Centralizes built-in provider model discovery in src/providers/models.json with a catalog loader, local override support, and build packaging for dist/providers/models.json.

Updates provider fallbacks, ACP/RPC model discovery, onboarding defaults, docs, and coverage for catalog overrides.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Move remaining local-provider fallbacks and setup defaults through the JSON model catalog, add Ollama bundled entries, and keep MLX runtime defaults explicit.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Document eight self-contained TDD slices for authorization, typed outcomes, command exits, cancellation, sync trust, skill containment, search containment, and built TUI release gating. Record the SDK, EventHooks, ACP, JSON-RPC, i18n, and environment compatibility contract plus the remaining completion queue.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Add a maintainer issue form, trusted-author GitHub Actions workflow, validated catalog updater, synchronization tests, and workflow documentation so provider model IDs can be proposed as reviewable models.json pull requests.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Run issue shape and maintainer trust checks in an unprivileged job, then permit the catalog pull-request job only through an explicit accepted output. This makes qualification observable and keeps write credentials isolated from ignored issues.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Rename the qualification job identifier so GitHub Actions resolves its accepted output through valid property syntax before granting the catalog job write access.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Resolve the issue author's current repository permission through the GitHub API and admit only write, maintain, or admin access. This avoids stale webhook association labels while keeping read-only contributors outside the write-enabled automation path.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Insert the requested model into the selected provider array without reserializing unrelated catalog content. Validate the resulting JSON and cover byte-for-byte formatting preservation so automated pull requests stay reviewable.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Replace GitHub's reserved dropdown option with a valid user-facing label and normalize that label back to the catalog's none reasoning metadata. Add regression coverage for both form discovery constraints and updater behavior.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Keep optional cloud restore discovery out of mandatory startup authentication so an unavailable sync endpoint cannot block first paint. Add unit and Tuistory coverage that completes device auth, stalls sync, and verifies the composer accepts input.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Publish a tested binary formula that installs the canonical autohand command while preserving the autohand-code alias. Generate future formulas from verified local release archives, fail stable releases when tap publication is unavailable, and document the Homebrew 6 compatible direct install path.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Publish autohand-code only as a compatibility alias for package, Unix, Windows, and local development installs. Add regression coverage for every supported install path.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Register the Sol, Terra, and Luna model IDs in the bundled OpenAI catalog while preserving the existing provider defaults. Extend catalog coverage so all three variants remain discoverable alongside the current GPT-5.4 baseline.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Resolve every native and fallback search candidate through its real path before reading it, reject symlink escapes, terminate cycles, and preserve safe logical display paths across workspace and additional roots. Apply ignore, hidden-path, built-output, binary, and size limits after admission, and pass leading-dash patterns after ripgrep option termination.

Cover native argument handling, contained and escaping file and directory symlinks, additional roots, cycles, broken links, ignored aliases, and oversized targets across semantic and fallback search.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Centralize validation for community registry metadata, skill identifiers, relative file paths, GitHub source URLs, and filesystem destinations. Reject traversal, encoded or platform-ambiguous paths, reserved names, duplicate files, malformed registries, and symlink escapes before cache, fetch, or install operations can mutate disk.

Use immutable registry IDs for installation, caching, activation hints, and installed checks while retaining display names for user-facing output. Harden cache eviction and recursive reads against symlinks, and add regression coverage across CLI fallback, registry fetching, cache handling, and project or user installation flows.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Introduce reusable atomic JSON writes and ownership-aware file locks, validate and recover session indexes, serialize import and session updates, and prevent torn state or duplicate imports under concurrent writers.

Drain heartbeat and snapshot writes before teardown, make memory extraction cancellable, persist and validate telemetry queues atomically, and bound idempotent shutdown flushing across telemetry and ping services.

Expand regression coverage for lock contention, stale ownership, corrupt recovery, concurrent writers, late asynchronous completions, cancellation, timeout handling, and repeated teardown.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Treat remote manifests, transfer URLs, credentials, and relative paths as untrusted input. Enforce schema, size, origin, protocol, containment, and symlink checks before any filesystem mutation or authorization forwarding.

Plan downloads before applying them, use locked atomic state and session-index updates, preserve rollback behavior, and propagate cancellation through retries, response streaming, upload, download, finalization, timers, and shutdown.

