Redesigned home screen toggle under Settings → Appearance. Turn it off for the classic banner and chat layout; changes apply immediately without replacing the conversation.
• Classic mode skips dashboard resource sampling and hides its taller banner in short terminals to keep the composer usable.
• Removed decorative vertical accent bars from messages, task cards, notices, terminals, and detail panels, including rendering code that recreated bars during updates.

Fixed

• /clear now rebuilds the full fresh-chat context estimate, including tool schemas, before refreshing the CTX indicators and home panels. Opening /context no longer changes the count merely by including those schemas.
• Ignore late system-resource samples after the dashboard panel has been removed during shutdown.

Validation and limits

• All 121 focused offline home-layout, context, animation, message, task-card, reference, workspace, harness, and terminal regression checks passed across two runs.
• New test files pass Ruff lint and formatting checks; the wider repository retains existing lint findings.
• Live-provider behavior was not exercised. No new dependencies were added.

Fixed

• Keep newer provider context counts after compaction and exclude auxiliary summarizer requests from the main context indicator.
• Refresh the TUI context indicators together when usage arrives. Remote goal runs now sum usage across turns while displaying the latest request's context size.
• Release wait_for_task when new user input arrives, allowing the agent to respond while the background shell job or subagent continues. Wait interruption is isolated by conversation and supported by the TUI, child sessions, and remote messages.

Validation and limits

• A combined offline goal, compaction, usage, protocol, waiter, worker, remote-status, and TUI regression run passed all 205 tests.
• Waiter Ruff formatting, lint, and mypy checks passed; the wider repository retains existing lint findings.
• Live-provider behavior was not exercised. No new dependencies were added.

Improved

• Redesigned the home screen with navigation tabs, quick task starters, and theme-aware system, model, task, and context panels.
• Added live CPU, RAM, and network counters through the new direct psutil dependency. The composer spans the terminal width and navigation tabs align left.
• Goals now retain their objective, lifecycle, and turn budget across session saves. Added pause, resume, and budget controls to the TUI, shared commands, and child sessions.
• Goal continuation yields to planning and queued input, pauses on interruption, avoids tool-free loops, and requires an explicit completion declaration with evidence.

Fixed

• Added a reducer for concurrent _context_snapshot writes, preventing the remote INVALID_CONCURRENT_GRAPH_UPDATE error while preserving a complete diagnostic.
• Prevented completed or paused goals and old rubrics from leaking into later agent requests or background threads.
• Restored the full conversation area when a shell command starts from the home screen.

Validation and limits

• Goal, agent-stream, worker, headless, and snapshot checks passed (144 tests in one focused run); final TUI/session/worker checks passed (114 tests in another run). These runs overlap.
• Targeted Ruff and mypy checks passed. The wider repository retains existing lint findings.
• The full suite reached a shell background-handoff timeout. That timeout, three context-metric assertion failures, and the async delegation prompt assertion failure were reproduced on unchanged 7f4b87e.
• One TUI scroll-timing assertion failed in the broad TUI run and passed on its focused rerun and subsequent session run.

Improved

• The prompt composer starts at one text row and grows as lines or soft wraps are added, leaving more room for the conversation when idle.
• Explicitly enables soft wrapping and adds TUI coverage for multiline cursor navigation, in-place editing, growth, and shrinkage.

Validation and limits

• TUI and clipboard tests passed (107 tests).
• Ruff still reports existing findings in the touched files; none were on the added lines.

Fixed

• Isolated learning proposal tests from a developer's auto-approval setting and real proposal ledger.
• Updated curator and skill refinement regressions to verify proposal approval and between-turn activation.
• Clarified curator and refinement messages to describe pending proposals.

Validation and limits

• Focused learning regressions passed (194 tests); the directly affected set passed again after final edits (60 tests).
• A live model review was not exercised; these tests use offline fixtures.

Fixed

• The main agent is prompted to collect required async subagent results before claiming a task is complete, using bounded waits and a clear pending status after five minutes.
• Async subagents that finish during an active TUI turn are queued for an automatic result fetch after that turn.
• !! returns to the TUI when its terminal command exits, without waiting for an extra Enter key.

Validation and limits

• Focused async completion, prompt, waiter, and terminal command tests passed (35 tests).
• A live remote subagent was not exercised; the remote completion path was tested offline.

Added

• wait_for_task performs a bounded wait for a background shell job or async subagent and reports its current status or result.
• list_waiters exposes active waits and their targets.
• The TUI task bar shows the number of active waiters and their targets, with details in a tooltip.

Validation and limits

• Focused waiter, shell-job, prompt, and TUI tests passed. Ruff and an isolated mypy check passed.
• A live remote subagent wait was not exercised; the remote path is covered with offline tests.

