Auto-claude-code-research-in-sleep (ARIS ⚔️🌙)

Technical Report · ARIS Intro (HTML) · ARIS Intro Slides — VALSE 2026 · AI Agents · Featured on PaperWeekly · Featured in awesome-agent-skills · AI Digital Crew - Project of the Day · GitHub stars · 💬 Join Community · Cite

💡 Use ARIS as a skill-based workflow in Claude Code / Codex CLI / Cursor / Trae / Antigravity / GitHub Copilot CLI / OpenClaw, or get the full experience with the standalone ARIS-Code CLI — enjoy any way you like!

🌱 ARIS is a methodology, not a platform. What matters is the research workflow — take it wherever you go.

🤖 AI agents: Read AGENT_GUIDE.md instead — structured for LLM consumption, not human browsing.

🛡️ ARIS audits its own output → now Anti-Autoresearch audits everyone's. It catalogs 46 integrity hack-patterns across 8 families (A–H), plus 13 zero-verdict-weight AI-style impressions and 2 advisory signals — 61 signals total — and checks a submission for them end-to-end, producing a deterministic, reviewer-ready integrity report. Self-consistency + fabrication forensics, not an AI-text detector.

🎬 ARIS goes multimodal → ARIS-Movie-Director — hand it a rough story and get back a movie told in still frames, checked scene by scene (the reference run has 19 scenes). Long stories usually break when the model forgets earlier details or judges its own work — so ARIS keeps a research-wiki for memory and has other models check every frame.

🧭 The same loop also makes clean method / flow diagrams — the figure above was made with it. Entry points in ARIS-Movie-Director: /movie-pipeline and /method-figure, the skill that made this figure.

🎯 准备 2026 AI 秋招？ → 🌐 ARIS-in-AI-Offer · GitHub repo · 中文 README —— 23 篇双语 ML / LLM / 多模态 / 生成式 / Agent 面试 cheat sheet，每篇 = 公式推导 + 从零 PyTorch + 25 高频面试题（L1 / L2 / L3），全部由 ARIS 的 /render-html 自动生成。希望大家秋招轻松一点 🌱

📝 Three long-form blogs, cross-model collaborative writing via /render-html — Continuous DLM — a representation-perspective survey (2026 H1) · Cosmos 3 — understanding + generation in one Transformer (MoT) · Diffusion × representation × manifold learning.

🛰 Keep an eye on your agent windows — Claude Fleet (by @tianyilt; local read-only dashboard for many parallel Claude Code / Codex windows, full-text transcript search — worth a ⭐), or the lighter built-in ARIS-Monitor (a tiny always-on-top macOS widget that lights up 🔴 when a session waits for your approval; click to jump there).

ARIS-Monitor — built-in, no clone / no pip / no browser:

cd aris-monitor && ./run.sh
# a borderless panel floats top-right; click a row to jump to that terminal

Claude Fleet — full web dashboard:

git clone https://github.com/tianyilt/claude-fleet
cd claude-fleet && bash run.sh
# open http://127.0.0.1:7878 in your browser

🚀 Beyond 科研 → 任何 "研究"：ARIS-Anything 把 ARIS 的五步 loop（plan / draft / 对抗审 / 迭代 / 持久化）推广到非学术的结构化研究——投资尽调 / 法律研究 / 市场研究 / 自驱学习 / 调查新闻 / 工程复盘等。

🔥 ARIS-Code CLI — 独立安装版 · English | ⬇️ Download · Downloads

📰 ARIS-Code v0.4.21 (2026-06) — latest is a bug-fix patch (5 user-facing fixes from a Codex hunt: streamed CJK/emoji text no longer corrupts to � on OpenAI-compatible providers, a saved executor config no longer overrides a shell EXECUTOR_PROVIDER, truncated streams no longer save as complete, cross-line grep_search, MCP structuredContent). Headline features: v0.4.18 — default model Claude Opus 4.8 (corrected pricing + availability fallback) and v0.4.17 — the MCP release (mcpServers drive real tool dispatch; cross-model review needs no OpenAI API key — aris setup wires your ChatGPT subscription in as reviewer via Codex MCP). Caps a 17-release run (v0.4.5 → v0.4.21); per-release detail below. Credits: @GetIT-Sunday, @Anduin9527, @GO-player-hhy, @Jxy-yxJ, @screw-44, @StevenUST, @opposj, @ShijunLei-cn, @algojogacor.

