zero/CHANGELOG.md

Changelog

All notable changes to this project are documented in this file.

The format is based on Keep a Changelog, and this project aims to follow Semantic Versioning once the first release is tagged. Until then, source builds report the version dev.

0.1.0 (2026-07-02)

Features

• publish zero to npm via release-please (#367) (8eccc26)
• tui: FILES sidebar panel with click-to-select and file drill-in (#365) (142c548)

Bug Fixes

• auth: propagate credentials to every provider-build surface and pin children to the live provider (#366) (6e0a665)

[Unreleased]

Added

• SECURITY.md with a private vulnerability-reporting path, CODE_OF_CONDUCT.md, this changelog, and GitHub issue/PR templates.
• Interactive /theme picker: bare /theme opens a popup that live-previews each palette as you move and applies on select (Esc reverts).
• Ten built-in color themes alongside the dark/light built-ins — dracula, nord, gruvbox, tokyo-night, catppuccin, one-dark, solarized-dark, rose-pine, everforest, and solarized-light — selectable via /theme <name>, --theme <name>, or ZERO_THEME. Every palette is contrast-audited to WCAG AA. The built-in light theme was reworked for legibility.
• --theme <name> flag for the TUI, accepting auto or any registered theme (previously only the ZERO_THEME env var existed).
• "Accessibility / Appearance" section in the README documenting NO_COLOR, ZERO_THEME, /theme, and ZERO_NO_FADE.

Changed

• Provider connectivity health checks now allow loopback hosts for explicitly user-configured local providers (Ollama / LM Studio), so the keyless local-model path verifies instead of failing with "localhost hosts are blocked". The SSRF guard for fetched/remote URLs is unchanged.
• Auth (401/403) errors now show a curated, actionable message pointing at zero auth / setup; the raw upstream body is shown only under a verbose/debug flag.
• No-provider / missing-key errors now point at zero setup and zero auth, and distinguish a missing key from a rejected key.
• zero doctor no longer reports "Overall: pass" when no provider credential is configured, and formats the missing-language-server list for humans (no raw Go map[...]).
• Raised the faint/faintest theme tokens (and the light-theme accent) to meet WCAG AA contrast for the content they carry.
• NO_COLOR is now honored for any non-empty value, per the no-color.org spec.

Removed

• The inert /input-style slash command (it had no backend).

Fixed

• README/go.mod Go-version mismatch and other stale public-release docs claims.