Improved

• The coding workflow checks what numeric values include and verifies ambiguous classifications against the full category definition.
• The optional post-edit reminder recognizes failed checks and checks with no tool result.
• Terminal Bench analysis records post-edit check attempts and compares matched jobs; the evaluation launcher supports SWE-bench Verified.

Validation and limits

• A matched Terminal Bench financial-document task improved from reward 0 to 1, with seven verifier tests passing. This single task does not establish a general accuracy gain and used more tokens.
• Focused agent and prompt regressions passed (87 tests). The full suite was kept separate; five pre-existing scoped mypy errors remain.
• A separate HTML-filter benchmark has a flawed clean-input comparison; its score was not used as evidence for a harness change.

Improved

• The shared coding agent asks for an independent check before generalizing from one example and gives more useful guidance when a shell check repeats without progress.
• Context compaction budgets encoded images by request size and treats provider HTTP 413 responses as a signal to compact. Oversized inline tool images can be omitted on the fallback retry.
• Terminal Bench runs use the effective Harbor time limit in the prompt, report failures and token use locally, and allow more graph steps before the task time limit.

Validation and limits

• The full Terminal Bench 2 run passed 49 of 89 tasks before these fixes. A graph-cutoff replay passed, but took a different path below the old graph limit, so causation is unproven.
• An image-heavy video replay reached grading without the earlier HTTP 413, but still failed the verifier's second video. The prompt change has not established better task accuracy.
• Focused context, provider-error, loop-guard, analyzer, and evaluation-wrapper checks passed. The full unit suite and full Terminal Bench run were not repeated for this release.

Added

• Cross-project communication between live tabs in one Nova window: use @tab:<session-id> <message> or @<unique-title> <message>, with autocomplete, queued delivery and linked replies. Agents can list sessions, send messages, read owned requests and explicitly reply through four session tools.
• Linked replies render as Markdown in initially collapsed panels. Attach to prompt adds the final answer to the owning tab's draft without sending it or interrupting a task; Open tab navigates explicitly.
• /tabs resume picks a saved session across projects; /tabs resume <id> accepts an exact ID or unique prefix. Sessions reopen in their saved project with their history, assistant, model continuation and checklist. Already-open sessions reuse their tab.
• Reproducible cross-session regression, coverage, baseline-probe and fault-injection checks, with separate implementation evidence reports.

Fixed

• Linked replies retain the latest main-agent answer instead of concatenating intermediate and subagent output into a duplicate raw transcript block.
• Child sessions save after each turn, including interruption and error paths. Cancelling subprocess startup removes the incomplete tab.
• Child shutdown closes stdin before waiting for process exit, releasing outstanding pipe reads.
• Telegram topics use NovaCode · <session name>. Existing topics update on reconnect while preserving their history and routing; unchanged titles avoid repeated edits and failed edits can retry without creating duplicate topics.
• Telegram and peer turns use correlated prompt IDs so queued replies and attachments remain associated with the correct request. Unicode tab addresses are supported and ambiguous names fail clearly.

Limits and validation

• Cross-session communication covers live tabs in a single Nova window. It shares only explicit message content; each recipient retains its own workspace, history, model and tool approval settings. Message bookkeeping is bounded and held in memory.
• Resuming requires an existing, Nova-approved project folder. Historical tools are displayed without executing them. Model availability and legacy-session fallbacks retain the existing continuation behavior.
• Targeted Windows session, tab, Telegram, transcript and model-restoration regressions pass using simulated model events, mocked Telegram APIs and real child-process transport rehearsals. New communication and resume modules have 100% line coverage.
• No live-provider or live-Telegram validation was performed. Existing full-suite timeouts and repository-wide lint limitations are documented in CROSS_SESSION_EVIDENCE.md and TAB_RESUME_EVIDENCE.md.

Added

• Telegram remote commands now use the normal TUI handlers in the main session topic, including skills, model selection, settings, and plugin commands.
• Interactive command panels expose numbered choices in chat. Use /choose N, /set N value, /input N value, /panel N, and /back to select actions, edit fields, submit forms, navigate pages, and close panels. Controls belong to the requesting sender and topic; password fields are masked.
• Telegram's native slash-command autocomplete menu includes registered commands and enabled skills. Menus refresh in the background after connection, skill management, and plugin registration; unchanged menus do not issue another registration request.
• Child sessions resolve slash commands through shared CLI handlers and invoke skills in their own workspace, preserving skill arguments and pinned prompts.
• Included context-display screenshots (CTX1.png and CTX2.png) and regression coverage for context-gauge updates while idle.

Fixed

• Commands sent during a running main-session task are queued until the turn finishes, with a bounded queue and cleanup on shutdown.
• Telegram command names with a bot suffix route correctly, including panel controls. Menu names use underscores in place of hyphens and resolve back to the original commands.
• Failed, cancelled, expired, and undeliverable remote command panels release their resources; expired panels dismiss waiting dialogs.
• Large command panels can be paged, and long command output is split for delivery.