v0.4.21 (2026-06-28) — bug-fix patch: 5 new user-facing bugs from a Codex adversarial hunt (all disk-verified, distinct from v0.4.20), each cross-model reviewed at a design gate and an implementation gate (gpt-5.5 xhigh; both started NO-GO — the reviewer caught an off-by-one in the grep line-mapping and a missing stream-level test before GO). 🐛 Headline: OpenAI-compatible streaming corrupted multi-byte UTF-8 (CJK / emoji) split across network chunks into � — each HTTP body chunk was from_utf8_lossy'd independently, so a 3-byte Chinese character or 4-byte emoji straddling a chunk boundary broke on both sides (a frequent hit for Chinese users on domestic OpenAI-compatible providers — Kimi/GLM/MiniMax/DeepSeek/Qwen/Doubao — streaming Chinese text); the stream buffer is now raw bytes, decoding only complete SSE lines. A saved OpenAI/custom executor config no longer overrides a shell-set EXECUTOR_PROVIDER — the startup "shell-provided vars win" path had one ungated write that re-pointed EXECUTOR_PROVIDER=anthropic … aris … to OpenAI (wrong executor / model-not-found). An Anthropic stream truncated after content but before a terminal signal now hard-errors (premature_eof) instead of saving a half-finished answer to history as a complete turn (symmetric to the OpenAI #249 guard; the stop_reason-only compat path is preserved, and ARIS_ALLOW_EOF_WITHOUT_STOP=1 opts a terminal-signal-less proxy back into the old behavior). grep_search with multiline: true now matches across lines in content mode (was silently empty — count mode already worked). MCP tool results carried only in structuredContent (empty content) are no longer dropped — the model gets the JSON structured payload. Tests (CI mode): api 32→35 / runtime 205→212 / tools 67 / aris-cli 172→181 / commands 5 (+21, incl. 2 stream-level integration tests), all green. Codex MCP (gpt-5.5 xhigh): design gate (NO-GO → GO after fixing the off-by-one) → implementation gate (NO-GO → GO after adding the stream-level integration tests); the Anthropic streaming spec (every stream ends with message_stop) was WebFetch-verified. Two latent-only candidates (Anthropic block-index routing, OpenAI multi-line SSE) remain deferred.

v0.4.20 (2026-06-19) — bug-fix patch: 7 user-facing bugs surfaced by a Codex adversarial hunt, each reviewed across 3 rounds (the reviewer caught a redraw gap, a trailing-blank, a spinner tail, and a blank-line edge before GO). 🐛 Headline (#299): short REPL replies showed only "✔ Done" — the spinner draws "⠋ Thinking…" with Save/RestorePosition so streamed output overwrites it on the same line, but finish then cleared that whole line, erasing a short single-line reply. The REPL now finishes without clearing when the turn printed visible text (Clear(UntilNewLine) wipes only the spinner tail after the reply). Streamed multi-paragraph replies rendered glued ("para1para2") — each chunk's paragraph separator was trimmed at the stream boundary; the markdown streamer now preserves separators via a held-separator so streamed output equals a single full render (no dangling blank line). Markdown tables with CJK/fullwidth content misaligned — width now counts display cells (CJK = 2), not chars. aris "prompt" / --print ignored the executor model saved by aris setup (REPL-only before) — a configured OpenAI/custom executor got the Anthropic default sent to its endpoint; the one-shot and REPL paths now share one resolver. Esc now actually closes the completion dropdown (it was recomputed right back). glob_search reports the total matched count when truncated (not the capped 100, which made the model think a 1000-match glob had 100 files). /model's custom menu reads the effective env the executor uses, not stale on-disk config. Tests (CI mode): api 32 / runtime 205 / tools 67 / aris-cli 172 / commands 5, all green; +7 new; real-machine verified (short reply renders + "✔ Done"; paragraphs keep their blank lines). Codex MCP (gpt-5.5 xhigh): hunt → 3 review rounds (NO-GO → NO-GO → GO). Two latent-only candidates (Anthropic block-index routing, OpenAI multi-line SSE) deferred to a hardening pass.

