Changelog

Unreleased

• Added a frontend generation strategy layer so website/UI prompts now carry a structured design brief: site type, archetype, audience, tone, content mode, asset policy, and anti-slop guardrails.
• Added a dedicated frontend design critique pass for mutated website/UI turns, separate from Sentinel code review, so Waterbrother can flag generic template output, fake credibility elements, placeholder-image dependence, and weak visual direction.
• Added tag-driven npm publishing via .github/workflows/publish.yml.
• Updated install docs for the live package: npm install -g @tritard/waterbrother.
• Documented the partner release flow using the repository NPM_TOKEN secret and GitHub Actions.

npm distribution prep

• Tightened package.json metadata for npm publishing, added a project LICENSE, and limited shipped files to the CLI runtime payload.
• Updated waterbrother update and /update so source clones use git pull plus checks while npm-installed users upgrade through a global npm install.
• Reframed README and install/update docs around npm-first onboarding for end users while keeping the source-install path for contributors.

Website redesign

• Reworked the public docs site into a near-black, x.ai-inspired visual system with luminous hero lighting, darker glass surfaces, stronger code blocks, and higher-contrast navigation and card styling.
• Reframed the landing page so the homepage reads like a product surface instead of a generic docs splash: sharper hero copy, stronger onboarding/MCP/production cards, and a cleaner quick-start story.