Limits and validation

• Telegram permits at most 100 command-menu entries, shared across the chat's topics. Commands take priority, followed by enabled skills; other skills remain callable with /skill:name.
• TUI-only management panels are available in the main topic. Child topics use the shared CLI handlers for other commands.
• Remote command, autocomplete, streaming, topic, and session-worker regression tests pass with mocked Telegram APIs. Live Telegram behavior has not been verified.

Added

• Clicking a task in the subagents panel opens a full page laid out like the main transcript: the task as a prompt block, the agent's name over rendered Markdown, and each run of tool calls as one block with a theme-coloured bullet per call and its result on the same line. Results are matched to their own call, so parallel calls that finish out of order still read correctly.
• A Telegram topic that connects while a turn is running joins that turn, starting from the response so far, instead of waiting for the next prompt.
• Nova's own context compaction for the main agent and every subagent: prune old tool results, trim old tool-call arguments, then summarize with the /compact engine. Your messages are kept verbatim, a failed summary no longer fails the turn, and the summary call no longer streams into the transcript.
• Nova works within a 128K-token context budget by default. Set context_budget_tokens to change it (0 uses the model's whole window). /context, auto-compact, and compaction all use the same figure.
• Learning reviews once when a task ends, with the real outcome. Lessons are stored per project and reach the shared pool only when a second project confirms them; a failed task shares nothing.
• Pitfalls are stored as symptom, cause, and fix, and recalled when failing output matches them by meaning, using a local embedding model (word overlap as fallback). Built-in environment lessons are recalled only at a failure.
• Ollama models run through Ollama's OpenAI-compatible endpoint. Thinking off maps to reasoning_effort=none, and a local model's context window is read from its Modelfile num_ctx, then OLLAMA_CONTEXT_LENGTH.
• --help shows the NovaCode name and version.
• The evaluation harness runs Terminal-Bench through Harbor on local Docker or Modal, in a hermetic home that never reads or writes ~/.nova, with --ak knobs for reasoning_effort, max_tokens, learning=off|on|frozen, and context_budget.

Fixed

• The loop guard's hard stop now ends the turn; previously a model could keep repeating a command through it. A repeat is flagged on the second identical result, near-identical calls with the same result count as one, and a hard stop left by an interrupted turn no longer ends the next one.
• A reply cut off by the output limit is no longer accepted as the end of a turn; the agent is nudged to continue, up to three times in a row.
• Sandbox file tools work on images without python3: read, list, and glob fall back to shell, and write/edit say what is missing. A populated directory is no longer reported as empty.
• Sandbox installers no longer hang on interactive prompts, and files written to /tmp, /dev, /proc, or /sys land where the shell sees them. Sandbox provider lifecycle and timeout handling are repaired.
• rm -rf below the top level is allowed again (for example rm -rf /tmp/build). Root, home, and top-level directories stay blocked in any argument position, quoted or not, including with the long --recursive / --force options.
• The dangerous-command pattern for halt / shutdown no longer matches those words inside other commands.
• A test run's failure summary is treated as a failure.
• /context rows no longer stay at 0 when one tool has no JSON schema, and the embedding cache no longer raises KeyError after it fills.
• The status bar updates CTX on every model call, and the cache hit rate can no longer exceed 100%.
• The TUI stays responsive on long, tool-heavy turns: large tool arguments are compared in milliseconds rather than seconds, saved tool results are checked on disk once rather than on every model call, and compaction's planning pass runs off the UI loop.
• Compaction recovers from a too-long summary request, keeps injected notes out of your quoted messages, and budgets a subagent against its own model.
• Improved async concurrency and runtime efficiency.

Limits

• The 128K default budget's effect on task success has not been measured. Set context_budget_tokens to 0 to return to the whole window.
• In the subagent page the tool block is always expanded. A remote (async) agent's page updates step by step rather than token by token.
• Recall by meaning needs the local embedding model; without it, matching falls back to word overlap.

Added

• Persistent public --mode pipe / --headless JSONL sessions for remote-app bridges, with readiness, request IDs, tool approvals, cancellation, queues, and clean shutdown. Includes process-local --model, startup/request/approval deadlines, a documented v1 protocol, and a Node adapter example.
• Telegram toggle in the /trello board header connects a dedicated Trello topic using the current remote bridge or saved protected credentials.
• Authorized users can send text tasks or /add <task> to create Loaded cards, and /status to see counts. Topic messages never become ordinary session prompts or steering.
• Topic links, asynchronous connection status, duplicate message protection, deleted-topic recovery, and paused intake when the toggle is off or the board stops.
• Headless deadlines (--timeout), optional partial text events, versioned JSON records with exit codes, bounded UTF-8 input, and structured startup errors.