v0.4.19 (2026-06-14) — honesty / guardrails patch (theme from a Codex fresh-eyes audit; no behavior change for healthy setups). 🔴 MCP protocol-version negotiation guard — the stdio handshake requested 2025-03-26 but never read the version the server negotiated back (a parsed-but-dead field), so a server agreeing on a version ARIS can't speak was silently accepted and later tools/list / tools/call ran on an incompatible protocol with opaque failures. ARIS now validates the negotiated version against a supported set (2025-11-25 / 2025-06-18 / 2025-03-26 / 2024-11-05 — stdio framing is identical across these) and, on an unsupported one, terminates the child + clears the slot + surfaces a clear per-server error (aris doctor shows it) — the "terminate when versions can't be agreed" behavior the MCP lifecycle spec requires. The request stays 2025-03-26 (proven against codex mcp-server), so healthy servers are unaffected — verified end-to-end: the real Codex MCP server still spawns + initializes + advertises its tools under the guard. 🧹 Papercuts: the OpenAI-family subagent fail-loud message dropped its stale "lands in v0.4.18" marker (now version-agnostic + actionable, still credential-free); OpenAI upstream error bodies are now truncated (500 chars) + credential-redacted (sk-… keys and Bearer … tokens, via a substring scanner that catches the compact-JSON shape {"api_key":"sk-…"} a misconfigured proxy can reflect back) instead of splatted verbatim; the system-prompt hook-events summary now counts only the hooks the runtime actually executes (a command hook with a command string), matching the parser. Tests (CI mode): api 32 / runtime 204 / tools 67 / aris-cli 167 / commands 5, all green; live smoke confirms the real Codex MCP server still initializes under the guard. Reviewed by Codex MCP (gpt-5.5 xhigh): design GO → impl NO-GO (compact-secret miss + command-string strictness) → GO after fixes.

v0.4.18 (2026-06-14) — default model → Claude Opus 4.8, with corrected pricing and a safety net. The bump moves DEFAULT_MODEL, the opus alias, the model picker, aris setup, and the subagent default to claude-opus-4-8 — with an availability fallback: if the account lacks 4.8 (the API returns 404 not_found_error), ARIS auto-falls-back to claude-opus-4-7 for the session, rebuilds the system-prompt model identity so it stays coherent (the model is never told it's 4.8 while served 4.7), warns once, and retries — for the main session (text + JSON) and subagents. It fires only on that precise 404 (never 400/rate-limit/auth), latches against loops, and the text path rebuilds from a pre-turn snapshot so a retry never double-appends the user message; accounts with 4.8 are byte-identical to a plain bump. 💰 Pricing corrected (verified against Anthropic's published schedule; had been a 3–5× over-estimate): current Opus 4.5–4.8 = $5/$25 (deprecated Opus 4/4.1 keep $15/$75, split by word-boundary so a future opus-4-10 isn't mis-tiered); Sonnet 4.x = $3/$15 (decoupled from the generic unknown-model fallback, which stays $15/$75); Haiku was already correct. 🧹 Backlog: aris setup option 10 pins the Codex MCP reviewer to model_reasoning_effort="xhigh" (deterministic for new setups, independent of ~/.codex/config.toml; idempotent merge never clobbers an existing entry); a startup + aris doctor misconfig hint (#259) for a silently-ignored/misplaced config (malformed JSON, or a stray ~/.aris/config.yaml — stderr-only so --print/JSON stdout stays clean); the system-prompt hook summary now marks parsed-but-never-fired events "PARSED ONLY … will NOT run" instead of implying dead hooks run (full event expansion — actually firing SessionStart/SessionEnd/… — deferred to a separate issue). Tests (CI mode): api 32 / runtime 202 / tools 67 / aris-cli 166 / commands 5, all green; a live one-shot smoke returns model=claude-opus-4-8 end-to-end. Reviewed by Codex MCP (gpt-5.5 xhigh) across the design + both implementation batches (design REWORK→GO, impl NO-GO→GO, batch-2 GO).

