Mermaid: baixar versions anteriors

## Mermaid 0.30.0

### Added

• **`/usage` shows what the session cost.** Below the token counts it now
lists each model the session used, subagents included, with an estimate
at list prices and a total. A price comes from `[pricing.models."<model>"]`
in your config first, then from the public catalog at models.dev (fetched
at most once a day and cached; set `[pricing] catalog_url = ""` to never
fetch it, and it is never fetched under `safety.network = "deny"`). Local
Ollama models cost $0. A model with no price says so and is left out of
the total. Saved sessions now record their usage per model, so a resumed
session keeps its cost.

• **Ctrl+R searches the prompts you sent before.** It lists this session's
prompts at once and adds those of the project's last 50 saved sessions
as they load, newest first. Type to filter (every word must match, case
does not matter); Ctrl+R or Down goes to the next match; Enter puts the
prompt in the composer to edit or send; Esc leaves the draft as it was.

• **`/init` asks the agent to write AGENTS.md.** It sends one ordinary
prompt：write the file at the project root with the build, test, lint
and run commands, the layout and the pitfalls an agent cannot learn
quickly from the code, or improve the file that is there. Words after
`/init` are added to the request.

• **`--add-dir <dir>` and `/add-dir <path>` let the agent work in more than
one directory.** Each added directory gets the project directory's trust:
the file tools and the policy gate treat paths inside it as project paths
(no outside-the-project approval or Auto-mode review, edits checkpointed,
writes confined beneath it), `execute_command` with a `working_dir` there
is not escalated, and `--confine-fs` / `--sandbox` let shell commands write
there. `read_only` still blocks writes everywhere. The flag repeats and adds
to a new user-config key, `[workspace] additional_dirs`; `/add-dir <path>`
adds one for the rest of the session and bare `/add-dir` lists them.
Paths are canonicalized when added, and a missing one is an error. Symlinks
get the project root's rules：a link inside an added directory that points
out of it is not inside it. Subagents inherit the list, and `/doctor` and
the model's session facts name it. A repository's `.mermaid/config.toml`
cannot set the key.

• **MCP resources and prompts.** A server that declares the `resources`
capability gives the model two built-in tools, `list_mcp_resources`
(optionally filtered by `server`; each resource's uri, name, description
and mimeType) and `read_mcp_resource` (`server`, `uri`; text verbatim,
images attached, other binary content summarized by type and size, output
capped at 100,000 characters). They are advertised only while such a server
is ready, are never deferred behind `tool_search`, and pass the same policy
gate as MCP tool calls, so `read_only` blocks them as it blocks MCP tools. A
server that declares `prompts` puts each prompt in the `/` palette as
`/mcp__<server>__<prompt>`, tagged `(mcp:<server>)`：running it maps the
typed words onto the prompt's declared arguments in order (quotes group
words; the last argument takes the rest), prints a usage line when a
required one is missing, and otherwise fetches the prompt and sends its
text as your message. `/doctor` lists each ready server's tool, prompt and
resource support.

• **Gemini models get Gemini's own computer use tool.** With `[tools]
computer` and `provider_native` on, Gemini gets its `computer_use` tool for
the desktop in place of Mermaid's schema. Each call runs through Mermaid's
`computer` tool with the same approval and mouse-move stop, its
coordinates (out of 1000 across the screen) are scaled to the screen, and
the screenshot after it goes back in the function response. A call Gemini
asks to confirm is shown with that request; a call it blocks does not run.

• **OpenAI models get OpenAI's own computer tool.** With `[tools] computer`
and `provider_native` on, an OpenAI model on the Responses API gets the
`