Fixed

• Internal compaction uses the threshold shown by /context; category estimates rebuild after compaction and resume. Internal SESSION INTENT drafts are hidden behind an animated compaction status.
• Startup restore seeds a fresh checkpoint instead of merging saved history with old messages and summarization cutoffs. Restore budgets count tool arguments and retained reasoning, and restored metrics include both the briefing and injected instructions/memory.
• Trello execution and logs stay with the board's owning TUI tab. Queued execution waits until that tab is selected and idle.
• Telegram task intake preserves the session's approval mode, existing topic subscriptions, and dedicated handlers across bridge restarts. Connection and acknowledgment operations have deadlines.
• Notification hook payloads identify TUI-managed delivery and provide the current installation's Nova.png path. The example Windows hook defers to the native TUI notifier to avoid a second toast with the old avatar.
• Pipe output survives partial writes and interrupted writes, routes ordinary/native/child diagnostic output to stderr, and reports cancellation, timeouts, closed pipes, and incomplete event streams consistently.
• Headless approval requests reject unresolved verdicts rather than silently granting permission. --print no longer enables auto-approve or persists recursive workspace trust. Use explicit --auto-approve and, when needed, --trust-workspace (folder-only).
• Subagent prose no longer pollutes the final headless answer or turn count; exceeding the turn budget cannot be hidden by an interrupt or completion event.

Limits

• The board remains in memory; keep Nova and the board running. The dedicated topic accepts text tasks only.
• Telegram must already be configured through /remote; forum topics and bot Manage Topics permission are required.
• Existing user-installed PowerShell notification hooks need the updated examples/hooks/windows-notify.ps1 to honor the new payload fields.

Added

• Added approval-gated /session launch for opening an existing approved folder as a session tab with an initial task.
• The new tab receives a dedicated Telegram topic through the current session's remote bridge and routes topic messages to that tab.
• Added project pickers to the local TUI and Telegram so approved folders can be selected without typing paths.
• Renamed the local session management command to /tabs; /tab in Telegram opens the project picker, and /tab close offers a picker of running tabs.
• Session tabs animate while agents work and show live Telegram/Discord connection indicators.
• Added a keyboard-accessible jump-to-latest button in every transcript; tabs remember whether you are reading history.
• Telegram photos and image documents now reach the corresponding Nova session as image inputs, with optional captions and queued delivery while busy.
• Tabs inherit the source tool approval mode and send it per turn; remote connections never enable auto-approve. Dismissed tool approval dialogs reject the request.
• Telegram tab pickers are removed after launch approval, cancellation, closing, or expiry. Repeated confirmations cannot start another tab or reach the agent as prompts; new pickers supersede older requests in the same requester/topic scope.
• Tab switching returns immediately while history replays in small batches. Background token bursts no longer repaint the tab bar per token, and spinner frames avoid layout when their width stays the same.
• Stream buffers retain their parts across switches; delayed stream/tool repaint callbacks belong to their originating pane. Approved-folder disk checks run off the UI thread, and concurrent launches reserve capacity before starting processes.
• The footer names the selected tab and shows only its tasks. Child tabs have their own task snapshots and /tasks panel; terminate, restart, and logs controls route to that child's process. Main-tab completion logs, notes, and notifications remain in the main conversation.
• Task panel polling transfers metadata only; log requests fetch one bounded tail and match the originating tab and request ID.
• Escape and Ctrl+B in child tabs no longer kill or detach main-tab commands. Closing a worker stops its background commands, and exited tabs clear running task indicators.
• Windows termination stops the whole process tree before the shell exits, preventing orphaned child processes. Background launch failures report failure instead of success. Task tool descriptions explain session-local IDs and how to stop and verify tasks.

Limitations

• Telegram can request and approve a launch from its originating topic. Existing approved folders only are supported.

• On Telegram reconnect, validate saved session topics and recreate topics that Telegram confirms were deleted. Persist the replacement ID and bind incoming messages and outgoing responses to it.
• Reuse valid topics and reopen closed ones. Network failures, rate limits, and permission errors leave the saved mapping intact and report a connection warning instead of creating duplicate topics.

• /remote now includes Telegram user authorization controls: a user ID field, Authorize/Revoke buttons, and the saved authorized user list. The panel scrolls on shorter terminals to keep the controls accessible.
• /remote subcommands entered in the prompt now execute directly, including during an active task, instead of opening the remote panel and discarding arguments.
• Remote subcommands use the root session's bridge manager even when a child tab is visible.