v0.4.17 (2026-06-13) — the MCP release. Before v0.4.17, mcpServers in settings.json parsed, showed in aris doctor, and did nothing; now ARIS spawns each configured stdio server, runs the MCP handshake, discovers tools, and advertises them as mcp__<server>__<tool> on both provider paths (Anthropic + OpenAI-family), with end-to-end dispatch, soft per-server degradation, and an approval gate for untrusted MCP tools (external processes the sandbox can't cover; --allowedTools now accepts mcp__ names). 🆕 zero-API-key cross-model reviewer: aris setup → option 10 (Codex MCP, ChatGPT subscription, no API key) writes an idempotent mcpServers.codex entry into the settings file the runtime actually reads (atomic write + backup, explicit consent before trust: true), with an optional API reviewer as fallback (ARIS_REVIEWER_PROVIDER=codex-mcp + ARIS_REVIEWER_FALLBACK_PROVIDER); /setup in-REPL rebuilds the system prompt + runtime so reviewer changes take effect without quitting. 🔴 Protocol fix the fakes couldn't catch: real-machine e2e against codex mcp-server exposed that our stdio transport spoke LSP-style Content-Length: framing while the MCP spec (and codex) use newline-delimited JSON-RPC — every fake-server test passed because the fakes spoke the same wrong dialect; writes are now NDJSON, reads auto-detect both, and the spec-mandated notifications/initialized is sent after initialize (a select-based round-trip also closes the #286 large-request deadlock). Hooks: object-style Claude Code hooks preserve matcher / timeout / async (anchored-regex matcher filtering; per-hook timeout, default 30 s kill = warning not deny). Long tail: ARIS_DISABLE_KEYCHAIN gate, Anthropic stop_reason clean-EOF symmetry (CL2), OpenAI tool-call index-missing merge-by-id (OE6), slash commands enter history. Real-machine push-gate hardening (the zero-key reviewer's first run): codex codex/event notification spam silenced by default (gated behind ARIS_MCP_STDERR=inherit), the system prompt now tells the model not to pass a model parameter to Codex (account default = gpt-5.5 + xhigh; arbitrary names are rejected by a ChatGPT account), and a Codex-MCP-primary-with-no-fallback LlmReview call returns a clear "use mcp__codex__codex" message instead of a misleading OPENAI_API_KEY/gpt-5.5 error. Built with the v0.4.16 zero-regression methodology (24 new characterization tests; every deliberate flip annotated in-place). Tests (CI mode): runtime 199 / aris-cli 165 / tools 67 / api 30 / commands 5, all green. Reviewed phase-by-phase by Codex MCP (gpt-5.5 xhigh) across 17 rounds (7 NO-GOs all resolved). Subagent MCP routing (P8) + MCP protocolVersion bump + hook async execution deferred to v0.4.18.

