Release v0.3.0

[madebyaris]

Summary

Release v0.3.0 from dev to main, covering all work since v0.2.0.

New features

• Skills system — nca skills CLI for discovering, installing, and managing skills; invoke_skill tool for agent-side skill invocation
• Question modal picker — arrow-key navigable structured question UI in the TUI
• Enhanced search and edit tools — search_code returns structured JSON results; replace_match for coordinate-targeted edits; edit_file/apply_patch fail loudly on ambiguous matches
• Advanced busy indicator — animated state-aware indicator (thinking, streaming, tool execution)
• User event preview and at-mention handling — file mention chips, inline preview compaction
• Wildcard allow command — Ctrl+U always-allow for tool approval patterns
• Cancel during process — Ctrl+C / /stop cancels the current running turn mid-stream
• Comprehensive documentation — 10-page user-facing docs covering getting started, commands, interactive mode, configuration, providers, tools, sessions, permissions, skills, and advanced topics

Fixes

• Prevent tool_use/tool_result desync during context truncation
• Consecutive tool failure circuit breaker (stops infinite retry loops)
• Improved cancel responsiveness with 25ms polling via tokio::select!

Chores

• Version bump from 0.2.0 to 0.3.0 across all crates and install script
• README build target table corrected to match release workflow (3 targets)
• CI/release workflows updated for multi-branch support

Pre-merge checks

• cargo build --release — compiles cleanly
• cargo clippy --all-targets — zero warnings
• cargo test — all 184 tests pass
• cargo fmt --check — clean
• Version set to 0.3.0 in workspace Cargo.toml, Cargo.lock, and install.sh

Made with Cursor

---

Summary by cubic

Release v0.3.0 with a new skills system, safer search/edit tooling, and major TUI improvements. This release also adds cancel-in-progress, improves reliability, and ships comprehensive docs.

• New Features

  • Skills system: nca skills CLI (list/add/remove/update) and invoke_skill tool; inlines referenced files and loads from .nca/skills and .claude/skills.
  • TUI upgrades: question modal picker (arrow-key), file at-mention chips with compact previews, animated busy indicator (thinking/streaming/tool/approval), and cancel mid-turn (Esc/Ctrl+C//stop).
  • Safer search/edit workflow: search_code returns structured JSON matches; replace_match enables precise edits; edit_file/apply_patch reject ambiguous replacements; query_symbols uses literal symbol search.
  • Permissions & docs: session-scoped wildcard “always allow” via Ctrl+U; new user docs (getting started, commands, configuration, providers, tools, sessions, permissions, skills, advanced); README build targets corrected; CI/release workflows support multi-branch and install ripgrep.

• Bug Fixes

  • Prevent tool_use/tool_result desync during context compaction.
  • Stop infinite tool retries with a 3-failure circuit breaker.
  • Faster cancellation responsiveness with 25ms tokio::select! polling.
  • Harden skill invocation against path traversal and stale session tagging.

^{Written for commit 0a23e33. Summary will update on new commits.}

[cubic-dev-ai]

16 issues found across 56 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/plans/file-mention-preview-compaction.md">

<violation number="1" location="docs/plans/file-mention-preview-compaction.md:9">
P3: Malformed backtick formatting makes the fence example render incorrectly and unclear. Use a valid inline code span for the fence example.</violation>
</file>

<file name="crates/core/src/skills.rs">

<violation number="1" location="crates/core/src/skills.rs:475">
P1: The new AGENTS.md-skip heuristic in `resolve_skill_reference` is incorrect, so Level 2/3 fallback can resolve files outside the workspace root.</violation>
</file>

<file name="crates/core/src/tools/replace_match.rs">

<violation number="1" location="crates/core/src/tools/replace_match.rs:170">
P2: Reject columns that point past the end of the line body. With the current `>` check, `column == body.len() + 1` is accepted and can replace across the newline, which violates the "column starts within the line" contract.</violation>
</file>

