v0.1.7

Summary

This release adds tool_script — programmatic tool orchestration in a QuickJS sandbox, letting the model chain multiple tool calls in one script instead of many round-trips, with a hardened serialization contract, sandbox jail, MCP dispatch, and opt-in gating.

It also introduces session handoff + a try-best detector (behind MIMOCODE_ENABLE_TRY_BEST_HANDOFF, default off) and a big skills push: new bundles (data-analytics, product-design, sales, learn-everything), a skill_search tool with BM25 matching, bundle autocomplete + i18n, and the mimocode bundle renamed to mimocode-docs. Other updates: xAI/Grok bump with OAuth login, interleaved-reasoning transform sync, several provider/session robustness fixes, and switching install docs to bun ci.

---

本次发布新增 tool_script:在 QuickJS 沙箱里以脚本方式编排工具调用,让模型在一段脚本里串联多个工具、减少多轮往返,并配有严格的序列化契约、沙箱隔离、MCP 分发和按需开关。

同时引入会话交接(handoff)+ try-best 检测器(由 MIMOCODE_ENABLE_TRY_BEST_HANDOFF 控制,默认关闭),以及一批技能(skill)增强:新增 data-analytics、product-design、sales、learn-everything 等 bundle,带 BM25 匹配的 skill_search 工具,bundle 自动补全与多语言,并把 mimocode bundle 更名为 mimocode-docs。其他更新:xAI/Grok 升级并支持 OAuth 登录、interleaved reasoning 的 transform 同步、若干 provider/session 健壮性修复,以及安装文档改用 bun ci。

Features

• tool: add tool_script — programmatic tool orchestration in a QuickJS sandbox by @JinyuXiang-Mimo in #1749
• skill: add skill_search tool with BM25 matching by @MiMoHardFather in #1799
• skill: add data-analytics, product-design, and sales skill bundles by @MiMoHardFather in #1792
• skill: add learn-everything bundle by @MiMoHardFather in #1805
• skill: skill bundle autocomplete + i18n; rename mimocode bundle to mimocode-docs by @MiMoHardFather in #1796, #1797
• session: session handoff and try-best detector (opt-in via MIMOCODE_ENABLE_TRY_BEST_HANDOFF, default off) by @MiMoHardFather in #1751, #1767
• provider(xai): bump @ai-sdk/xai to 3.0.102, sync Grok transform, add OAuth login by @wqymi in #1818

Bug Fixes

• tool_script: serialization contract, sandbox jail, MCP dispatch, and opt-in gating; discourage overuse and stop escaping return values by @JinyuXiang-Mimo, @yanyihan-xiaomi in #1784, #1777
• provider: guard non-array message content in part mapping (j.map is not a function) by @wqymi in #1728
• transform: sync interleaved handling — exclude openrouter + always echo reasoning field by @wqymi in #1819
• session: treat GPT reasoning-only steps as terminal by @MiMoHardFather in #1820
• session: narrow empty-step guard to only empty-args tool calls by @yanyihan-xiaomi in #1776
• session: session LLM and plugin hook fixes by @MiMoHardFather in #1815
• task: remove main-session task gate, keep subagent gate only by @yanyihan-xiaomi in #1759
• tui: clean up unsupported tips by @yanyihan-xiaomi in #1768
• skill: only expose top-level builtin entries; localize new bundles and hide internal workflows by @MiMoHardFather in #1795
• build: fresh-clone engine node build + pin ghostty-web to a commit by @clyfish in #1771

Docs

• document CJK/East-Asian font handling for office skills by @clyfish in #1758
• clarify pptx preview script paths and CLI-only scope by @yanyihan-xiaomi in #1789
• use bun ci for install instructions by @clyfish in #1775, #1778

Internal / CI

• default MIMOCODE_ENABLE_TRY_BEST_HANDOFF to off + align tests by @MiMoHardFather in #1767, #1770
• rename build:dev to build:local + add root shortcut by @yanyihan-xiaomi in #1821
• skip two cold-warmup-flaky workflow/tool tests by @yanyihan-xiaomi in #1779

New Contributors

• @clyfish made their first contribution in #1771

Full Changelog: v0.1.6...v0.1.7

v0.1.6

Summary

Slash skills are now enabled by default and support multi-skill orchestration — referencing 2+ /skill-name in a single message auto-loads their contents and injects an orchestration plan. /skip-permissions adds a runtime toggle for unattended runs — forced-ask operations (destructive bash, etc.) auto-reject after 60s with actionable feedback, while other non-deny permissions auto-allow.