Add adversarial coverage for traversal and link escapes, malicious or oversized responses, cross-origin credential leakage, partial failures, concurrent sync, cancellation races, and crash-safe state recovery.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Introduce one fail-closed authorization preflight and a typed tool outcome contract across built-in actions, hooks, delegated agents, MCP, RPC, and ACP. Permission denial, validation errors, operational failures, and successful output now retain their meaning before telemetry or protocol adaptation.

Carry cancellation through the ReAct loop, command and web actions, repository and worktree operations, shell children, subagents, teams, MCP requests, quality hooks, and automatic project operations. Abort paths terminate owned resources and suppress late output, patches, commits, notifications, and other post-cancellation effects.

Make command mode return truthful process status, initialize MCP tools before the first model turn, gate RPC diagnostics, and centralize bounded idempotent shutdown for agents, bridges, listeners, background managers, in-flight RPC work, stdin, and child processes.

Add broad unit and integration coverage for authorization ordering, typed outcomes, tool IDs, cancellation races, command failures, first-turn MCP discovery, resource ownership, protocol behavior, and repeated or in-flight shutdown.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Route bracketed paste through Ink's protocol-aware paste channel so large or split payloads render compactly and submit exactly once, and keep registered multiword slash commands discoverable through exact input.

Make the standard proof run both the unit gate and the built Tuistory suite, require terminal scenarios in CI and release jobs, and execute compiled Windows --version and --help smoke tests before publishing artifacts.

Refresh compatible runtime and development dependencies while preserving the Ink 7 and React 19 floors, pin the audited esbuild override, and ignore local autoresearch output.

Expand render and built-CLI coverage for paste handling, autocomplete, truthful command exits, patch suppression, non-interactive research approval, provider selection, workflow wiring, and binary smoke guards.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Mark plans 001 through 008 and the audited follow-up queue complete, update each baseline and done criterion to match the implemented authorization, outcome, cancellation, sync, containment, and built-terminal behavior.

Correct repository test examples to invoke the Vitest script through bun run, record the final CLI, packaging, audit, workflow, and SDK verification evidence, and keep the plan index aligned with the resulting history.

Document the intentionally retained boundaries around remote cancellation timing, same-user pathname replacement races, already-dispatched atomic renames, detached processes, and local Windows execution.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Classify delete_path as a write capability so sensitive-file policy is evaluated before interactive, --yes, YOLO, or unrestricted approval can reach an executor or filesystem side effect.

Forward the automode manager's abort signal through command mode and preserve a false command outcome as an unsuccessful iteration with an explicit aborted or incomplete reason instead of assuming success.

Add focused regression coverage for sensitive deletion across approval modes, capability context mapping, abort propagation, and truthful standalone automode results.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Execute the freshly compiled Windows CLI in the cross-platform CI matrix and require both --version and --help to complete successfully under a bounded PowerShell step.

Keep the Unix binary verification path intact and extend workflow guardrail tests to assert platform conditions, binary resolution, timeout, shell selection, and both CI and release smoke commands.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Record the post-blocker unit and built Tuistory counts after revalidating package, audit, workflow, and SDK gates.

Keep the unrelated autoresearch output ignore outside the reliability delivery so the concurrent working change can be restored separately.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Exclude generated autoresearch-results output from source control so local research transcripts and machine-specific proof artifacts do not reappear as repository changes.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Add the top-level plans directory to the repository ignore rules alongside the existing prd directory entry. Existing tracked plan records remain versioned until explicitly removed from the index.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Replace filesystem PID polling, Vitest's one-second wait loop, and the competing command timeout with a stdout readiness promise. The child now stays alive until the test aborts it, so the assertion still proves captured output is preserved without racing process startup under full-suite load.

Validated with 25 repeated focused runs, all 38 command tests, the 6,788-test repository suite, lint, typecheck, production ESM/CJS/declaration builds, and all 23 built-CLI Tuistory scenarios.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Mock the atomic session lock and index boundary in every importer suite that already mocks fs-extra, preventing clean CI homes from failing when the sessions parent does not exist.

This also stops parsing-focused unit tests from creating locks or replacing index data in a developer's real ~/.autohand directory. Dedicated BaseImporter and atomic-file suites continue covering persistence semantics.

Validated against an empty HOME, the exact release test command, lint, typecheck, production ESM/CJS/declaration builds, and all 23 built-CLI Tuistory scenarios.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Run piped POSIX shell commands in their own process group and signal the full group during graceful and forced termination so descendants cannot retain output pipes after cancellation.

