• [new] Auth emits auth cached_token check (has_current, is_devbox, is_expired, is_legacy) and auth init user_info check (key_prefix, needs_user_info, rt_prefix, user_id).
• [new] Default auth method priority: cached_token overrides xai.api_key for default_auth_method_id; cached_token handler sets api_key (SessionToken).
• [new] Model catalog notifies clients (current_model_id, model_count) instead of emitting fetch/refresh-failure events.
• [new] Shell surfaces shell.tool.exec_done (elapsed_ms, success, tool_name) and shell.turn.inference_done (attempts, elapsed_since_turn_start_ms, itl_p50_ms, loop_index, model_elapsed_ms, ttft_ms).
• [new] Per-session artifacts: sessions/{workspace}/{session}/resources_state.json, sessions/{workspace}/{session}/signals.json.
• [new] Home layout includes bundled/ with agents (explore, general-purpose, plan), personas, roles, skills (build-with-ai, design, execute-plan + validate script, implement + memory script/tests, pr-babysit, resume-* variants, review, shared resume-session), and manifest.json.
• [removed] Auth lock acquire/attempt events and on-disk auth.json.lock.
• [removed] Auth recovery (disk token expired, refresh-from-authority failed), permanent-failure set/refresh, prepare_sampling_config-without-session-key, refresh_chain short-circuit, and token-expired silent-refresh-failed reauth required.
• [removed] OIDC refresh enter/attempting-idp / try_refresh_pure enter and terminal-error events.
• [removed] auth 401 attribution, model catalog: fetching, model catalog refresh failed.
• [removed] shell.turn.inference_failed and turn.terminal_failure.