v0.4.16 (2026-05-30) — REPL UX + provider hardening, shipped under a zero-regression discipline: 64 characterization ("golden") tests locked the current provider-routing / pricing / reviewer / subagent / REPL behavior first, then stayed green through every change. Closes #274: command history now persists to ~/.config/aris/history (0600) and reloads on startup, with an ARIS_NO_HISTORY kill-switch and a disk-only secret-skip (credential-looking lines stay in in-session history but never touch disk); bash-style Ctrl+R reverse incremental search (CJK display-width-aware single-line render; no existing key binding changed; no new dependency). Security: an OpenAI-family main session (Kimi / GLM / MiniMax / …) spawning a subagent previously silently billed the user's Anthropic OAuth/Keychain credential — it now fails loud with a clear, credential-free error; full OpenAI-family subagent routing is a cross-crate change deferred to v0.4.17. Groundwork (no behavior change): the 3 byte-identical word-boundary matchers consolidate into one canonical runtime::word_match; new pure ProviderFamily classifier (unwired). Tests (CI mode): runtime 164 / aris-cli 128 / tools 49 / commands 5, all green. Codex MCP (gpt-5.5 xhigh) reviewed each phase + a final integration pass.

v0.4.15 (2026-05-29) — OpenAI-compatible streaming robustness hotfix. Closes #249: MiniMax (and other OpenAI-compatible providers / proxies) were effectively unusable because the clean-EOF completion check treated the data: [DONE] SSE sentinel as the only authoritative signal. A non-empty choices[].finish_reason is the Chat Completions spec's terminal-chunk marker; [DONE] is a transport convention some compatible providers never emit (MiniMax sends finish_reason: "stop" then closes without [DONE]). The clean-EOF decision is now a pure, unit-tested stream_eof_action(...) that completes on EITHER [DONE] OR a non-empty finish_reason; reads are NOT stopped early at finish_reason (a trailing include_usage usage-only chunk is still consumed), genuine truncation still hard-errors, and a pre-output proxy abort still restarts. Coupled fixes: OE7 reads finish_reason before the delta guard (delta-less terminal choice); OE2 flushes pending tool calls on any non-empty finish_reason; OE4 surfaces a mid-stream error envelope as a hard error instead of silently dropping it; OE3 tolerates data:{...} without the space after the colon. +5 unit tests (77→82) extract the previously-untested SSE completion logic into pure helpers. Anthropic SSE path untouched. Codex MCP (gpt-5.5 xhigh) 3 rounds (GO-WITH-NITS → GO-WITH-NITS → GO).

v0.4.14 (2026-05-25) — Security-hygiene release closing the top items from the v0.4.13 codex audit (gpt-5.5 xhigh, 6/10 NEEDS-REWORK verdict). 🔴 S9 (P0) system-prompt config redaction — before v0.4.14, render_config_section() dumped the merged settings.json verbatim into the system prompt sent to the LLM provider, leaking env, mcpServers.<name>.headers.Authorization Bearer tokens, hook command env, signed-URL query params, and apiKey fields. New renderer whitelists top-level fields (model/permissionMode/theme/outputStyle/permissions/sandbox with recursive redaction inside), redacts sensitive keys (apikey/token/secret/password/authorization/headers/env/_KEY/_SECRET/_TOKEN), replaces MCP command with <configured> placeholder, reduces MCP url to strict <scheme://host[:port]> origin (scheme allow-list http/https/ws/wss, ASCII host, digit-only port, IPv6 brackets), and drops hook command strings entirely. Regression test exercises 9 distinct leak surfaces; URL parser has its own targeted test for 7 smuggling attempts including port-position secret injection (codex round-3 catch). 🟡 P9 (P1): DeepSeek aris --help now points at aris setup option 7 instead of an env-var path the resolver never honored. 🟡 M1/M2 (P1) doc: aris doctor + README/README_CN gain experimental warning whenever mcpServers.len() > 0 (full MCP tool dispatch lands v0.4.16). 🟢 C11 (P2) stream idle timeout — both Anthropic MessageStream and the OpenAI SSE loop wrap response.chunk().await in tokio::time::timeout (env ARIS_STREAM_IDLE_TIMEOUT_SECS, default 120, clamp [10, 1800], 0/negative disables); closes the "aris hangs forever with no output" symptom when an upstream HTTPS proxy holds a connection without keepalives. Bundle: 77 skills (+1 /wiki-enrich via late same-day sync to main 7e3ab67 which also picks up upstream check_ready.sh awk + grep-c null-match fix), 54 helpers. Codex MCP 6 rounds (NO-GO + 4 → GO-WITH-NITS + 3 → NO-GO + port smuggling → GO → release metadata GO → sync GO).