• Telegram group messages rejected by sender authorization now display a throttled explanation in Nova, including the sender ID and the command to authorize that user.
• Added local /remote allow-user telegram <USER_ID> and /remote deny-user telegram <USER_ID> commands (also available for Discord). Permissions persist and update active bridges immediately in the current Nova process.
• Preserve registered session topic IDs when incoming Telegram messages omit is_topic_message, keeping prompts and replies routed to the correct session.

• Telegram /remote connects each Nova session to a named topic containing its session ID, including main sessions and sessions already running when the bridge starts.
• Separate Nova windows share an authenticated local Telegram polling connection, preventing competing getUpdates requests. Topic messages reach their registered Nova process; replies and local streamed output stay in that topic.
• Topic mappings and polling offsets persist, and another connected window takes over polling when the owner exits. A saved session cannot be connected in two windows simultaneously.
• Added private bot topic-mode support, retryable topic capability detection, and visible setup guidance and topic IDs in /remote.
• General-chat messages are delivered only when one Nova window is connected; with several windows, send messages in the session's topic.

• Replaced /help's transcript dump with a searchable, categorized Textual command guide covering built-in commands, aliases, plugin and panel commands, skills, and keyboard shortcuts.
• Added a responsive /evolution dashboard with lifetime totals, searchable activity, unlock/level-up filters, scrollable task details, refresh, and clear empty/error states.
• Evolution history loads asynchronously and its panel can open during an active agent turn.

• Fixed ANSI theme color parsing that made inline code and file paths appear as solid gray blocks in resumed sessions.
• Added a contrast check for inline code and CSS color/alpha support.
• Cached replies now refresh their colors when the theme changes while preserving rendering performance.
• Added five themes to /themes: nova-synthwave, nova-aurora, nova-ember, nova-abyss, and the light nova-paper palette.

• Add OpenCode Zen Jev and Jev Free presets in /model → Decisions and /router. Use the Zen API key for the exact official System One endpoint, including decision-based tool pruning and opt-in auto-approval.
• Keep TypeSafe, Zen, and custom endpoint credentials isolated. Carry NovaCode's user agent and stable session header on Zen decision requests. Manage the Zen credential directly from the Decisions tab.
• Print Nova's wordmark, current version, session label, and nova --continue <session-id> after the Textual application exits. Check saved root-session metadata before offering continuation; adapt the wordmark for narrow terminals and safely render session names. Zen Jev documentation: https://opencode.ai/docs/zen/#jev.

• Add OpenCode Zen alongside OpenCode Go in /auth, /model, router targets, role models, and first-run setup. Zen uses its own API key and endpoint; existing Go configuration remains compatible.
• Offer “Sign in to OpenCode Console” for both services. Open the official Console in a browser, then return to Nova's masked API-key field. This implements OpenCode's documented Console/key flow, rather than claiming unsupported third-party OAuth.
• Discover available models independently for Zen and Go. Select Chat Completions, Responses, or Anthropic Messages according to each model's documented API. Exclude native Google and System One models from the conversational picker.
• Identify gateway traffic as NovaCode, retain the stable session header, mask saved Zen credentials in settings, and strip them from shell subprocess environments.
• Avoid reporting a public model-list response as proof that an OpenCode key was authenticated. Official setup: https://opencode.ai/docs/zen/ and https://opencode.ai/docs/go/.

• Stream local TUI turns, including Ctrl+B background agent tasks, to connected Discord and Telegram chats. Show a separate live activity message for the session, plan, tool calls, and their results, alongside an editable answer.
• Stream replies to remote prompts, including routed child sessions, without sending the final answer twice. Start the TUI message consumer when a bridge is enabled after launch and avoid duplicate consumers.
• Coalesce token updates off the TUI rendering path. Retry the latest answer after failed edits, retain bounded buffers, and stop streaming pumps on completion or cancellation.
• Render Telegram Markdown as supported HTML and paginate without breaking tags. Keep Discord fenced code blocks balanced across message pages. Reconcile all pages after answer replacement or shrinkage instead of dropping overflow text.
• Refresh /remote connection status live and explain that connected chats receive local tasks. Suppress automatic Discord mentions in model output.
• Honor Telegram flood-control retry delays and treat unchanged edits as successful. Preserve final Markdown indentation and keep an unavailable debug log from preventing remote startup.

• Explain resolved file attachments in the model context and show referenced files in the live user transcript, so the target file and loaded context are visible.
• Show slash skill invocations as user messages with a pinned-skill label while continuing to load structured instruction snapshots through the skills middleware.
• Include Ctrl+B background agent turns and running remote async subagents in the Background Tasks dialog and persistent tasks indicator, alongside shell jobs. Track completion, failure, cancellation, and bounded agent logs; support cancellation and log viewing for local background agent turns.
• Let the Background Tasks list fill the available modal height, including on short terminals. Keep running tasks first and preserve selection and scrolling during live updates.