## Mermaid 0.29.0

### Added

• **Local web search now works on Windows.** `web_search` defaulted to a
bundled local SearXNG that had no Windows build, so on Windows the tool
simply was not there unless you pointed Mermaid at Ollama Cloud or your own
instance. mermaid-searxng v0.4.0 publishes a `windows-x86_64` bundle, and
Mermaid now downloads, verifies and runs it like on Linux and macOS：no
Docker, no WSL, nothing leaving the machine. SearXNG's one Unix-only import
(`pwd`, used only to log a Valkey connection failure, and Valkey is off)
is made optional in that build.
• **Claude now gets the tools it was trained on.** On Anthropic, Mermaid sends
Anthropic's own text editor (`text_editor_20250728`) and bash
(`bash_20250124`) tool definitions instead of its hand-written schemas for
the same work. The text editor stands in for `read_file`, `write_file` and
`edit_file`; `bash` sits beside `execute_command`, which keeps its timeout
and background mode. Every native call is rewritten onto the Mermaid tool it
stands for before it runs, so the policy gate, the read-only sandbox,
checkpoints and approvals apply exactly as before, and history replays the
call in the form the model wrote. `bash` is not offered on Windows, where
commands run under PowerShell. A model that rejects these tools is
remembered and gets Mermaid's schemas; `[tools] provider_native = false`
turns the whole thing off. Along the way `read_file` lists a directory
instead of failing on it.
• **The evals can compare the guidance pack on and off, and keep a history.**
`just eval-guidance <model>` runs every task with the coaching pack pinned
on and then off (3 runs each by default) and reports the difference per
task, with a verdict on whether the pack helps that model and whether the
`auto` default, which decides by local versus hosted provider rather than by
capability, picked right for it. Every live run now appends its scores to
`evals/results/history.jsonl` with the date, version and commit, and the
report compares each model with its earlier runs and with every model
recorded, on the same tasks. `MERMAID_EVAL_JOBS` runs tasks in parallel.
• **Three longer eval tasks, scored on inputs the model never sees.**
`ledger-refunds` carries a feature through parsing, totals and the report;
`ledger-exact-money` moves money from `f64` to integer cents across a crate;
`stock-wrong-totals` is a bug reported only by its symptom, whose cause sits
in a different module. Each is scored by running the program on a hidden
input copied in after the run (the new `overlay` on a `command` check), so
a fix tuned to the visible samples does not pass.

### Changed

• **Hosted models no longer get coaching through tool descriptions and
checklist reminders.** The guidance pack was already off for hosted APIs,
but the same advice still reached every model another way：the `memory`,
`task_create`, `task_update`, `task_list` and `ask_user_question` tool
descriptions told the model how to use them well, and the checklist sent a
reminder every 5 model calls without an update and a note whenever more
than one task was in progress. Tool descriptions now say only what the tool
does, the advice lives in the guidance pack, and both checklist reminders
follow `[output] guidance`.

• **Compaction summaries now read more of the conversation on large-context
models.** The summarizer's input was capped at 64k tokens whatever the model's
window, so a 1M-context model compacting ~850k tokens of history wrote its
handoff from a 64k excerpt trimmed from the middle. The budget now scales with
the window Mermaid resolves for the model：75% of it (750k on a 1M model, 150k
on 200k), never less than the old 64k and never more than the window minus the
summary's output, so small local models behave exactly as before. An unknown
window keeps 64k. The share is configurable as
`[compaction] summarizer_input_window_percent`.

• **The `auto`-mode safety classifier now sees the conversation, not just
your last message.**

## Mermaid 0.27.0

• **Output styles (`/output-style`).** Named voice/format presets that modify the system prompt：built-ins `default` (stock prompt), `proactive`, `concise`, `explanatory`, and `learning`, plus custom Markdown files with `name`/`description`/`keep-coding-instructions` frontmatter (keeping the built-in engineering instructions is the default). Custom files live user-globally (`~/.config/mermaid/output-styles/<name>.md`) or per-project (`<git-root>/.mermaid/output-styles/`, which wins on a clash); a custom name shadows a built-in. Select with `/output-style [name]` (persists to the user config, or the project config with `--project`), `[output] style = "..."` in either config file (project config may set it — prompt text, not a capability), or `--output-style` for one invocation. A switch applies to the next message with no `/clear` needed and never touches subagents; unknown names warn and fall back to `default`; `mermaid doctor` reports the active style and which layer set it.

### Fixed

• **`/reasoning xhigh` now sets the level instead of showing the current one.**
`ReasoningLevel::parse` (the slash-command path) missed the `xhigh` arm, so
the command parsed to `None` and printed the current depth. Alt+T,
`--reasoning xhigh`, and config-file `xhigh` already worked.
• **`reasoning：max` reaches Meta's `max` tier on muse-spark-1.3.** The Meta
adapter collapsed `Max` to `xhigh`, which was correct while `max` was in
partner preview but stale since its Sept 4 public release：a 1.3 session
set to `max` now sends `reasoning：{effort: "max"}`. muse-spark-1.1/1.2
still snap down to `xhigh`, which is their top accepted tier.
• **The release pipeline still ran `mermaid version`.** The subcommand went
in 0.26.0 (`--version` is the one that stays), but `release.yml`'s build
smoke test, the `install.sh` check and the Homebrew formula's test all
called it, so the v0.26.0 release run failed after a successful build.
All three use `--version` now.