Agent mode is now locked after first message: Build and Plan can still switch between each other, but entering Compose isolates the session to that mode. Many models tend to ignore tools that appear mid-conversation, so keeping the skill/tool set fixed from session start significantly improves tool-call reliability.

Custom provider compatibility: /modalities command lets users configure multimodal support (image, audio, video, pdf) for custom models directly in the TUI without manual config editing; system prompt is now sent as a single {role:'system'} message instead of two, fixing vLLM and other backends that expect exactly one system message; Moonshot/Kimi tool calling no longer 400s on discriminated-union schemas; oversized images are now compressed and area-averaged downscaled before sending, preventing permanent 400 failures.

Other highlights: orchestrator mode improvements (liveness tracking, fan-in aggregation, stall watchdog, structured notification cards); workflow meta.permissions manifest for up-front permission declaration; /rebuild command to manually rebuild context from checkpoint; file hooks hot-reload from any external editor without restart; builtin skills gated by CLI availability; broken custom tools no longer crash the session.

---

Slash skills 默认开启，支持多技能编排——一条消息里引用多个 /skill-name 会自动加载对应技能内容并生成编排计划。新增 /skip-permissions 命令，适合无人值守跑任务——危险操作 60s 无响应自动拒绝，其余非 deny 权限自动放行。

模式锁定：发送第一条消息后 agent 模式不可切换（Build/Plan 之间仍可互切，但 Compose 进入后隔离）。很多模型不喜欢中途出现的新工具、倾向于不调用动态插入的 skill，锁定模式让 skill/tool 集合从会话开始就固定，显著提升工具调用成功率。

Custom Provider 兼容性改进：新增 /modalities 命令，可以直接在 TUI 里为自定义模型设置多模态支持列表（图片、音频、视频、PDF），不用手动改配置文件；system prompt 合并为单条消息发送，修复 vLLM 等后端因双 system message 导致的指令重复问题；Moonshot/Kimi tool calling 不再因 discriminated-union schema 报 400；超大图片发送前自动压缩和面积均值缩放，不再因尺寸超限导致 400 永久卡死。

其他：orchestrator 模式改进（存活状态跟踪、fan-in 聚合、卡顿监控、结构化通知卡片）；workflow 支持 meta.permissions 清单用于前置权限声明；新增 /rebuild 命令手动从 checkpoint 重建上下文；文件 hooks 支持外部编辑器热重载；内置 skill 按 CLI 可用性自动门控；自定义 tool 文件有语法错误不再导致整个 session 崩溃。

Features

• tui: slash skills enabled by default with multi-skill orchestration — /skill-name triggers autocomplete anywhere in input, 2+ skills auto-load with orchestration prompt; compose: prefixed skills correctly filtered to compose agent only by @MiMoHardFather, @yanyihan-xiaomi in #1654, #1656
• tui: add /modalities command to configure per-model input capabilities (image/audio/video/pdf) with multi-select dialog, persistent config and live-reload by @JinyuXiang-Mimo in #1650, #1651
• permission: add /skip-permissions runtime toggle for unattended runs — auto-allows non-deny permissions; forced-ask permissions auto-reject after 60s with actionable CorrectedError feedback instead of hanging forever by @JinyuXiang-Mimo in #1645
• session: agent mode locks after first message — Build/Plan freely switch between each other, Compose isolated once entered; fixes models ignoring dynamically injected skills mid-session by @yanyihan-xiaomi in #1725
• orchestrator: liveness tracking (progressing/stalled), fan-in aggregation, stall watchdog notifications, reliable relay into idle peers, grant persistence, and structured notification cards in TUI by @wqymi in #1681, #1699, #1691, #1711
• workflow: meta.permissions manifest for up-front permission declaration + engine-level agent retry by @wqymi in #1686
• session: /rebuild command to manually rebuild context from the latest checkpoint; fixes large-session wedge when a checkpoint writer is in-flight by @wqymi in #1647
• provider: area-averaging image downscale (better than nearest-neighbor) + automatic compression of oversized images before send by @wqymi in #1679
• plugin: hot-reload file hooks via mtime staleness check — edits from any external writer (editors, git, other processes) now detected without restart by @JinyuXiang-Mimo in #1638
• skill: gate builtin skills by CLI availability — skills requiring specific CLI tools only show when the tool is installed by @MiMoHardFather in #1743
• skill: add drive-mimo builtin skill for programmatically driving a separate mimo process — supports headless JSON events and interactive TUI via tmux by @wqymi in #1603
• session: expose full system prompt on session.post/userQuery.post hooks by @MiMoHardFather in #1717
• build: include commit short SHA in version string for traceability by @wqymi in #1723