• Give foreground and async specialists selective skill libraries with their own activation state. General-purpose agents keep the full enabled library. Discover selected directories before parsing instructions to reduce specialist startup work.
• Configure custom agents with skill_names: [skill-name, another-skill], skill_names: [] for no skills, or skill_names: "*" for the full library.
• Resolve space-separated metadata.include_tools names to private tools, runtime aliases, or integration groups. Support async resolvers and recheck activation and run context before private tool execution. Compaction removes access when activation messages disappear.
• Map MCP server names and unambiguous original tool names to the existing inventory without reconnecting servers. Tools registered independently remain searchable; their implementation takes precedence over a private tool with the same name.
• Keep Nova's verified Deep Agents dependency range. Nova implements this behavior in its own middleware, including on the locked 0.7.10 release; it does not depend on the newer upstream skill-tools API.

• Pin enabled skills using $skill-name, /skill-name, or the new Pin to prompt control in /skills. Load each skill as a structured instruction snapshot, without preloading its supporting files. Earlier snapshots remain unchanged after edits.
• Add skills_load and skills_read_resource tools for explicit activation and bounded, on-demand reference reads. Relative resource paths resolve against the skill directory and reject traversal.
• Activate optional tool schemas declared in metadata.include_tools. Dedicated skill tools are gated until their skill is loaded; removing activation messages during compaction removes that access. Existing independently registered tools remain searchable.
• Add a Reload control and per-run pinned_skills / skills_metadata=None support. Keep the full skill library outside session checkpoints and run async discovery and pin reads off the UI event loop.
• Use consistent user → shared → Claude → plugin → project precedence across discovery, invocation, previews, and the agent. Preserve nested YAML metadata and multiline frontmatter during skill normalization.
• Keep /skills action buttons usable on narrow terminals and show compact pinned-skill labels when restoring sessions.

• After a successful nova update, clear interactive progress output and show a centered NOVA logo, the newly installed version, “Update successful.” and “Restart Nova”.
• Show the same completion screen from the Windows update helper after the launcher exits and installation finishes. Read the version from the updated environment instead of a previously imported version.
• Keep failed-update diagnostics visible, preserve the up-to-date message for no-op updates, and leave redirected output free of terminal control codes.

• Give Ctrl+B priority over text editing shortcuts. Detach running shell, bash and execute commands even when the editor contains a draft; preserve that draft.
• Keep the Background Tasks panel single-instance during repeated Ctrl+B presses. Ignore repeated handoff requests so preserved drafts are not submitted accidentally.
• Register ! commands with the background-task controller, retain their process and logs during handoff, and track completion/termination in the task panel.
• Remove detached commands from the foreground control list so Esc cannot kill work already moved to the background. Clean up shell process trees on cancellation.
• Display a Ctrl+B · run in background hint beneath running execution-tool output and hide it once the command finishes.
• Show the available release's version/title and a short changelog preview in the transcript. Add View more pages and official changelog links to automatic notices and /update.
• Fetch release metadata off the UI loop, deduplicate notices by revision, bound changelog content, and keep update notices usable when metadata is unavailable.
• Display animated retry progress (1/3, 2/3, 3/3) for failed provider requests before reporting a final error. Keep retries confined to model calls, stop on cancellation, and skip authentication, quota and context overflow failures.
• Add general-purpose-async for background coding, investigation, testing, research and analysis, with workspace file tools, shell/bash, web/docs tools, model retries and unattended approval enforcement.
• Prefer async delegation for general work as well as specialists. Return control to the user when delegated work is pending and continue on completion, keeping synchronous general-purpose as a fallback.

• Read the version shown by nova --version, startup ASCII art and the agent API from the shared release version constant instead of the stale hardcoded 1.0.6 value.
• Handle nova --version through the lightweight entry point without importing the agent runtime or starting onboarding.
• Include the current version beneath the compact startup portrait and use UTF-8-capable console output for --version on Windows.

• Show NovaCode · <session name> in the terminal window/tab title and update it when switching sessions or refreshing their names.
• Keep the main session tab and terminal title synchronized with the current session ID after /resume and /clear.
• Sanitize session names before writing terminal controls, skip terminal writes in headless mode, and avoid repeating unchanged titles.
• Add /settings → Performance → Live animation frame rate with persistent 15, 30 and 60 FPS choices, defaulting to 30 FPS. Apply changes immediately to status/tool spinners, shimmer and enabled Matrix Rain.
• Keep motion speed independent of refresh rate, limit background-state polling separately, and retain low-resource overrides and focus/visibility pauses.