v0.4.13 (2026-05-25) — Residue-cleanup release closing every codex audit P1 carried since v0.4.10–v0.4.12, plus the long-tail regression tests. 🟡 v0.4.10 P1.D per-server MCP timeout — mcpServers.<name>.requestTimeoutSecs override > MCP_REQUEST_TIMEOUT_SECS env > 300s default (clamped 1..=1800), so one Codex MCP agent can run 5 min while filesystem MCP errors in 5 s. 🟡 v0.4.10 known limitation closed — McpStdioProcess::request() skips JSON-RPC notifications (id absent/null) and keeps reading until the correlated response. 🟢 meta_opt hook deploy via aris init — tools/meta_opt/{log_event,check_ready}.sh bundle into the binary; aris init writes ARIS-namespaced aris-meta-opt-log-event.sh / aris-meta-opt-check-ready.sh to ~/.claude/hooks/ (codex round-1 #1: never clobbers user hooks); settings.json merge idempotent, backups hard-fail, final rewrite atomic via tempfile + rename. 🧪 9 v0.4.12 targeted regression tests for sandbox.strictMode (3) + parse strictMode + provider_match pricing + has_word o-series + stream_options 400 + meaningful-content classification + premature-EOF retry truth table (codex round-1 #3 — should_retry_on_premature_eof() extracted to pure fn, 7-row test). Bundle: 76 skills, 54 helpers (+2 meta_opt scripts vs v0.4.12). Codex 3 rounds (NO-GO + 3 → NO-GO + metadata → GO).

v0.4.12 (2026-05-22) — Bug-fix + small-feature release. #238 sandbox.strictMode opt-in config key; when set, SandboxConfig::resolve_request() ignores all five LLM-supplied overrides (dangerouslyDisableSandbox, namespaceRestrictions, isolateNetwork, filesystemMode, allowedMounts) — closes the gap where a tool call could silently bypass user sandbox policy. aris doctor adds a "Sandbox:" row; bash tool schema documents the strictMode semantics. #232 auto-review-loop-llm updated from legacy deepseek-chat / deepseek-reasoner (deprecate 2026-07-24; reasoner rejects tool_choice) to deepseek-v4-flash / deepseek-v4-pro. v0.4.10 audit P1 follow-ups: P1.A Anthropic stream retry gates on has_emitted_meaningful_content (a stream that only sent MessageStart before EOF is retry-eligible); P1.B supports_reasoning_effort + reviewer mirror use word-boundary match so openai/o3-mini / proxy:o4 route correctly; P1.C stream_options.include_usage:true proxy fallback retries once without on real 400 unknown-field errors; P2 pricing match precision via provider_match() so qwen3.6-plus / kimi-k2.5 route correctly while my-kimi-clone does not. Skills sync (76 skills, 52 helpers): /interview-cheatsheet + /render-html newly bundled; build.rs ALLOWED_EXTS gains html for render-html templates; EXCLUDED_SKILL_PREFIXES → starts_with("skills-codex"). CI fetch-depth: 0 + origin/main fetch so drift-test ancestor check runs. Cross-reviewed by Codex MCP (gpt-5.5 xhigh) over 4 rounds.