Bug Fixes

• session: system prompt collapsed from two {role:'system'} messages to one — fixes vLLM and other self-deployed backends that only accept a single system message; memory instructions scoped to checkpoint owners only by @wqymi in #1636
• provider: fix Moonshot/Kimi 400 errors on tool calls — strip parent type from discriminated-union tool schemas by @mvalentsev in #1665
• provider: never send a provider-rejected assistant prefill; drop only incomplete trailing assistants + reactive backstop by @wqymi in #1703
• provider: make prompt image size cap provider-aware instead of hardcoded 4.5MB; compress or strip oversized images so they no longer 400 and permanently wedge the session by @wqymi in #1679
• session: halt on repeated empty/no-op tool calls — model-loop guard prevents infinite empty-action cycles by @wqymi in #1706
• session: truncate compaction input at previous compaction/checkpoint boundary — fixes context corruption on long sessions by @JinyuXiang-Mimo in #1695
• session: session ask answers from a child's persisted history — isolated/idle children no longer report no-activity by @wqymi in #1701
• permission: background subagents inherit parent grants instead of re-prompting or failing closed by @wqymi in #1700
• permission: force re-allow skill dirs after user config merge — external_directory: "deny" no longer blocks builtin/compose skills from loading by @yanyihan-xiaomi in #1632
• tui: session list no longer shows internal subagent/worker child sessions; fetch limited to root sessions so the 100-slot budget is fully available for user-visible sessions by @JinyuXiang-Mimo in #1627, #1642
• tui: fix slash autocomplete mid-message bugs; support colon in multi-skill mention regex for compose:* skills; include hidden skills in free-text mention detection by @yanyihan-xiaomi in #1697, #1715, #1716
• tui: save/restore scroll position when switching between agent views by @yanyihan-xiaomi in #1685, #1694
• tui: fix sticky scroll timing race via opentui _hasManualScroll by @yanyihan-xiaomi in #1718
• tui: skip app-level right-click paste on Windows Terminal to avoid double-insert by @wqymi in #1729
• tui: hide sidebar toggle strip when sidebar auto-collapses on narrow terminals (width <= 120) by @JinyuXiang-Mimo in #1637
• plugin: gracefully skip broken file tools (.mimocode/tools/*.ts) instead of crashing the entire session by @JinyuXiang-Mimo in #1635
• plugin: fix file hook reload — use Bun.build for cross-platform reliability; wire file hooks' event handlers to bus by @JinyuXiang-Mimo in #1638
• task: prevent subagents from stealing task ownership via task start — keep original owner to avoid system-reminder re-entry loops by @JinyuXiang-Mimo in #1616
• task: rewrite main-session gate prompt to prevent self-answering by @yanyihan-xiaomi in #1738
• prompt: memory-flush nudge reworded to not stop the turn; added explicit "CONTINUE current task" directive; debounced to checkpoint-boundary dedup instead of per-turn nagging by @wqymi in #1613
• mcp: handle standard tool result fields; preserve attachments on tool errors; route tool attachments by provider support; cap synthetic error images safely by @wqymi in #1704
• actor: make instanceID a process-level singleton to prevent false orphaning on layer rebuild by @wqymi in #1724
• instance: release worktree resources at boundaries by @wqymi in #1709
• workflow: robust args handling, actionable validation; fix brief-phase file write in dynamic workflows; wire parseArgsAsQuestion for deep-research bare string args by @wqymi in #1683, #1686
• tui: session-list subagent exclusion, 429 rate-limit normalization, CJK/multibyte text in tool args, structured error render by @wqymi in #1680
• tui: change provider connect placeholder from mimorouter to openrouter by @JinyuXiang-Mimo in #1610
• config: correct config schema doc URLs from opencode.ai to mimo.xiaomi.com by @yanyihan-xiaomi in #1677
• config: add .cron-lock to auto-generated .mimocode/.gitignore; ensure .gitignore is created when cron-lock acquires the directory by @yanyihan-xiaomi in #1629, #1714