File-listing + cleanup UX refinements

• Leaving auditor mode now unpins the reviewer profile and restores the mode-default profile (for example guide returns to coder unless you explicitly choose another profile).
• Added a deterministic local git-history path for prompts like any ui changes today?, so Waterbrother can answer from recent commits without model-mediated shell probing.
• Default terminal output is quieter: normal trace mode no longer prints turn summaries, no-tool trace timelines, or generic thinking... / running exact shell command... banners.
• Manual interrupts now use neutral copy (Enter a new prompt or command when ready.) instead of implying the model did something wrong.
• Read-only file tools can now inspect ~/Desktop, ~/Downloads, and ~/Documents directly.
• Added macOS-friendly aliases for those locations: /desktop, /downloads, and /documents.
• Tightened agent guidance for simple file-list requests so responses stay literal instead of drifting into editorial summaries.
• Tightened agent guidance for cleanup and organization requests so Waterbrother asks one focused question at a time before proposing moves.
• Default trace mode is now quieter during long turns; repeated run-state heartbeat lines are shown only in verbose trace mode.
• Approval prompts now support keyboard-first choices: Enter/y approve once, p saves a session approval rule for the current shell-command prefix or tool, and Esc denies with optional guidance.
• Added /approvals plus session-approval summaries in /status so saved shell-prefix and tool rules are inspectable.
• Styled approval prompts as bordered blocks with the default action highlighted.
• Added arrow-key row selection inside approval prompts.
• Added a compact footer rules indicator when session approval rules are active.
• Stopped read-only turns from inheriting unrelated git diff files into receipts.
• Collapsed normal-mode traces for one-tool success cases to a single tool:ok line.
• Added receiptMode / --receipts auto|off|verbose and interactive /receipt-mode.
• Default receipt mode now suppresses noisy receipt lines for minimal read-only turns.
• Added /run <prompt> as an explicit slash alias for ordinary chat turns.
• Cleared the spinner row before long-running still working notices so trace output no longer collides with the animated bar.
• Mutating-turn receipts now diff against the turn checkpoint snapshot, which prevents unrelated pre-existing repo changes from leaking into files, diff, and review summaries.
• Single-tool node --check success turns now render as a terse one-line result (path: syntax ok) instead of a markdown-heavy assistant paragraph.
• The terse node --check renderer now also applies when the model does harmless read-only prep work before the shell check.
• Tightened inline markdown stripping so plain terminal answers are less likely to leak emphasis, link, or strike-through markers.
• Multiline pasted input now stays in the interactive buffer until explicit Enter, shows a placeholder like [Pasted Content N chars] in the prompt row, and no longer auto-submits on pasted newlines.
• Removed the terminal renderer's special handling for short **bold-only** lines so replies like **Yes.** no longer preserve markdown emphasis in chat output.
• Hardened raw-terminal multiline paste capture so pasted newline bursts stay buffered as input content and only explicit Enter submits the turn.
• Paste capture now consumes raw terminal data before keypress translation and briefly suppresses submit events after a pasted block, reducing accidental auto-send in Apple Terminal.
• Interactive assistant output no longer streams raw markdown fragments; terminal replies are buffered and rendered through the plain-text formatter so emphasis markers are not leaked during streaming.
• Explicit absolute or ~/ paths in read-only inspection prompts are now exposed to built-in file/search tools for that turn, reducing unnecessary shell fallback on repo architecture requests.
• Refreshed terminal polish with semantic trace pills, stronger footer and border contrast, a styled pasted-content chip, and updated approval-block accents.
• Reworked the docs site visual system in assets/styles.css with motion tokens, stronger heroes, a glass topbar, richer cards, and cleaner install/onboarding presentation.
• Selectively forward-ported safe UX additions from PR #4 without taking the risky approval or mention changes: /cost, /fork, /diff, and headless pipe mode via -p / --output-format text|json|stream-json.
• Hardened two production-readiness blockers: session saves now use atomic temp-file writes plus rename, and cwd sandbox checks now canonicalize real paths to block symlink escape by default.
• One-shot exec / review interrupts now abort cleanly on Ctrl+C, terminate the child shell process tree, and persist the session in error/interrupted state instead of leaving stale planning metadata behind.
• Submitted user turns are now persisted before model/tool execution begins, so forced-kill recovery can resume from the actual last prompt instead of an empty planning shell.
• Blocked tool results now short-circuit into a direct assistant reply instead of re-entering the tool loop after a denied approval.
• Approval prompt cleanup now pauses stdin correctly, which fixes the one-shot hang after denied approvals.
• Terminal assistant output and live trace labels now sanitize ANSI escape sequences, carriage-return overwrite, and other control characters before rendering.
• Concurrent one-shot sessions were locally validated to keep distinct session ids, prompts, tool outputs, and assistant replies without cross-session bleed.
• Session saves now write lightweight metadata sidecars, so /sessions and resume selection no longer need to parse full multi-megabyte transcripts in steady state.
• Synthetic long-session validation now shows steady-state listSessions(5) around 5 ms even with ~2.9 MB session files present.
• Added npm run soak:long-session to seed a large synthetic session, benchmark save/load/list behavior, and optionally run a real resume probe on top of that session.
• The long-session soak harness now supports bounded live resume probes via --resume-timeout-ms, so stalled resume tests fail cleanly instead of hanging indefinitely.
• Fixed non-TTY one-shot stdin handling so supervised resume runs no longer stall before loading the session.
• Large resumed sessions now pre-compact aggressively, and oversized compaction requests fall back to a deterministic local summary instead of timing out inside the compactor.
• Local scripted soak now passes on a 360-message / 2.76 MB session: resume pre-compacts to the last 24 messages and completes in about 9 seconds.
• Esc now interrupts active turns in both interactive and one-shot TTY mode by temporarily capturing raw terminal escape input during model and tool execution.
• Destructive shell commands can no longer bypass policy through saved session shell-prefix approvals; deny-patterns now override session rules, ask-patterns still force confirmation, and persistent shell approvals are limited to non-mutating prefixes.
• Esc pressed inside an approval prompt now denies that prompt instead of being intercepted by the global interrupt listener.
• Added explicit agent guidance that “run the exact shell command …” requests must execute only that command and must not silently fall back to diagnostic alternatives.
• Added a deterministic exact-shell execution path for prompts beginning with Run the exact shell command ...; those prompts now bypass the model, execute exactly one run_shell call, and enforce policy before shell execution.
• Fixed runtime config merging so user or project overrides no longer erase default approvalPolicy deny rules like rm -rf, git reset --hard, or curl ... | sh.
• Local hostile-output checks now cover three layers: renderer sanitization, direct spoof-prompt refusal, and contract-gated shell output before rendering.
• Added /prod-readiness to track the active release-blocker matrix and the first validated runtime fixes.