• Batch shell output and yield between pipe reads so keyboard input, cancellation and repainting can run during noisy commands. Handle long lines and split UTF-8 without readline overflow.
• Reuse wrap calculations for unchanged output lines, evict discarded lines from the cache, and parse only the retained display tail of large command results.
• Remove per-line forced scrolling from live shell, tool and background-agent output. Coalesced log paints follow the latest output when the user is already at the bottom.
• Bound shell/execute result capture while the command runs, instead of retaining all output until completion; keep live output streaming and the existing truncated-result notice.
• Cover cancellation while waiting for a shell process to exit after its output closes.

• Add Google browser sign-in under /auth for Gemini Developer API, using a user-owned Desktop OAuth client and Cloud quota project. Includes PKCE, state validation, cancellation, refresh, saved-account selection and disconnection; API keys remain available.
• Add guided Anthropic Console setup alongside API-key entry. Claude subscription OAuth is not offered because Anthropic explicitly excludes third-party applications.
• Display the selected Google authentication method in provider readiness and credential screens.

• Render imported Codex and Claude sessions as structured conversation cards with Markdown and collapsible historical tool records in the transcript and View preview.
• Preserve the imported history display when resuming a saved Nova session; hide the internal continuation reference message.
• Page long histories, bound displayed excerpts, and release removed history data to keep the TUI responsive. Complete normalized history remains saved.
• Format Claude tool arguments as JSON and retain tool error indicators.

Fixed

• Command output renders only visible rows, with bounded row caches, instead of rendering entire logs on each paint. Hidden output remains available and reflows when revealed or resized.
• Removed output and chat widgets immediately release their text, markdown visuals, and render caches.
• Late background output and stream callbacks cannot revive removed cards or restart their paint timers.
• Transcript scrollback is bounded by content size as well as widget count, while preserving active replies and tool/subagent cards. Persisted session and agent context remain intact.
• Streaming previews read only recent fragments instead of repeatedly copying the full growing answer and reasoning buffers.
• Long turns retain speech-summary text only when voice responses are enabled, with a bounded summary buffer.

Added

• /auth can connect OpenAI with a ChatGPT account using OpenAI's Sign in with ChatGPT flow, while preserving API-key setup. The ChatGPT-plan path uses the Responses API with streaming and response storage disabled; OAuth tokens are stored separately in the OS credential store and refreshed as needed.
• OpenAI ChatGPT sign-in status is shown in /auth and can be removed independently of an API key.

Notes

• ChatGPT-plan access is subject to OpenAI account eligibility and the current preview limits. Some hosted Responses tools are unavailable in this mode; OpenAI API-key access remains the full existing path.

New Features

• Bug investigation async specialist: Traces reported defects through code and tests, then returns evidence-backed root-cause hypotheses and focused verification steps.
• Performance audit async specialist: Reviews latency, memory, CPU, task cleanup, and multi-session resource behavior, returning ranked findings and measurement suggestions.

Improvements

• Async subagent preference: Nova now prefers available async specialists for independent background work, while retaining synchronous task delegation when results are needed immediately, no suitable async agent is available, or background dispatch fails.

Security Improvements

• More conservative decision approvals: Approval decisions now include the active user request, use a stricter risk rubric and confidence threshold, and deterministically reject high-impact deletion, overwrite, Git-history, database, and system commands. Unclear or low-confidence answers still fail closed.

Improvements

• Approval decision indicators: Auto-approve sessions now display a green approval or red rejection message with the decision model and tool name. Fail-closed outcomes identify when the model was unavailable or uncertain.

New Features

• Decision-model auto-approval: An opt-in /settings switch lets the configured Decisions model approve or reject actions that require review during auto-approve sessions. Policy denials remain blocked, and unavailable or uncertain verdicts fail closed. Configure Tev1, Jev, Luna, or another supported decision model in /model → Decisions.

New Features

• Prompt cache visibility: The TUI status bar and /context now show the provider-reported cache hit rate and cumulative input tokens read from and written to the prompt cache. The compact status bar adapts the indicator to narrower terminals.

Improvements

• Cache read, cache creation, and input-token counts are accumulated across model calls in a turn, so the hit rate reflects the whole session run rather than just the last response.
• Cache metrics remain hidden for providers that do not report prompt-cache usage; Nova does not estimate hits.