Docs

• update modern-python-toolchain skill to current best practices by @yanyihan-xiaomi in #1662
• add theme font pitfall to docx skill, clarify pptx script deps by @yanyihan-xiaomi in #1742
• improve pptx skill with visual QA subagent + live preview server by @yanyihan-xiaomi in #1628
• add uv/PEP 723 support to docx-official skill by @yanyihan-xiaomi in #1739
• migrate theme schema URLs to mimo.xiaomi.com by @yanyihan-xiaomi in #1692
• add i18n descriptions for codex and claude-code skills by @MiMoHardFather in #1744

Internal / CI

• replace internal gateway name with neutral placeholder in transform tests by @wqymi in #1708
• skip flaky woken-turn notification test; skip flaky two-level workflow resume test by @yanyihan-xiaomi in #1740, #1634

New Contributors

• @mvalentsev made their first contribution in #1665

Full Changelog: v0.1.5...v0.1.6

v0.1.5

Summary

This release ships a builtin skills system — 14 domain-specific skill bundles (document handling, academic writing, arXiv search, deep research, super-research, html-to-video, skill authoring, design blueprint, and self-documentation) that auto-load when relevant files are attached or task context matches. Skills show localized descriptions in the TUI dialog and support auto-detection of office file attachments. The self-extend skill is renamed to evolve, reframing it as a proactive total self-modification interface. Two new built-in research workflows ship alongside: deep-research (parallel sub-agents → reflect → cited report) and fact-check (adversarial 3-juror verification).

Other highlights: Windows native installer now fully supported (PowerShell one-liner, working upgrade/uninstall); vision-aware image paste spills images to temp files for non-vision models with automatic multimodal model selection; Edit tool defaults to exact string matching (fuzzy now opt-in); gpt-5.5 encrypted reasoning round-trip fix; rewritten repetition detector eliminating false-positive loop-kills on structured content.

Experimental opt-in: Orchestrator mode (MIMOCODE_EXPERIMENTAL_ORCHESTRATOR) adds delegating multi-session coordination with git worktree isolation; cron + loop scheduling (MIMOCODE_EXPERIMENTAL_CRON) enables recurring prompts with durable persistence.

---

这个版本的重点是内置 Skills——14 个领域 skill 随版本分发（办公文档、学术写作、arXiv 检索、深度调研、超级科研、HTML 转视频、skill 创作、设计蓝图、自文档化等），挂载相关文件或上下文命中时自动激活，TUI 对话框显示多语言描述。self-extend 改名 evolve，作为全面自我修改的入口。同时上线 deep-research 和 fact-check 两个内置 workflow。

其他值得关注的：Windows 一行式安装命令正式可用（upgrade/uninstall 完整支持）；粘贴图片时非多模态模型会收到临时文件引用而非 base64，自动选用多模态模型处理；Edit 工具默认精确匹配；gpt-5.5 加密 reasoning 往返修复；重复检测器重写，不再误杀结构化内容。