## Mermaid 0.26.0

### Added

• **One integration test binary.** The 23 integration test crates under
`tests/` are one `tests/integration.rs` with a module per former crate
under `tests/it/`, so a test run links once instead of 23 times. Alongside:
`rust-lld` for Windows MSVC via `.cargo/config.toml`, line-tables-only
debug info in the dev and test profiles, `opt-level = 2` for dev
dependencies, and a `just test` recipe for nextest.
• **Windows OS sandbox.** `--no-network`, `--confine-fs` and `--sandbox`
confine model-run shell commands on Windows through an AppContainer and a
Job Object：the network kill-switch omits the container's network
capabilities (loopback to `127.0.0.1` is exempted for local tooling), write
confinement grants the container SID access to the project, working and
temp directories and nothing else, and the job kills the process tree when
the handle closes. Documented in `docs/sandbox.md`.
• **`edit_file`：single-location search-and-replace.** `path`,
`target_content`, `replacement_content`, and `allow_multiple` for when the
target legitimately repeats. Matching degrades in steps -- exact, trailing
whitespace, full trim, Unicode normalisation -- and refuses an ambiguous
match. Same containment, checkpoint and approval-replay path as
`apply_patch`, which stays for multi-hunk and new-file work.
• **Allowlisting for the web tools.** The `web_fetch` approval offers "don't
ask again" for the host (`web_fetch:docs.x.ai`, `web_fetch:localhost:8080`)
for the rest of the session; `web_search` can be allowlisted the same way.
`[web] allowed_domains = ["docs.x.ai", "localhost:8080"]` in `config.toml`
makes the trust persistent.
• **Inline Markdown in the task checklist.** Task subjects in the checklist
band, the collapsed "Next:" line and the spinner headline render `**bold**`,
`` `code` ``, `*italics*`, `~~strikethrough~~` and `[links](url)`. Long
subjects wrap with a hanging indent under the text column, and the window
around the in-progress task is budgeted in visual lines rather than
subjects. Completed tasks keep their weights under the dim and
strikethrough.
• **Grok (xAI) is a built-in provider.** `mermaid --model grok/<model>`
(alias `xai/<model>`) reaches xAI's OpenAI-compatible endpoint at
`https://api.x.ai/v1` with `XAI_API_KEY`. Vision and tool calling work as
with any Chat Completions provider.
### Fixed

• **The daemon's warnings went nowhere.** `mermaidd` called `tracing::warn!`
for a rejected client, a failed accept, a reconcile that did not finish,
and never installed a subscriber, so none of it was written anywhere. It
now uses the CLI's log (`~/.mermaid/mermaid.log`, redacted, owner-only;
`RUST_LOG` sets the level) and logs its version on start. An ignored
daemon integration test starts a real `mermaidd` and reads that line back.
• **Process hardening applies on macOS and Windows, and says what it did.**
`harden_process` was a silent no-op off Linux. macOS now sets the core-dump
limit to zero and calls `ptrace(PT_DENY_ATTACH)`; Windows suppresses the
crash dialog whose debug path hands the process to a registered handler
(there is no per-process switch for WER dump collection, and the module
doc says so). The function returns what took effect, and `mermaid` logs a
warning at startup when nothing did instead of assuming the protection is
there. `mermaidd` applies it too; it had applied none.
• **The Windows sandbox honours the half of the policy it was not asked to
enforce.** An AppContainer denies both axes by default, so `--confine-fs`
alone had also cut the network (no capability SIDs were attached) and
`--no-network` alone had blocked nearly every write (no path was granted).
Now `deny_network = false` attaches the three network capabilities, and an
empty write list grants the working directory and the temp directory. An
AppContainer cannot be told "writes unconfined", so that floor is
documented in `docs/sandbox.md`. Three Windows tests cover the capability
list, the implicit temp grant, and tha

## Mermaid 0.25.0

### Added

**`mermaid task <id> --send "<text>"` -- you can talk to a task that is
already running.** Attaching to a daemon task could watch it and kill it,
and that was all: `subscribe_task` streams a task's events and
`cancel_task` fires its token, but nothing could put a message *into* a
run in flight. Noticing halfway through a twenty-minute task that you also
wanted the tests checked meant cancelling it or waiting it out and
starting again from `--resume`.

The run now publishes an `EngineHandle` -- its mailbox and its event bus --
the moment its engine exists, before the first model call. The daemon
registers it alongside the cancellation token it already kept, and drops
it with the task's event stream. The mailbox is the SAME channel every
effect result arrives on, which is the design and not an implementation
detail: a prompt sent from outside is indistinguishable from one the run
produced itself, so it goes through the same reducer, the same stale-turn
filter, the same recorder, and the same event log, and queues behind the
live turn exactly as a typed one does. There is no second way into the
state.