v0.4.11 (2026-05-18) — Skills bundle refresh + sync infrastructure. The embedded skills set in the v0.4.10 binary had fallen behind main (~6 of 56 main skills/ commits had been cherry-picked); v0.4.11 syncs the full set and ships sync infrastructure so the gap can't silently reopen. Bundle: 65→74 user-facing skills, 34→49 helper resources. 10 new skills bundled: /citation-audit (fourth-layer bibliography audit), /experiment-queue (SSH multi-seed job queue with OOM retry), /kill-argument (two-thread adversarial review for theory papers), /resubmit-pipeline (W5: text-only port to a new venue), /paper-talk (end-to-end conference talk pipeline), /slides-polish (per-page Codex layout review), /overleaf-sync (two-way Overleaf Git-bridge), /gemini-search + /openalex (broader literature sources), /qzcli (Qizhi GPU jobs). 46 existing SKILL.md refreshed — most critically the canonical resolver chain rollout (closes real user incident where /research-wiki was empty for a week from hardcoded tools/research_wiki.py), submission assurance gate + external verifier (/paper-writing Phase 6 now functions). tools/ goes 9→18: 9 baseline helpers refreshed (research_wiki.py 315→767 lines with canonical ingest_paper API), 9 new helpers (extract_paper_style.py, figure_renderer.py, paper_illustration_image2.py, overleaf_{setup,audit}.sh, verify_wiki_coverage.sh, watchdog.py, experiment_queue/{build_manifest,queue_manager}.py). New tools/sync_main_skills.sh automates main → bundle rsync with symlink pre-flight + codex-mirror prune + SKILLS_SOURCE_COMMIT pinning. 3 new CI drift tests in crates/runtime/src/cache.rs cover all 4 resolver layer patterns. Gemini MCP calls in /research-lit and /gemini-search now pass model: 'auto-gemini-3' (avoids silent downgrade to 2.5-pro on OAuth-personal capacity exhaustion). CLI runtime unchanged — codex-audit P1 follow-ups remain on v0.4.12 backlog. Cross-reviewed by Codex MCP (gpt-5.5 xhigh) across 5 rounds (REQUEST CHANGES → APPROVE WITH NITS → NO-GO → GO → final GO).

v0.4.10 (2026-05-17) — Stream + MCP reliability + multi-provider pricing. C6 whole-stream restart in Anthropic MessageStream + OpenAI SSE loop on chunk decode failure / premature EOF (ARIS_STREAM_RETRY, default 2, clamp 0..=5, fires only when nothing emitted yet — closes #228-style "error decoding response body" loop). M3 MCP stdio gains 300s default tokio::time::timeout over send+read (override MCP_REQUEST_TIMEOUT_SECS, clamp 1..=1800); response.id ↔ request.id correlation; ensure_server_ready() try_wait() dead-process respawn; kill().await on all failure paths so the next call starts clean (closes #151 / #172 "Calling codex..." stalls). C8/P4 OpenAI streaming requests now send stream_options.include_usage:true + parse cached_tokens; Anthropic streaming merges MessageStart.usage (input/cache) with MessageDelta.usage (output). C9 multi-provider pricing registry (15+ models, OpenAI cache_read = input × 0.1 corrects 5× generic overstatement, DeepSeek cache_hit/cache_miss tiers, has_word() boundary matcher for provider/<model> slugs). 9 dead-code warnings cleared; aris setup help text synced with actual behaviour.

v0.4.9 (2026-05-17) — Closes Codex v0.4.7 audit residuals (L1 TLS double-stack, L3 reasoning_cache compaction misalign, L4 reasoning replay unbounded). 2 new skills bundled (/figure-spec + /paper-illustration-image2 with scripts/ subdirs, new Layer 0b = $ARIS_CACHE_DIR/skills/<name>/scripts/); research_wiki.py promoted to shared tools/ (9+ callers); 5 more SKILL.md migrated to fallback chain.