实验性功能（需手动开启）：Orchestrator 模式支持委派式多 session 协作；cron + loop 支持定时与自适应循环。

Features

• skill/builtin: ship 14 builtin skills — docx, pdf, pptx, xlsx document handling; arxiv paper search; research-paper-writing (with PDF export); html-to-video pipeline; skill-creator; mimocode self-documentation; frontend-design; modern-python-toolchain; design-blueprint; deep-research; super-research (renamed from auto-research; literature surveys, experiment loops, paper reproduction, citation auditing). Office file attachments auto-inject skill context; TUI skill dialog shows localized descriptions; slash visibility gated by MIMOCODE_ENABLE_SLASH_SKILLS (#1557, #1564, #1565, #1555, #1569, #1570, #1572, #1567, #1531, #1583, #1579, #1585, #1587, #1586, #1604, #1580, #1594)
• skill/builtin: rename self-extend to evolve — rewrite SKILL.md as proactive total self-modification interface (tools, hooks, knowledge, workflows, UI all rewritable); sync hook-api.md with missing events; add ctx.ask() to tool-api.md (#1590)
• installer: first-class Windows PowerShell native installer (one-liner alongside macOS/Linux), working mimo upgrade/mimo uninstall, UTF-8 encoding; recommend native installer for npm/pnpm/bun users (#1511, #1549, #1551, #1592)
• tui: vision-aware image paste — non-vision models receive a temp-file @file reference instead of base64 bytes; automatic multimodal model selection; actor models [--vision] discovery command (#1513, #1546)
• edit: default to exact string matching with closest-match error hints — fuzzy matching moved to opt-in via MIMOCODE_ENABLE_FUZZY_EDIT (#1466)
• security: secondary permission prompt for irreversible bash deletions (bash_delete permission type) — intercepts rm, rmdir, shred, git reset --hard, git push --force, etc. Opt-out via MIMOCODE_AUTO_APPROVE_DELETE=true (#1588)
• tui: --dangerously-skip-permissions flag with confirmation warning (#1542)
• tui: clickable sidebar toggle button at content edge (#1541)
• config: automatic $schema URL migration from opencode.ai to mimo.xiaomi.com/mimocode/ (#1511)
• bash: token efficiency pipeline (opt-in, MIMOCODE_EXPERIMENTAL_TOKEN_EFFICIENCY_HEURISTIC) — heuristic shape-based filter strips predictable noise from common output patterns (#1473, #1519)
• provider: non-empty provider.<id>.models config acts as implicit whitelist when only_configured_models is enabled (#1532, #1589)
• orchestrator: Orchestrator mode (opt-in, MIMOCODE_EXPERIMENTAL_ORCHESTRATOR) — a primary agent that delegates to child sessions via a session tool with create/switch/list/cancel/ask/approve verbs, git worktree isolation per child, permission-approval forwarding (#1529)
• cron: cron + loop scheduling system (opt-in, MIMOCODE_EXPERIMENTAL_CRON) — 5-field cron parser, durable + session-only persistence, self-paced loop with adaptive delay and keepalive, /loop skill, TUI fire-time clock row (#1479)

Bug Fixes

• provider: fix gpt-5.5 empty output and reasoning part rs_… not found errors — request encrypted reasoning content for Responses API round-tripping (#1530)
• provider: defer vision model resolution to environment() call time — fixes crash where mimo upgrade/mimo uninstall failed without project context (#1546)
• detection: rewrite repetition detector from sliding-window n-gram to consecutive-block repeat algorithm — eliminates false-positive loop-kills on structured content; adds CJK character-level tokenization (#1476)
• tui: patch @opentui/core@0.1.101 to fix CJK paste-highlight drift (UTF-16 length → display width) (#1471)
• tui: prevent double session creation on home screen submit (#1497)
• tui: clear alternate screen buffer before spawning interactive commands (#1492)
• tui: fix background actor Task showing "completed · 0ms" while still running (#1499)
• session: add HTTP 400 to retryable status codes; exclude system sessions from mimo -c (#1528)
• effect: two-phase instance disposal — Bus shuts down after other services emit final events, fixing sessions stuck as permanently busy (#1527)
• build: generate ext/_manifest.ts in Node target (#1501)
• compose: strengthen skill invocation prompt and fix RLHF resistance (#1598)

Refactor

• Prediction uses side-channel generateText instead of llm.stream — bypasses session-coupled hooks, uses tighter context window (#1498)

Docs

• Add Builtin Skills and Workflows sections to README (en/zh) (#1581)
• Simplify npm README to concise feature list with GitHub link (#1470)

Internal / CI

• Skip flaky tests: cancel-truncation (#1523), cancel-interrupts-loop-queued-behind-shell (#1584)
• Remove unused imports and afterEach in overflow test (#1568)
• Add registry sync script (#1591)

v0.1.4

Summary

Workflow TUI gets a full overhaul — runs are now observable full-screen pages with message-style agent cards, live phase/status counters, and nested drill-down into each subagent's conversation. The inline panel is bounded to 12 lines so it doesn't flood the chat, while the full page gives you complete visibility into what every agent is doing.

A new built-in compose workflow encodes the Brainstorm → Design → Implement (TDD) → Verify → Review → Merge pipeline as deterministic code. It auto-parallelizes independent tasks into per-task worktrees, chains each phase's structured output to the next (brainstorm rationale → implementer intent → review verdict → merge), enforces bounded retry caps, and runs non-interactively to completion. When your requirements are well-defined and the task decomposes into independent subtasks, the workflow is a better fit than the compose agent — you can fire-and-forget and let the parallelism do its job. For exploratory or ambiguous tasks where you need to redirect mid-flow, ask questions, or inject judgment between steps, the compose agent's conversational mode remains the right choice.