<file name="crates/core/src/skill_installer.rs">

<violation number="1" location="crates/core/src/skill_installer.rs:52">
P2: Valid GitHub shorthand repos with `.` in the repo name are incorrectly rejected.</violation>

<violation number="2" location="crates/core/src/skill_installer.rs:234">
P1: Recursive copy follows directory symlinks without validation, which can traverse outside the source tree or recurse through cycles.</violation>
</file>

<file name="crates/common/src/message.rs">

<violation number="1" location="crates/common/src/message.rs:203">
P2: File-block compaction can stop at an internal code fence, so previews are malformed for files that contain ``` inside their contents.</violation>
</file>

<file name="crates/core/src/agent.rs">

<violation number="1" location="crates/core/src/agent.rs:137">
P2: Busy state can remain non-idle on error/cancel paths because Idle is only emitted on the success return path.</violation>
</file>

<file name="docs/documentation/sessions.md">

<violation number="1" location="docs/documentation/sessions.md:22">
P2: Session status value is documented as `failed`, but persisted JSON uses `error`. This can break automation that relies on the documented status string.</violation>

<violation number="2" location="docs/documentation/sessions.md:200">
P2: `auto_compact_on_finish` is documented under `[session]`, but runtime compaction behavior is keyed off `[memory].auto_compact_on_finish`. Users may configure the documented key and get no compaction.</violation>
</file>

<file name="docs/documentation/providers.md">

<violation number="1" location="docs/documentation/providers.md:9">
P2: The MiniMax default model/alias entries document `MiniMax-M2.7`, but the code defaults and built-in aliases are `MiniMax-M2.5`. Update the provider docs to match the actual defaults so users don’t configure the wrong model.</violation>
</file>

<file name="docs/superpowers/plans/2026-03-24-skill-supporting-files.md">

<violation number="1" location="docs/superpowers/plans/2026-03-24-skill-supporting-files.md:506">
P3: The expected test count is incorrect here; this task defines 5 `expanded_body` tests, not 4.</violation>

<violation number="2" location="docs/superpowers/plans/2026-03-24-skill-supporting-files.md:585">
P2: Use portable paths in verification commands; hardcoded absolute local paths make the plan fail for other developers.</violation>
</file>

<file name=".github/workflows/release.yml">

<violation number="1" location=".github/workflows/release.yml:7">
P1: The PR trigger is missing `types: [closed]`, so merged PRs won’t reliably satisfy the `pull_request.merged` gate and release jobs can be skipped.</violation>
</file>

<file name="crates/cli/src/main.rs">

<violation number="1" location="crates/cli/src/main.rs:1418">
P2: `skills update` will skip skills whose original directory name needed sanitization because the update path matches raw repo names against sanitized lock keys. Match against sanitized names to ensure updates work for those skills.</violation>
</file>

<file name="crates/core/src/tools/search.rs">

<violation number="1" location="crates/core/src/tools/search.rs:202">
P1: Missing `--` separator before positional arguments. If `pattern` starts with `-`, ripgrep will interpret it as a flag, causing incorrect behavior or errors. Move all option flags before the positional arguments and insert `--` to terminate flag parsing.</violation>
</file>

<file name="docs/documentation/skills.md">

<violation number="1" location="docs/documentation/skills.md:11">
P3: This line is incomplete: skill discovery also includes AGENTS.md and home-level skill directories. Update the wording so users don't miss those sources.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: The new AGENTS.md-skip heuristic in resolve_skill_reference is incorrect, so Level 2/3 fallback can resolve files outside the workspace root.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/core/src/skills.rs, line 475:

<comment>The new AGENTS.md-skip heuristic in `resolve_skill_reference` is incorrect, so Level 2/3 fallback can resolve files outside the workspace root.</comment>