v0.4.8 (2026-05-17) — Skill helper subsystem rewrite. Bundled helpers extract to ~/.config/aris/cache/<version>/ at startup; every Skill invocation surfaces helperReport JSON + 4-layer resolver preamble; /skills export copies helpers; new integration-contract.md with 6 failure policies; 8 shared helpers (arxiv/deepxiv/exa/S2/openalex/save_trace/verify_papers/verify_paper_audits) bundled; /research-lit + /deepxiv migrated. Plus 4 bug fixes: gpt-5.5+tools 400 on OpenAI; Custom reviewer reset; missing signature field (#228); --version Build date hardcoded.

v0.4.7 (2026-05-16) — DashScope Coding Plan 405 fixed (#159) via native-tls switch (#225); reasoning_content replay for all reasoning models (OpenAI o1/o3/o4 / DeepSeek-R1 etc.), not just Kimi (#226); 600+ lines dead code cleanup + rustyline dep removed + "Claw Code" → "ARIS-Code" rebrand.

v0.4.6 (2026-05-14) — 🚨 Two long-standing silent bugs fixed: PermissionMode::Prompt silently allowed every tool (derived-Ord bug); system prompt hardcoded current_date = "2026-03-31" made models reject post-cutoff data as future/prompt-injection. Plus Custom OpenAI-compatible provider (/setup option 11) with dynamic /models discovery (@Anduin9527 #221 + #222).

v0.4.5 (2026-05-13) — First-class reasoning-model support: thinking content blocks end-to-end (fixes #161) + reasoning_effort='xhigh' for GPT-5.5 / o1 / o3 / o4 / DeepSeek-thinking. DeepSeek V4 Pro + Xiaomi MiMo + Qwen 3.6 + Doubao in /setup (options 7-10). Object-style hooks parser. Default model bumped to Claude Opus 4.7 + GPT-5.5. REPL input hardening (multi-line wrap / Cmd+V paste / CJK boundary). GitHub Actions CI. Credits: @GO-player-hhy (#186), @Jxy-yxJ (#171), @GetIT-Sunday (#216 partial).

v0.4.4 (2026-04-20) — Setup UX + reviewer routing fixes (resolves #158, #162) | /setup no longer forces Bearer for Anthropic + custom URL | Provider-aware proxy URL hints | Stale state no longer leaks across provider switches | LlmReview smart fallback

v0.4.3 (2026-04-17) — Third-party Anthropic-compat proxy support (Bedrock etc.) | Skip beta flags that proxies reject | Propagate custom base URL for anthropic provider | Credit @screw-44

v0.4.2 (2026-04-17) — Auto-compaction corruption fix | Compaction summary preserved on OpenAI-compat executors | Shell-provided API keys no longer erased on launch

v0.4.1 (2026-04-15) — Plan mode (/plan) | Cooperative Ctrl+C interrupt | Auto-retry (429/5xx/network) | Research Wiki 📚 (persistent knowledge base) | Self-Evolution 🧬 (/meta-optimize) | Local models (LM Studio/Ollama) | 62 skills synced

v0.3.11 (2026-04-13) — Reviewer Anthropic-compatible mode (Claude via proxy)

v0.3.9 (2026-04-11) — Proxy/custom base URL (CCSwitch) | Local models (LM Studio/Ollama) | Windows (experimental)

v0.3.5 (2026-04-08) — Research Wiki (persistent papers/ideas/experiments/claims + relationship graph) | Meta-Optimize self-evolution (analyze logs → propose SKILL.md patches)

v0.3.0 (2026-04-03) — Multi-file memory index | Rich task system (TodoWrite) | /plan | Security hardening

v0.2.2 (2026-04-03) — /plan step-by-step planning | /tasks persistent tracking

v0.2.1 (2026-04-03) — Persistent Memory | Kimi K2.5 multi-turn fix | CJK cursor fix

v0.2.0 (2026-04-02) — Open source | Kimi + MiniMax + GLM support | Smart LlmReview routing | CI/CD

v0.1.0 (2026-04-02) — Initial release | Multi-executor & reviewer | 42 bundled skills