Other highlights: dedicated system prompts for DeepSeek, GLM, and MiniMax; and a fix for Windows CJK shell output garbling — on non-UTF-8 locales (e.g. zh-CN with code page 936/GBK) spawned subprocesses now force UTF-8 encoding, covering both the bash tool and TUI shell mode.

Workflow TUI 全面重做——运行状态升级为全屏页面，每个 agent 以消息卡片形式展示（带实时阶段/状态计数器），支持嵌套下钻到子 agent 的完整对话。内联面板限制在 12 行以内不刷屏，全屏页面则提供完整的运行可观测性。

新增内置 compose workflow，把 Brainstorm → Design → Implement (TDD) → Verify → Review → Merge 流程编码为确定性程序：自动将独立任务并行分发到隔离 worktree、在阶段之间传递结构化输出（brainstorm 结论 → 实现意图 → review 判定 → merge）、限定重试上限、全程非交互跑到底。当需求明确且任务可以拆解为独立子任务时，workflow 比 compose agent 更合适——丢出去让并行跑完即可。如果任务本身比较探索性、需要中途介入改方向或在步骤间注入人工判断，compose agent 的对话式编排仍然是更好的选择。

其他重点：为 DeepSeek、GLM、MiniMax 添加了专用系统提示词；修复了 Windows 下中文 shell 输出乱码——非 UTF-8 区域设置（如简中 GBK/936 代码页）下的子进程现在强制 UTF-8 编码，bash 工具和 TUI shell 模式均已覆盖。

Features

• workflow/tui: full-screen workflow page with message-style agent cards — live spinner/status/phase/colored counters in an inline panel (capped to 12 lines), drill-down into each agent's full conversation, nested workflow drill-down, scroll position preserved across navigation; new observability-only structure tree records per-run phase/agent/workflow nodes with parameters and result summaries (#1375)
• workflow/compose: add built-in compose workflow — a programmatic pipeline that enforces the Brainstorm → Design → Implement (TDD) → Verify → Review → Merge phases as code. Compared to the existing text-constrained compose agent: the workflow auto-parallelizes independent tasks into per-task worktrees, chains each phase's structured output to the next (brainstorm rationale feeds implementer intent, review verdict feeds merge), enforces bounded retry caps, and runs non-interactively end-to-end. The compose agent remains better for interactive work where you need to redirect mid-flow or inject human judgment between steps. Supports incremental amend (re-running on existing docs reuses them and scopes the fan-out to the actual diff) (#1380)
• provider: add dedicated system prompts for DeepSeek (#1389), GLM (#1396), and MiniMax (#1398) models, routed by model API id
• tui: show view workflow agents keybind hint after workflow tool messages, reusing the existing subagents panel (#1353)

Bug Fixes

• session: detect and recover from text-form tool calls — when a model serializes a tool call as prose markup (<invoke name=...>) instead of a structured tool_use block, the turn is discarded and retried (bounded by MIMOCODE_TEXT_TOOL_CALL_RETRY_LIMIT, default 2); prevents 400 errors and session poisoning (#1336)
• server: add keep-alive heartbeat (whitespace every 10s) on POST /:sessionID/message stream to prevent external clients from timing out during long waits (e.g. question tool blocking on human input) (#1354)
• tui: default to free mimo-auto on clean install instead of a paid model that unauthenticated users can't call (#1434)
• tui: force UTF-8 encoding for Windows shell subprocesses to fix CJK mojibake — covers both the bash tool and TUI shell mode (#1418)
• security: remove SSRF check from MCP server connections — user-configured MCP servers on private networks (10.x, 172.x) are a normal pattern; SSRF protection now only applies to AI-initiated webfetch requests (#1328)
• agent: plan-mode edit/write backstop — a persisted "always" approval can no longer override plan's deny for edit/write; bash/workflow left to model discipline with clearer prompt reinforcement (#1330)
• provider: let xiaomi provider use its models.dev name "Xiaomi" instead of hardcoded "MiMo" that collided with the free mimo provider (#1366)
• actor: restore previous spawnRef binding on finalizer cleanup instead of wiping to undefined, fixing checkpoint writer breakage when Actor.layer initializes more than once (#1416)

