TroubleScout: vanhemmat versiot ja versiohistoria

Changed
- 🧾 Refresh report readability - session reports now render code and JSON more compactly, show reasoning as collapsed prose, reduce repeated tool plumbing, preserve TUI-style ordering for approval flows, and normalize model labels without misleading source tags.

Changed
- 🧭 Tighten delegated evidence collection - selected subagent models now apply before session recreation, delegated PowerShell must use exact parent-authored commands or staged scripts, and subagent runs show a configured model fallback when SDK events omit model details.
- 🧾 Improve PowerShell audit readability - terminal and report surfaces now distinguish main-agent vs subagent execution, preserve full substantive PowerShell scripts/commands, and support temp staged read-only scripts with cleanup.

Internal
- ♻️ Aggressively split TroubleshootingSession - TroubleshootingSession.cs is now capped below 900 lines as a facade/composition root, with prompt flow, approvals, status, telemetry, model/BYOK, target coordination, initialization, and command wiring moved into focused services and direct tests.

Internal
- 🧭 Extract slash-command dispatch - simple interactive commands now flow through SlashCommandDispatcher, keeping registry-backed suggestions/help aligned while moving low-risk command behavior out of TroubleshootingSession.RunInteractiveLoopAsync. Added dispatcher tests for command matching, fallthrough, exit handling, /mode, /theme, /save, and /copy.

✨ New Features
- 🛡️ SafeMarkup helper - new TroubleScout.UI.SafeMarkup provides Escape(value) and Interpolate($"[red]{value}[/]") for emitting Spectre markup that contains user- or model-controlled text. Interpolate auto-escapes every interpolated argument while preserving literal markup tags, eliminating the "did I forget Markup.Escape here?" footgun.
- 🔐 SecretRedactor helper (not yet wired) - new TroubleScout.Services.SecretRedactor masks secret-shaped values (GitHub PATs, AWS access keys, JWTs, Bearer tokens, URLs with userinfo, connection-string passwords, generic api_key= / token= / secret= pairs) with ***REDACTED***. The helper is added in this release as a prerequisite for any expanded session persistence (opt-in transcript, /replay); it is not yet invoked by /report or conversation history. 24 tests cover each pattern category plus negative cases (background_color=red, token=ok, plain URLs without userinfo).
🐛 Bug Fixes
- 🔒 Patch GHSA-37gx-xxp4-5rgx / GHSA-w3x6-4m5h-cxqf - pin System.Security.Cryptography.Xml to 9.0.15 so dotnet run/dotnet build no longer surface NU1903 warnings about the vulnerable 9.0.10 version that Microsoft.PowerShell.SDK 7.5.4 pulls in transitively.
- 🧹 Trim startup status panel - the "MCP approved (session)" and "MCP approved (persisted)" rows no longer appear in the boot capability table; they were always empty before any approval prompt and never gained signal afterward. Both tiers are still surfaced in the HTML report.
🧪 Tests & Tooling
- ✅ Pin AGENTS.md safety invariants with regression tests - new InvariantGuardsTests and expanded McpReadOnlyHeuristicTests lock down per-server MCP approval scope, the read-only MCP heuristic, JEA AddScript protection, IncludeSubAgentStreamingEvents = false, the PauseForApproval/ResumeAfterApproval pairing for prompts shown while the spinner is live, and ESC cancellation propagation. Designed to catch regressions before larger refactors land.
📝 Documentation
- 📐 docs/architecture.md - promoted the AGENTS.md component diagram and key seams to a contributor-facing architecture document; linked from the README.
- 📓 docs/slash-commands.md - first manual reference of every slash command, grouped by area; linked from the README. (Will become generator-backed once the slash-command registry refactor lands.)
- ⚙️ README "Configuration Reference" section - one-stop reference for settings.json keys, BYOK environment variables, MCP role mapping, and persisted approvals.
- 🧑‍💻 CONTRIBUTING.md human workflow - human-only build/test/smoke instructions and version-bump rule (separate from the agent-only TDD workflow in AGENTS.md).

✨ New Features
- 🎛️ Post-analysis action dialog - after diagnosis/recommendations or after approved commands finish, TroubleScout now returns control to the user with a next-step dialog: continue investigating, apply the fix, or stop for now.
- 🎨 Windows Terminal wait feedback - TroubleScout now sets the running terminal title to TroubleScout, drives the Windows Terminal tab/taskbar progress ring with OSC 9;4, and uses the ASCII-safe "Wheel of IT Blame" animation while the AI is busy.
🐛 Bug Fixes
- ♻️ Stop endless post-approval recursion - approved command follow-ups now ask the AI to summarize what changed and then yield control back to TroubleScout instead of recursively telling the model to "continue your analysis" forever.
- 💤 Better stalled-stream visibility - when a streamed response goes quiet mid-turn, TroubleScout now surfaces explicit wait notices while keeping the tab progress indicator active.
📝 Documentation & UX
- 📝 Document the new checkpoint and waiting flow - refreshed README and AGENTS guidance for the next-step action dialog, Windows Terminal title/progress behavior, and the new waiting animation.

🏗️ Architecture
- Decompose oversized classes — extracted 14 focused service/UI classes from TroubleshootingSession.cs (6,627→4,244 lines, −36%), ConsoleUI.cs (2,300→1,319, −43%), and PowerShellExecutor.cs (990→574, −42%):
- Services/JsonParsingHelpers — static JSON parsing utilities
- Services/PermissionEvaluator — shell permission analysis and assessment
- Services/ReportHtmlBuilder — HTML troubleshooting report generation
- Services/CommandValidator — command safety validation and blocking
- Services/CopilotCliResolver — CLI path resolution and prerequisite checks
- Services/SystemPromptBuilder — system prompt construction
- Services/ModelDiscoveryManager — model listing, pricing, and display
- Services/ConversationHistoryTracker — thread-safe prompt/reply history
- Services/ServerConnectionManager — multi-server session lifecycle
- Services/ByokProviderManager — BYOK OpenAI configuration and auth
- Services/SecondOpinionService — second-opinion prompt building
- UI/MarkdownStreamRenderer — streaming markdown-to-ANSI conversion
- UI/ModelPickerUI — interactive model selection UI
- UI/PowerShellSyntaxHighlighter — PowerShell syntax highlighting

✨ Features
- 🔐 Add startup --jea support — TroubleScout can now preconnect a single JEA endpoint at launch with --jea <server> <configurationName>, making headless validation and smoke testing possible without going through the interactive TUI first.
🐛 Bug Fixes
- 🐛 Fix JEA no-language runspaces — JEA command execution now avoids the script-wrapper path that failed on no-language endpoints, so command discovery and constrained command execution can succeed.
- 🐛 Remove redundant /jea approval prompt — explicitly choosing /jea no longer triggers an extra Safe-mode confirmation before the session is established.
- 🐛 Guide /jea input interactively — entering /jea without parameters now prompts for the server name and configuration name instead of failing with usage-only output.
📝 Documentation & UX
- 📝 Use generic JEA examples — help text and docs now use placeholders like server1 and JEA-Admins instead of real-looking infrastructure names.
- 📝 Document JEA CLI parity — README, release guidance, and AGENTS guidance now reflect the --jea startup flag and the updated /jea UX.