io-cli 0.18.0

.github/dependabot.yml

@@ -22,19 +22,42 @@ updates:
       patch-updates:
         update-types: ["patch"]
     ignore:
-      # The composer is `tui-textarea` 0.7, and it is built against exactly
-      # ratatui 0.29 and crossterm 0.28. Upstream has published nothing newer
-      # since 2024-10, so bumping either crate puts two crossterm versions in the
-      # tree and the build stops: `Input: From<crossterm::event::KeyEvent>` and
-      # `&TextArea: Widget` both stop resolving. Dependabot raised exactly that
-      # pair and both PRs were closed rather than merged. These two entries are
-      # what keeps it from raising them again every week; delete them the day
-      # tui-textarea publishes a release against the 0.30 line. Both crates are
-      # pre-1.0, so the minor bump is the breaking one — patches still come
+      # The `ratatui` entry that stood here is GONE as of 0.18.0, and the note it
+      # carried is worth keeping because of how it ended. It said the composer was
+      # `tui-textarea` 0.7 built against exactly ratatui 0.29 and crossterm 0.28,
+      # that upstream had published nothing since 2024-10, that bumping either
+      # crate put two crossterm versions in the tree and stopped the build, that
+      # Dependabot had raised exactly that pair and both PRs were closed — and
+      # "delete them the day tui-textarea publishes a release against the 0.30
+      # line."
+      #
+      # It never did. Twenty-two months on, 0.7.0 was still both the newest
+      # release and the state of upstream `main`, and the freeze had acquired a
+      # cost: ratatui 0.29 required `lru ^0.12.0`, and `lru` carried
+      # GHSA-rhfx-m35p-ff5j (Dependabot alert #1) with the fix landing in 0.16.3
+      # and never backported to the 0.12 line. Because tui-textarea required
+      # ratatui through EVERY feature path it had — `no-backend` included —
+      # bumping io-cli's own ratatui would have left both 0.29 and 0.30 in the
+      # graph and closed nothing. So the dependency was removed rather than
+      # bumped: the editing model is `src/editor.rs` now, and ratatui is on 0.30.
+      #
+      # Alert #1 was dismissed as not-reachable rather than fixed by a version,
+      # and the evidence is this: in ratatui 0.29 `lru` backed the layout cache
+      # only (`src/layout/layout.rs:9` and `:31`), and `iter_mut` appears nowhere
+      # under `ratatui-0.29.0/src/layout/` — so `lru::IterMut`, which is the
+      # entire subject of the advisory, was never constructed on any path this
+      # binary could reach. The tree is clean by version now in any case:
+      # `ratatui-core` 0.30 takes a current `lru`, and
+      # `tests/dependencies.rs::n1_the_composer_is_free_and_no_lru_is_in_the_advisorys_range`
+      # fails the build if any `lru` in the lockfile falls inside the range.
+      #
+      # `crossterm` stays pinned, and now for a reason of our own choosing rather
+      # than a dependency's: ratatui 0.30 is taken with the `crossterm_0_28`
+      # feature, so a Dependabot bump of the direct `crossterm` to 0.29 would put
+      # two versions in the tree again. Moving to crossterm 0.29 is a deliberate
+      # change of that feature flag and this entry together, not a bot's to make.
+      # It is pre-1.0, so the minor bump is the breaking one — patches still come
       # through.
-      - dependency-name: ratatui
-        update-types:
-          ["version-update:semver-minor", "version-update:semver-major"]
       - dependency-name: crossterm
         update-types:
           ["version-update:semver-minor", "version-update:semver-major"]

CHANGELOG.md

@@ -6,6 +6,53 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.18.0] - 2026-08-26
+
+Tell it to remember something, and it is still remembered tomorrow.
+
+**`/remember` writes a line into a markdown file you can open, read, edit, diff
+and delete.** The scope is chosen at the moment it is written, because the
+difference between the three is whether it gets committed: `AGENTS.md` for what
+the team should share, `AGENTS.local.md` for what only this checkout should know,
+and `~/.io-cli/IO.md` for what is true of every project. Nothing here is a store
+nobody can inspect — these are files, and io-harness has read `AGENTS.md` since
+its 0.45.0.
+
+**A remembered line takes effect on the next turn, with nothing restarted.** The
+configuration is discovered again for every turn rather than once at startup, so
+an edit you make in your own editor counts too. A file that stops parsing no
+longer ends the session: the last configuration that read cleanly stays in force,
+you are told which file refused and why, and the repaired file is picked up with
+nothing further asked.
+
+**`/memory` shows both memories in one place.** The three instruction files with
+what each holds and — the part no other surface can tell you — **which of them is
+actually being read**. Naming files in `[instructions]` replaces the default
+rather than adding to it, and a named file that does not exist is skipped in
+silence, so a project's own table can quietly displace a wider list and nothing
+warns you. Beside the files sits the durable memory the *agent* wrote for itself:
+every entry with its key, its kind, whether it is pinned, the run and step that
+wrote it, and how many runs have since drawn on it, in both the workspace scope
+and the global one, with the caps named per scope because a run drawing on both
+can carry twice the number a single figure suggests.
+
+**Pin what should survive, forget what should not.** A pinned entry is exempt
+from being overwritten and from being evicted when the cap is reached, which is
+the only lever an operator has over a store the agent otherwise manages alone.
+Forgetting leaves a restore point, so an entry removed by accident can be put
+back; an entry that is pinned reports the refusal and names the pin rather than
+quietly doing nothing. Evictions, refusals and recalls are shown too — they emit
+no event at all and have been happening invisibly since the store gained a cap.
+
+**`tui-textarea` is gone, and with it the last thing holding this product on
+ratatui 0.29.** The composer and the wizard now use an editing model io-cli owns.
+Nothing about typing changes: the multi-line keys, prompt-history recall, the
+wrapped rows, the single block cursor, selection, cut and paste, the masked
+credential field, and undo and redo on `Ctrl+U` and `Ctrl+R` all behave exactly as
+they did, one step per character as before. ratatui moves to 0.30 and crossterm
+stays at 0.28. The dependency that carried a security advisory with no fix
+available for the version in reach is no longer in the tree.
+
 ## [0.17.0] - 2026-08-26
 
 Say something while it works, and have it land.