Refactor

• Restructure agent system prompt with comprehensive sections for modes, permissions, tools, tasks, subagents, and workflows (#1407)

Docs

• Explain how to opt in to allowing the system temp directory (/tmp) via config — default unchanged, access still prompts (#1339)
• Add MiMo Ecosystem section linking awesome-mimo-agent (#1440)

Internal / CI

• Skip flaky cancel-during-fan-out and hung-agent-timeout tests (#1417)
• Test reliability improvements: backfill DB isolation (#1395), correctness fixes (#1392), remove flaky MCP lifecycle test (#1391)
• Update MimoAuthPlugin config tests for xiaomi name removal (#1386)

v0.1.3

Summary

A security-hardening and stability release. Fixes a batch of vulnerabilities from a security audit (XSS, auth enforcement, rate limiting, webhook verification, etc.) and adds SSRF protection for AI-initiated web requests. On the user-facing side, fixes a painful multi-line paste bug for CJK users: pasting content after Chinese characters would leave bracket residue and swallow trailing text, because the editor's display-width offsets were mixed with JS UTF-16 string indices. The model picker also gets a cleaner layout — mimo models pinned to the top, Ctrl+A unified with /connect.

安全加固与稳定性版本。修复了安全审计中发现的一批漏洞（XSS、认证加固、速率限制、Webhook 签名校验等），并为 AI 发起的网络请求新增了 SSRF 防护。用户侧最大的修复是中文多行粘贴问题：在中文字符后面粘贴内容，展开时会残留方括号前缀并吞掉尾部文本，原因是编辑器按显示宽度（中文=2列）计算偏移，而 JS 按 UTF-16（中文=1单位）切字符串，两者混用导致位置右偏。模型选择器也做了整理——mimo 模型置顶、Ctrl+A 统一走 /connect 登录流程。

Security

• Address 25 vulnerabilities from security audit: add SSRF checking module for webfetch (blocks private IPs, cloud metadata endpoints, IPv4-mapped IPv6 bypasses); enforce auth on non-loopback binds; require Bearer token for share endpoint; sanitize markdown HTML with DOMPurify; strip stack traces from error responses; remove query-param auth; add sliding-window rate limiting (20 req/min) on prompt and shell routes; add Feishu webhook signature verification (#1242)
• Remove /root from FORBIDDEN_ROOTS to avoid false positives on legitimate home directories (#1276)
• Skip FORBIDDEN_PREFIXES check on Windows where Unix paths like /dev incorrectly match D:\dev after normalization (#1278)

Note: The SSRF check was also applied to MCP server connections in this release, which incorrectly blocked user-configured MCP servers on private networks (10.x, 172.x). This was removed in v0.1.4 (#1328) — SSRF protection now only applies to AI-initiated webfetch requests, not user-configured endpoints.

Bug Fixes

• tui: fix multi-line paste and autocomplete corruption with CJK input — the editor (@opentui/core) tracks cursor offsets in display-width units (CJK char = 2 columns, newline = 1, tab = 2) while JS slice uses UTF-16 units (CJK char = 1); mixing them caused the [Pasted ~N lines] placeholder to leave a stray [ and swallow trailing content when preceded by Chinese, and autocomplete triggers (@/$//) to misalign their filter term (#1292)
• tui: restore provider hint on model picker favorites/recent rows, lost during #1241 refactor (#1253)

Features

• tui: remove provider name i18n (provider list is English-only), pin mimo-free and xiaomi at top of model picker, unify Ctrl+A with /connect to open MiMo OAuth login directly, scope model picker to show only the connected provider's models (#1279)
• tool: add tool-compat utility for unified tool compatibility handling; refactor edit, multiedit, read, write, apply_patch, notebook-edit, and lsp tools to use the new layer (#1252)

Compose

• Remind subagents to cd into the worktree when an isolated worktree is in use, so review and test commands run against the correct checkout (#1293)

Internal / CI

• Split unit tests into 4 parallel shards with fail-fast disabled; bump actions to v6/v5/v7; simplify setup-bun; bump bun to 1.3.14 (#1236)
• Isolate tmpdir from parent git worktree in test fixtures; add outsideGit option to shared tmpdir helper (#1256, #1259)

v0.1.2

Summary

This release reworks the free-channel experience and polishes daily ergonomics. The model picker now presents the free MiMo channel more clearly and shows a Token Plan dialog on rate-limit; the command palette supports English and pinyin search so Chinese users no longer need to switch input methods; and a new notebook-edit tool enables Jupyter cell editing. Plan mode is more stable — switching in and out no longer reshuffles the tool list. Voice input can route to any configured ASR provider, and release binaries now download from a mainland-China CDN for faster installs.