A task that is not running says so and points at `mermaid run --resume`,
rather than accepting a message with nowhere to go. The send is
non-blocking on the daemon's side, so a run that is behind on its own
effects cannot stall every other client.

### Changed

**Every provider streams through one read loop, and a slow reader now
reaches the socket instead of a queue.** Five adapters each carried their
own copy of the same loop -- read a chunk, cap the reassembly buffer, split
frames, dispatch, decide whether the stream ended or was cut -- and only the
dispatch step was ever about the provider. The copies had drifted: Ollama
flushed the un-terminated frame left when a body closes mid-frame and the
four SSE adapters dropped theirs, so a server that ends its body directly
after `data: {...}` without the blank line loses its final frame on four
providers out of five. Nobody chose that; it is a `Framing` decision written
down in one place now, with the reason next to it.

What you can observe. Between the adapters and the screen sat an unbounded
staging channel and a relay task spawned per turn, there to stop a `Done`
event from overtaking a tool call the model had asked for -- which would
make the agent silently skip running it. The adapters' read loops were
already async, so they now await the send directly and the ordering holds by
construction, with no second channel to reorder anything. The bounded
channel that was always documented as the backpressure finally is it: a turn
whose consumer falls behind stalls the read and fills the provider's TCP
window, rather than growing a queue in memory. A turn also no longer leaks a
spawned task if it is cancelled at the wrong moment, because there is no
longer a task to leak.

Meta joins the other four as a real adapter rather than a provider that
hand-rolled one, which is what removes the fifth copy of the loop. The wire
formats are now covered by one conformance suite: recorded response bodies
per provider, asserted in shared terms, so that Anthropic's `max_tokens`,
Gemini's `MAX_TOKENS`, OpenAI's `length` and Ollama's `done_reason:
"length"` are provably the same fact to everything above them. Each scenario
runs twice, the second time one byte at a time, which is the first coverage
any adapter has had for a network chunk boundary landing inside a frame.

**The driving loop is a value now, and a timed-out headless run stops
leaking its MCP children.** `update(State, Msg) -> (State, Vec<Cmd>)` is the
whole product; driving it is five lines -- stamp the clock, reduce, route the
commands, stop on exit -- and those five lines were written out longhand in
six places, each with its own spelling of the loop around them. The cost was
never the duplication, it was that fixes landed once per copy: #76 (a
timed-out child dropped its effect runner mid-flight and leaked th

Mermaid 0.18.0
Changed
- BREAKING: Windows commands now run under PowerShell instead of cmd.
Foreground and background execute_command on Windows spawn PowerShell
(pwsh, falling back to Windows PowerShell 5.1) with -NoProfile -NonInteractive rather than cmd /C. Write commands in PowerShell syntax
($env:VAR, Get-ChildItem, Select-String); cmd-only syntax
(%VAR%, if defined, & chaining) no longer works. Native exit codes
now propagate — a failing cargo build surfaces its real code instead of
collapsing to 0/1 — and background processes get a hidden console so they
survive detached. The read-only-command allowlist and the
destructive-command hard-deny both learned the PowerShell spellings
(read-only cmdlets like Get-Content/Test-Path, and blocked shapes like
Remove-Item -Recurse on dangerous roots).
- BREAKING: write-capable MCP tools are vetted even in full_access. A
new [safety] external_writes floor (allow | auto | ask | deny,
default auto) means safety mode alone no longer authorizes an external
side effect: an MCP tool without a server-advertised readOnlyHint is
vetted against your request by the intent classifier — aligned calls run
silently, off-task calls escalate to approval — in every mode,
full_access included. Read-annotated tools are unaffected, and the hint
is treated as untrusted (it never grants more than the mode already
allows). Set external_writes = "allow" to restore the previous
unconditional behavior.
- BREAKING: machine-scoped package installs are vetted even in
full_access. A new [safety] system_installs floor (same levels and
auto default) gates system-scoped package operations — npm -g, cargo install, pip install, pipx, gem install, go install, dotnet tool install, and brew/apt/dnf/pacman/winget/scoop/choco/…
installs — because they mutate the machine, not the project, and sit
outside checkpoint reach. Project-local installs (npm install, cargo add, yarn add) are untouched. Set system_installs = "allow" to restore
the previous behavior.
Added
- blocked task-checklist status. A task stalled on an external
dependency can be marked blocked — rendered with its own glyph and
overflow-footer count — instead of masquerading as pending. Unblocking a
task preserves its original start time and token accounting. The blocker
workflow the agent follows: mark the stuck task blocked, add a task for the
blocker, and make that one in-progress.
Fixed
- System prompt corrected against runtime behavior. The agent's system
prompt is now truthful about what the runtime actually does: the real
per-platform shells, the exact tool inventory (memory verbs,
ask_user_question, tool_search-deferred MCP tools), the read-only
mode's true allow/deny surface, scratchpad sweep timing, plan-mode gating,
and the reduced subagent toolset. Memory facts are now readable via
read_file in every scope, the write_file schema no longer points at a
removed tool, and the memory tool reports its search action. New
regression guards hold the prompt, the README's slash commands, and the
sample config to the runtime so they cannot silently drift again.