Config layering update

• Split config into user defaults in ~/.waterbrother/config.json and project overrides in .waterbrother/config.json.
• Runtime config now merges user and project settings automatically from the active working directory.
• Expanded config commands with scope-aware forms: config set ... --scope user|project, config set-json ... --scope user|project, config get ... --scope user|project|merged, and config list ... --scope user|project|merged.
• Onboarding continues to save user-level defaults, while project-local model and workflow overrides can live in the repo.
• Deep-merged mcpServers across user and project config layers.

MCP stdio support

• Added config-driven MCP stdio server support via mcpServers.
• Waterbrother now discovers MCP tools at runtime and exposes them to the model alongside built-in tools.
• Added waterbrother mcp list for server + tool inspection.
• Added interactive /mcp.
• Added MCP visibility in /status, /session, and waterbrother doctor.

Context continuity + memory release

• Added built-in web research tools for pasted URLs and open-web search prompts.
• Added read_url for direct webpage reads and web_search for open-web search.
• Added interactive pasted-URL handling: paste a URL by itself or a URL plus question on one line.
• Added explicit slash commands: /read <url>, /search <query>, and /open <url|index>.
• Added interactive /update to reuse the existing self-update flow without leaving chat.
• Added selectable search results after /search with arrow keys and Enter.
• Added live visible trace lines during turns so users can see structured progress before the final summary.
• Fixed live trace rendering so trace lines no longer collide with the animated spinner.
• Fixed read-only tools such as list_files and read_file being mislabeled as unknown in traces.
• Increased the per-turn tool-call ceiling to reduce premature iteration-limit failures on larger edit tasks.
• Improved edit guidance for large rewrites so the agent prefers write_file earlier instead of getting stuck in repeated replace_in_file loops.
• Tightened post-edit response style so edit summaries lead with changed files and concrete changes instead of hype.
• Updated agent guidance to prefer dedicated web tools over ad hoc shell commands.
• Updated docs and examples for web research workflows.
• Added manual compaction with /compact and /compact <keep-last>.
• Added auto-compaction controls via autoCompactThreshold and --auto-compact-threshold.
• Added project source-of-truth memory file support with WATERBROTHER.md.
• Added memory commands: /memory, /memory show, /memory add, /memory reload, /memory init.
• Added trace controls: /trace and /trace on|off|verbose.
• Updated thinking animation to a flowing left-right glow style.
• Added dedicated GitHub repo reading for pasted GitHub repository URLs, including private repos when gh is authenticated.
• Grouped retry noise in compact trace output so recoverable tool retries read as one operation.

Command parity expansion

• Added waterbrother exec <prompt> for non-interactive command-style runs.
• Added waterbrother review <prompt> with reviewer profile default.
• Added waterbrother resume [session-id] [prompt] and waterbrother resume --last.

Approval UX + terminal rendering update

• Replaced yes/no approval prompts with codex-style 1/2/3 choices.
• 1 approve once, 2 approve all remaining tool calls in session, 3 deny and provide alternate guidance.
• Added turn spinner/progress animation while model and tools execute.
• Added compact turn summaries (duration, tool results, token usage when available).
• Improved assistant output rendering for markdown code fences in terminal sessions.

Onboarding wizard + agent/vision update

• Added first-run onboarding wizard in terminal (API key, model, profile).
• Wizard can offer opening https://console.x.ai/ for key creation.
• Added agent profiles: coder, designer, reviewer, planner.
• Added top-level and slash vision commands for local image prompts.
• Session records now persist selected agent profile.
• Interactive UI now shows model/profile/approval/tools header at startup.

Onboarding + parity baseline release

• Added web onboarding guide and API key setup docs.
• Added model catalog command and expanded slash command surface.
• Added command docs, changelog, and FAQ pages.

Initial CLI scaffold

• Grok chat integration, tool runtime, sessions, and approval controls.