本版本重点打磨了免费渠道的体验和日常使用的顺手感。模型选择器重新整理了免费 MiMo 渠道的展示逻辑，触发限流时会弹出 Token Plan 引导；命令面板新增拼音和英文关键词搜索，中文用户不用再切输入法；新工具 notebook-edit 支持直接操作 Jupyter 单元格。Plan 模式进出不再反复刷新工具列表，稳定性明显改善。语音输入现在可以自由指定 ASR 服务商，安装包也迁移到了国内 CDN，下载速度大幅提升。

Features

• tui: rework free MiMo channel presentation — Xiaomi pinned to the top, mimo-auto folded into the Xiaomi group, name-only Recent/Favorites — and add a Token Plan dialog shown once per 24h on rate-limit (#1241)
• tui: search the command palette by English keyword or pinyin (#1135)
• tui: improve provider selection and popular ordering, surfacing Xiaomi first (#1140)
• tui: localized descriptions for built-in slash commands across 7 languages (#1167)
• tool: add notebook-edit tool for Jupyter cell operations (replace/insert/delete), enforce Read-before-Edit for existing files (#1243)
• tool: keep plan_enter/plan_exit present in every mode, eliminating tool-list churn on mode switches (#1207)
• voice: make ASR and control models configurable via voice config (#900)
• compose: configurable docs directory for specs/plans/reports, defaulting to docs/compose (#1238)
• session: sliding-window n-gram repetition detection that stops and recovers runaway repeated output (#1176)
• plugin: session lifecycle hooks with full trajectory serialization (#1165)
• release: publish and install via Xiaomi FDS for faster mainland-China downloads; GitHub releases still available (#1212)
• checkpoint: preserve verbatim recent user input across compactions (#1208)
• workflow: run operation now blocks by default and streams phase/log lines inline (#1202)
• log: add MIMOCODE_DISABLE_LOG_ROTATION to keep a single growing log file (#1119)

Bug Fixes

• tui: add Super+V / Cmd+V paste support, simplify clipboard handling (#1142)
• tui: force full repaint after interactive command resume (#1124)
• tui: restore grey provider name next to model in prompt area (#1143); restore model-selector search box (#932)
• tui: allow navigating into a still-running subagent from its Task block (#1125)
• provider: improve auth-method fallback when a provider advertises no methods (#1186); keep opencode subscription models (#1129)
• provider: fix low prompt-cache hit rate — pin breakpoints to rolling tail + tool-definition breakpoint (#1213)
• session: end final step on a user turn with tools disabled, fixing Bedrock Claude rejection and restoring agent.steps hard cap (#1239)
• session: anchor env date to session-creation time for stable prompt-cache prefixes (#1145)
• tool: accept quoted / <<- heredoc delimiters and rescue JSON-escaped newlines in shell parser (#1235)
• mcp: let local MCP servers initialize regardless of claude-origin config (#1149)
• compose: tighten brainstorm scope check to prevent skill bypass (#1122); de-specialize Claude content and port v6 orchestration improvements (#1198)
• metrics: allow arbitrary event types and raise request timeout to 60s (#1217)
• build: load src/ext modules via generated manifest for release binary (#1190); inject local src/ext overlay in dev (#1210)
• skill: move self-extend out of compose into a standalone builtin skills module (#1214)
• docs: rename opencode → mimocode in upgrade command (#941); update website links (#942)

Security

• Block arbitrary file reads via directory-parameter injection; resolve cwd symlinks before containment check; add hook-level rollback with circuit breaker (#1184)
• Enforce cwd containment unconditionally with defense-in-depth whitelist (#1201)

Internal / CI

• Add test and lint workflows on main+dev (#907); resolve pre-existing test failures (#911); stabilize cancel-shell tests (#1189, #1200); fix CI failures on main (#1196)
• Unify LLM request-header injection (#1034); rename private overlay to ext (#915); build tweaks (#899)

Note: model-dialog full-ID title change (#1169) was reverted before release (#1192).

v0.1.1

MiMoCode v0.1.1