Mermaid 0.17.0
Added
- Windows: PTY-fidelity foreground exec via ConPTY. Foreground
execute_command on Windows now runs on a real pseudoconsole (the same
portable-pty path Unix uses) instead of always degrading to pipes: the
child sees a console (isatty-gated color and progress tools behave),
and the capture reaches the model ANSI-stripped and CRLF-normalized.
[exec] pty = false still forces pipes, and any pre-spawn PTY failure
falls back to the pipe path. strip_ansi now also consumes
DCS/SOS/PM/APC string payloads, drops bare BEL, and applies backspace
erasures — artifacts ConPTY repaints emit.
- macOS exec sandbox (Seatbelt). --no-network and --confine-fs /
--sandbox now confine model-run shell commands on macOS via
/usr/bin/sandbox-exec, behind the same launcher that applies
seccomp/Landlock on Linux. The generated allow-default profile denies
network (sparing AF_UNIX sockets, matching Linux) and denies writes
outside the allowed roots, matching both the literal and canonicalized
path so macOS TMPDIR firmlinks work. Fail-closed: if the sandbox cannot
be applied the command exits 126 instead of running unconfined.
mermaid self-test now reports real per-platform sandbox availability
instead of a hardcoded "yes" off-Linux, and CI gains a macOS
sandbox-integration job with a Seatbelt profile-compile canary.
- Plan mode: headless runs + SDK visibility. mermaid run --plan enters
plan mode before the prompt seeds: the run explores read-only and
delivers a plan file (.mermaid/plans/) as its result — with no approval
UI the plan is accepted but implementation does not start.
--plan-autoaccept flows the same run straight from the approved plan
into implementation. RunEvent::ToolFinished gains an additive plan
payload (path + start/fresh/fork disposition) when the finishing call is
exit_plan_mode, so NDJSON streams and daemon subscribe_task
subscribers get first-class plan visibility without any change to
existing event shapes.
- Plan mode: clear-context execute + handoff. The approval dialog gains
Approve, clear context and start — execution continues in a fresh
conversation seeded with a handoff preamble plus the approved plan (the
option shows how full the context is, so the tradeoff is legible), with
the checklist re-seeded and the exploration transcript saved to disk —
and Hand off..., a two-step sub-dialog: fork of this session (carries
the transcript) or fresh session, then the execution model (same model,
a recently-used or locally-pulled model from ollama list, or any
free-typed provider/model). Handoffs mint a new conversation id (the
rewind-fork machinery), switch models per-request, and auto-start
implementation.
- Remote MCP servers over Streamable HTTP. [mcp_servers.<name>] now
accepts url = "https://…" instead of command, connecting to hosted MCP
servers (GitHub/Sentry/Linear-class) everywhere MCP works today — TUI,
headless, and daemon. Auth rides as headers: literal headers in config,
or env_headers mapping a header to an environment variable resolved at
request time so the secret never lands in config.toml. Register from the
CLI with mermaid add <name> --url https://… --header 'Name: Value' --env-header 'Authorization=TOKEN_VAR'. The transport tracks the server's
MCP-Session-Id, sends the negotiated MCP-Protocol-Version on every
request after initialize, drains SSE-streamed responses (including
reconnect-and-resume when the server closes a stream mid-request), and
DELETEs the session on shutdown. URLs must be https, or http to
loopback only; connections to private/link-local addresses are refused
unless the server entry opts in with allow_private_network = true.
- Run summary shows total line changes. The end-of-run
Worked for … · used … tokens line now appends · +N/-M — the exact
lines added and removed across every file mutation in the run
(write_file, apply_patch), so you don't have to sum each tool call's
diff by hand. Counts come from the tools' exact diff metadata (not the
display diff, which is capped at 220 l