Per-Turn Model Routing (`/router`)

• A route per kind of work: Nova can hold several routes, each a provider:model pair, and pick one per turn instead of running every turn on a single model
• Criteria are the classifier's prompt: A route carries a plain-English description of the work it should win, which is what the decision model reads. A route without criteria is refused rather than silently never selected, because a route the classifier cannot match is worse than one that is missing
• /router screen: A native modal to add, edit, remove and reorder routes. It edits a working copy and returns a payload, so Cancel has no side effects and nothing reaches the config until Save
• Decision model is configurable: Presets for Jev (TypeSafe System One API), Tev1 (local Ollama, the default and free), or a custom endpoint and model name
• Off until switched on: Routing defaults to disabled, so an existing Nova.config.json behaves exactly as before and a session that never opens /router is unaffected
• Falls back rather than fails: If the classifier is unreachable, returns something unreadable, or names a route that cannot be built, the turn runs on the default route - a router that could break a turn would be worse than no router
• Routes live in Nova.config.json: router_enabled, router_routes, router_default_route, router_decision_endpoint, router_decision_model and router_min_confidence, written through a validating setter so a typo caught in the screen never reaches model construction mid-turn

Settings Screen (`/settings`)

• Native preferences modal: Opens from /settings, applies immediately, and persists to Nova.config.json
• Matrix Rain switch: Turns the home-banner animation on or off without editing the environment or restarting

Idle Resource Efficiency

• Every numerical backend is capped, not just OpenBLAS: OPENBLAS_NUM_THREADS was already pinned to 1, but OpenMP, MKL and NumExpr still defaulted to a machine-wide thread pool, so each Nova process - the TUI and every spawned session - could occupy every core while idle. All four are now pinned with setdefault, so an explicit user value still wins
• Voice models load on demand: A text session no longer constructs or preloads the native voice models. Previously any of enabled, speak_responses or push-to-talk triggered the full model load at boot, so a user who had never spoken to Nova paid a large load for a feature they had not touched. Only explicitly enabled voice builds a pipeline now, and the models load on first use
• Speech does not allocate the microphone stack: VoicePipeline.warmup takes input_audio=False to build the TTS side alone, and _ensure_components splits into _ensure_input_components and _ensure_tts so each direction loads only what it needs. Explicit /voice download still warms the full stack
• The home banner no longer repaints forever: MatrixRain animated roughly 15 times a second on an idle terminal. It is now off by default, keeps its first themed frame, and stays available as an opt-in through NOVA_ANIMATIONS=1 or the new Settings switch. Resizing and theme changes still repaint a static banner
• Live tool output is bounded by construction: The pending-output map held an unbounded list[str] per call, so a chatty command grew it until the painter happened to drain it. OutputTail caps each call by bytes and by lines, and MAX_PENDING_CALLS caps how many calls may be buffered at once. Dropping a call trims only the live display - final tool results still arrive through the normal event/session path

Startup and the agent server

• Deep Agents metadata scan is no longer paid twice: The startup scan is patched so the version metadata is read once instead of on every check
• The agent-server extra is optional and reported honestly: /agent-server says whether the extra is installed and prints the uv sync --extra agents-server hint when it is missing

Textual UI

• Branded workspace approval screen: Path approval opens a native screen showing what is being approved instead of a bare prompt
• Theme-aware tool rendering and session usage display
• Subagent panel reset on clear: Interrupted subagent timers stop and the panel resets rather than showing stale rows
• Every subagent is created from one screen, as in-process or background

Bug Fixes

• Banner animation could never start: MatrixRain.on_mount enabled the rain through set_animation_enabled, which returns early when the widget is not mounted - and is_mounted is still False inside on_mount. Setting NOVA_ANIMATIONS=1 therefore produced a static banner. The timer start moved into _start_timer, which on_mount calls directly and set_animation_enabled delegates to.
• A failed MCP discovery is no longer cached: A transient outage used to look like "no such tool" for the rest of the session, and an outage is now told apart from a genuine absence
• MCP tools work from the agent server and from background agents: Previously they were declared but not callable on those paths
• An async agent whose graph cannot build is never registered, so a broken server config surfaces as an error instead of a dead dispatch
• Windows updates report progress: The launcher is released before the external updater runs, a locked launcher during uv tool updates is handled, and progress plus the final result are streamed live. An already-current install says so instead of looking stalled

Technical Changes

• OutputTail extracted to novacode_cli/tui/output_buffer.py: Self-contained (no TUI imports) so the bounded buffer can be tested and reused independently of the app that consumes it
• Per-role model plumbing: config/role_models.py is the single place that answers what each role runs on, with one config key per role so two Nova processes cannot clobber each other's settings
• Session interoperability: Claude and Codex histories can be imported through session adapters, and multimodal content blocks from read_file are preserved through to the model
• Test coverage: tests/test_resource_efficiency.py pins the thread-pool caps, lazy voice loading, the opt-in banner, and the buffer ceilings; tests/test_model_router.py covers route selection, fallback, and config round-trips; tests/test_workspace_approval.py, tests/test_startup_version_scan.py and the UI harness tests cover the newer surfaces
• Measurement scripts: scripts/benchmark_idle.py measures an idle process, scripts/verify_resource_efficiency.py checks the claims against a running build, and scripts/mutate_resource_efficiency.py re-injects each defect to prove the tests are not vacuous