Extend the shell cancellation regression to cover a stubborn descendant and measure shutdown from the abort boundary.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Normalize saved Autohand website deployment origins to the canonical control-plane API while preserving explicit development overrides. This restores announcements and other authenticated API features for affected installations.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Preserve the stable type_v7 ancestry for the current Bedrock and fff dependency integrations on top of the goal-continuation merge. The exact combined tree passes the complete repository proof gate.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Record the current origin/main dependency integration on top of the local goal-continuation and TypeScript 7 merges without changing their validated file content.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Integrate the validated type_v7 cutoff at a8cdd4e while preserving the primary worktree's later uncommitted Tuistory change. The exact combined main candidate passes the complete repository proof gate.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Integrate automatic continuation for active persistent goals with its unit, built-terminal, and documentation coverage.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Record the original validated control-plane configuration branch after its byte-identical change was replayed on type_v7.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Unify the validated TypeScript 7 dependency migration, persistent-goal continuation, and control-plane configuration repair while preserving each source branch's ancestry.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Add a built-terminal regression scenario proving that the Enter key used to submit /whatsnew does not immediately dismiss the announcement modal and that Escape restores the composer.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Preserve matched native tool history across provider turns, share reflection and duplicate-call safeguards between the main runtime and subagents, and retain compatibility for structured JSON fallbacks.

Cover direct, delegated, parallel, teammate, and built-CLI YOLO flows, and document the provider contract.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Attach active goals and usage accounting to the session that created or explicitly resumed them. Redact detached goal objectives from model tools in fresh sessions while preserving direct inspection and same-session continuation.

Cover MOA terminal startup, goal ownership, explicit resume, continuation, and teammate session propagation.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Resolve explicit specialist rosters before the lead loop, harden catalog installs with provenance, preserve interview and team lifecycle context, and add built CLI acceptance coverage.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Retry only explicit request-per-minute throttles using the bounded server delay and cancellable waits. Treat 5-hour, weekly, and unknown quotas as terminal, and show localized reset guidance with real terminal coverage and provider documentation.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Accept and display the canonical console.autohand.ai upgrade link in Autohand AI quota and tier errors, with provider and built-terminal coverage.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Resolve explicit specialist requests without prior opt-in while preserving a config-backed opt-out, manual team and catalog workflows, and startup fail-soft behavior.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Keep passive status and completion repainting from reasserting hardware cursor focus while users inspect terminal history. Restore cursor intent only after the user edits the composer, with component and real-terminal regression coverage.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Accept the rollout-compatible entitlement contract, display 5-hour, 24-hour, weekly, and RPM values in usage and status, and treat long-window quota exhaustion as terminal with exact reset guidance.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Route teammate workers before interactive authentication, assign pending work as soon as workers become ready, and propagate the lead configuration and task identity into child runtimes.

Push live team progress into Ink, ACP, hooks, tasks, and subagent activity while adding keyboard and slash-command views plus real terminal coverage.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Parse backward-compatible token ceilings, show request and token throughput in usage/status, and keep token-throughput exhaustion terminal while retrying only explicit RPM throttles.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Introduce opt-in SGR mouse tracking with terminal-coordinate reconciliation, preserve wrapped Unicode cursor mapping, and cover configuration, Ink interaction, and built CLI PTY behavior.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Treat omitted configuration as enabled across generated, legacy, and runtime paths while preserving an explicit opt-out and documenting both config commands.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

The production device-auth endpoint rejects schema v2 while explicitly advertising schema v1. Retry once on that exact response, retain v2 as the preferred contract, and keep unexpected downgrades or legacy endpoints rejected.

Cover the request negotiation and complete startup login path with contract and real Tuistory/PTTY regressions.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Refresh Ink cursor intent only after idle user edits while preserving passive working and completion behavior. Freeze the quota reset clock so the paid-plan assertion is deterministic under CI load.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Resolve support ticket 723CE715 by falling back to native Windows architecture variables when RuntimeInformation is unavailable. Report every detected signal for unsupported hosts and exercise the resolver under Windows PowerShell in CI.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

The 5-hour quota assertion in tests/providers/LLMGatewayClient.spec.ts
failed on CI while passing locally. vitest.config.ts selects the threads
pool on CI, and a Node worker thread ignores runtime changes to
process.env.TZ, so the formatter resolved the zone the worker inherited at
creation rather than the zone under test.

formatAutohandQuotaReset now resolves the display zone from TZ explicitly
and falls back to the ICU default when the value is not a usable zone, so
the rendered reset time and the zone label always agree. This is a no-op
on the main thread, where Node already resolves TZ the same way.