<file context>
@@ -394,6 +438,139 @@ fn parse_permission_mode_str(raw: &str) -> Option<PermissionMode> {
+            .file_name()
+            .and_then(|n| n.to_str())
+            .unwrap_or("");
+        let is_likely_skill_subdir =
+            !skill_dir_name.is_empty() && skill_dir_name != "." && skill_directory != catalog_root;
+
</file context>

[cubic-dev-ai]

P1: Recursive copy follows directory symlinks without validation, which can traverse outside the source tree or recurse through cycles.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/core/src/skill_installer.rs, line 234:

<comment>Recursive copy follows directory symlinks without validation, which can traverse outside the source tree or recurse through cycles.</comment>

<file context>
@@ -0,0 +1,588 @@
+        let entry = entry.map_err(|e| e.to_string())?;
+        let src_path = entry.path();
+        let dst_path = dst.join(entry.file_name());
+        if src_path.is_dir() {
+            copy_dir_recursive(&src_path, &dst_path)?;
+        } else {
</file context>

Suggested change

	if src_path.is_dir() {
	copy_dir_recursive(&src_path, &dst_path)?;
	} else {
	std::fs::copy(&src_path, &dst_path)
	.map_err(|e| format!("copy {}: {e}", src_path.display()))?;
	}
	let file_type = std::fs::symlink_metadata(&src_path)
	.map_err(|e| format!("metadata {}: {e}", src_path.display()))?
	.file_type();
	if file_type.is_symlink() {
	continue;
	} else if file_type.is_dir() {
	copy_dir_recursive(&src_path, &dst_path)?;
	} else {
	std::fs::copy(&src_path, &dst_path)
	.map_err(|e| format!("copy {}: {e}", src_path.display()))?;
	}

[cubic-dev-ai]

P1: The PR trigger is missing types: [closed], so merged PRs won’t reliably satisfy the pull_request.merged gate and release jobs can be skipped.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/release.yml, line 7:

<comment>The PR trigger is missing `types: [closed]`, so merged PRs won’t reliably satisfy the `pull_request.merged` gate and release jobs can be skipped.</comment>

<file context>
@@ -4,17 +4,74 @@ on:
   push:
     branches: [main]
     tags: ["v*"]
+  pull_request:
+    branches: [main]
 
</file context>

Suggested change

	pull_request:
	branches: [main]
	pull_request:
	branches: [main]
	types: [closed]

[cubic-dev-ai]

P1: Missing -- separator before positional arguments. If pattern starts with -, ripgrep will interpret it as a flag, causing incorrect behavior or errors. Move all option flags before the positional arguments and insert -- to terminate flag parsing.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/core/src/tools/search.rs, line 202:

<comment>Missing `--` separator before positional arguments. If `pattern` starts with `-`, ripgrep will interpret it as a flag, causing incorrect behavior or errors. Move all option flags before the positional arguments and insert `--` to terminate flag parsing.</comment>

<file context>
@@ -37,36 +163,299 @@ impl ToolExecutor for SearchCodeTool {
         let mut cmd = tokio::process::Command::new("rg");
-        cmd.arg("--no-heading")
-            .arg("--line-number")
+        cmd.arg("--json")
             .arg("--color=never")
-            .arg(pattern)
</file context>

[cubic-dev-ai]

P2: Reject columns that point past the end of the line body. With the current > check, column == body.len() + 1 is accepted and can replace across the newline, which violates the "column starts within the line" contract.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/core/src/tools/replace_match.rs, line 170:

<comment>Reject columns that point past the end of the line body. With the current `>` check, `column == body.len() + 1` is accepted and can replace across the newline, which violates the "column starts within the line" contract.</comment>

<file context>
@@ -0,0 +1,296 @@
+
+        let body = line_body(segment);
+        let byte_column = column - 1;
+        if byte_column > body.len() {
+            return ToolResult {
+                call_id: call.id.clone(),
</file context>

Suggested change

	if byte_column > body.len() {
	if byte_column >= body.len() {

[cubic-dev-ai]

P2: Use portable paths in verification commands; hardcoded absolute local paths make the plan fail for other developers.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/superpowers/plans/2026-03-24-skill-supporting-files.md, line 585:

<comment>Use portable paths in verification commands; hardcoded absolute local paths make the plan fail for other developers.</comment>

<file context>
@@ -0,0 +1,603 @@
+
+```bash
+mkdir -p .nca/skills/test-skill
+cp /home/nst/Documents/superpower/skills/subagent-driven-development/SKILL.md .nca/skills/test-skill/
+cp /home/nst/Documents/superpower/skills/subagent-driven-development/implementer-prompt.md .nca/skills/test-skill/
+cp /home/nst/Documents/superpower/skills/subagent-driven-development/spec-reviewer-prompt.md .nca/skills/test-skill/
</file context>

[cubic-dev-ai]

P2: skills update will skip skills whose original directory name needed sanitization because the update path matches raw repo names against sanitized lock keys. Match against sanitized names to ensure updates work for those skills.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/cli/src/main.rs, line 1418:

<comment>`skills update` will skip skills whose original directory name needed sanitization because the update path matches raw repo names against sanitized lock keys. Match against sanitized names to ensure updates work for those skills.</comment>

<file context>
@@ -1274,6 +1329,120 @@ fn list_skills(config: &NcaConfig, workspace_root: &Path, json: bool) -> anyhow:
+
+            let discovered = discover_skills_in_dir(&skills_path).map_err(anyhow::Error::msg)?;
+
+            if let Some((_, src_dir)) = discovered.iter().find(|(n, _)| n == &skill_name) {
+                let dest = target.join(&skill_name);
+                copy_skill_dir(src_dir, &dest).map_err(anyhow::Error::msg)?;
</file context>

Suggested change

	if let Some((_, src_dir)) = discovered.iter().find(|(n, _)| n == &skill_name) {
	if let Some((_, src_dir)) = discovered.iter().find(|(n, _)| {
	n == &skill_name
	|| nca_core::skill_installer::sanitize_skill_name(n)
	.ok()
	.as_deref()
	== Some(skill_name.as_str())
	}) {

[cubic-dev-ai]

P3: Malformed backtick formatting makes the fence example render incorrectly and unclear. Use a valid inline code span for the fence example.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/plans/file-mention-preview-compaction.md, line 9:

<comment>Malformed backtick formatting makes the fence example render incorrectly and unclear. Use a valid inline code span for the fence example.</comment>

<file context>
@@ -0,0 +1,17 @@
+
+## Implementation
+
+- Add a shared preview compactor that rewrites expanded ````file:path` fences back to `@path`.
+- Use that compacted preview for user `MessageReceived` events.
+- Keep assistant/tool previews unchanged.
</file context>

[cubic-dev-ai]

P3: The expected test count is incorrect here; this task defines 5 expanded_body tests, not 4.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/superpowers/plans/2026-03-24-skill-supporting-files.md, line 506:

<comment>The expected test count is incorrect here; this task defines 5 `expanded_body` tests, not 4.</comment>

<file context>
@@ -0,0 +1,603 @@
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `cargo test -p nca-core expanded_body 2>&1 | tail -20`
+Expected: all 4 tests pass
+
</file context>

[cubic-dev-ai]

P3: This line is incomplete: skill discovery also includes AGENTS.md and home-level skill directories. Update the wording so users don't miss those sources.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/documentation/skills.md, line 11:

<comment>This line is incomplete: skill discovery also includes AGENTS.md and home-level skill directories. Update the wording so users don't miss those sources.</comment>

<file context>
@@ -0,0 +1,177 @@
+
+## Skill Discovery
+
+nca looks for skills in configured directories:
+
+```toml
</file context>

Suggested change

	nca looks for skills in configured directories:
	nca discovers skills from `AGENTS.md` and from the configured directories (resolved relative to the workspace and combined with `~/.nca/skills` and `~/.claude/skills` when HOME is set):