The spec pins the full composed message using the configured zone's
wall-clock time, which a UTC fallback would miss by twelve hours, and adds
coverage for an unusable TZ -- V8 reports an undefined zone there, so the
existing fallback is what keeps "(undefined)" out of the user-facing error.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

Someone working in the CLI had no way to see what they were paying for.
The plan now appears on the status line and again right after signing in,
so the first thing after authenticating answers "what am I on?".

The status line refreshes on a slow timer, so a plan bought in the console
reaches an open session without a restart. A failed refresh keeps the last
known plan rather than blanking the line, and the timer is unref'd and
stopped with the UI.

The plan is merged into the status slot rather than replacing it, so it
sits beside the session's own segments. The memo comparator had to learn
about it as well: it previously skipped re-renders whenever the session
was idle, which is exactly when an upgrade would arrive.

Free never shows a billing cycle, because a free account has no
subscription to renew, and an unrecognised cycle shows none rather than
guessing at one.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

…uests

Two auto-reported session failures traced to the same place: Autohand sends
Claude requests that Anthropic rejects. The first named a model OpenRouter does
not serve; the second named a valid one and still failed, because OpenRouter
forwarded a payload Anthropic refused. Anthropic validates strictly and rejects
unsupported parameters rather than ignoring them, so anything we send loosely
comes back as an opaque 400.

Adds `anthropic` as a first-class provider on the official TypeScript SDK, with
the Messages API contract handled at the provider boundary: system prompts,
images, tool calls and results, structured output, adaptive thinking, and
Anthropic usage fields. The bundled catalog gains the current Claude lineup for
both the native provider and OpenRouter, and drops two OpenRouter IDs that never
existed. Setup, /model, /settings, ACP, and the answer-only RPC surface all know
about the provider.

Every optional request parameter is now gated on the target model. Temperature
is dropped for the Claude 5 family and Opus 4.7/4.8, output effort is clamped or
omitted where unsupported, and the thinking parameter is omitted entirely for
models that always think. Sending temperature unconditionally had been breaking
the default OpenRouter model on every request.

Thinking blocks are captured from each response and replayed unchanged on the
next one. Thinking level defaults to normal, which omits the parameter, but the
current models think adaptively regardless — so blocks come back every turn, and
dropping them risks ordering and signature rejections inside the tool loop.
`reasoningBlocks` is a provider-opaque passthrough on the message type, so other
providers needing the same replay contract can adopt it later.

Conversation history is repaired on the way out rather than trusted. A tool-only
assistant turn now sends null content instead of an empty string, which
aggregators translate into an empty text block; blank turns are dropped; blank
tool results become a placeholder; and tool calls or results orphaned by context
compaction are backfilled or removed. This is shared by OpenRouter and LLM
Gateway, and the equivalent repair is applied to Bedrock's Converse payload.

Vertex AI's native Claude branch was posting OpenAI-shaped messages, system role
included, straight to streamRawPredict. It could not have worked with a system
prompt. It now uses the shared Messages translation.

OpenRouter's error.metadata.raw carries the upstream provider's actual
complaint, while its own message is often the wrapper "Provider returned error".
Discarding it is why both reports were undiagnosable; it is now included, which
also lets a prompt-too-long rejection classify as context overflow and trigger
auto-compaction instead of failing the session.

Co-authored-by: Autohand Evolve <code-noreply@autohand.ai>

… with 2 updates

Bumps the production-dependencies group with 2 updates in the / directory: [@ff-labs/fff-bun](https://github.com/dmtrKovalenko/fff/tree/HEAD/packages/fff) and [node-llama-cpp](https://github.com/withcatai/node-llama-cpp).


Updates `@ff-labs/fff-bun` from 0.10.3 to 0.10.5
- [Release notes](https://github.com/dmtrKovalenko/fff/releases)
- [Commits](https://github.com/dmtrKovalenko/fff/commits/v0.10.5/packages/fff)

Updates `node-llama-cpp` from 3.19.1 to 3.20.0
- [Release notes](https://github.com/withcatai/node-llama-cpp/releases)
- [Commits](withcatai/node-llama-cpp@v3.19.1...v3.20.0)

---
updated-dependencies:
- dependency-name: "@ff-labs/fff-bun"
  dependency-version: 0.10.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: node-llama-cpp
  dependency-version: 3.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>