# PatchPilot v0.2.1

## Highlights

- Version alignment release for the npm package and CLI surface.
- Provider reasoning behavior now respects model-specific support instead of assuming every route can enable or disable reasoning the same way.
- Agent tools gained safe read-only helpers for Git status and package scripts.

## Fixed

- CLI version is read from `package.json`, preventing stale hardcoded `patchpilot --version` output.
- Onboarding clears secret input before model search, preventing API keys from appearing in an unmasked picker.
- Provider calls now use explicit timeouts and retry only safe discovery requests.
- `/mode plan` no longer permanently loses previously enabled build permissions.
- Onboarding errors are shown in the setup panel instead of being hidden in the transcript.

## Improved

- `/models` and `/connect` keep interactive palette context after loading options.
- Reasoning handling is provider-aware for Gemini Thinking, OpenRouter reasoning, Ollama `think`, NVIDIA GPT-OSS reasoning effort, and Codex.
- Shell tool validation blocks destructive simple commands such as forced removes, risky Git mutations, and npm publication commands.
- LAN discovery allows private `172.16.0.0/12` prefixes while avoiding common Docker bridge prefixes.

## Pull Requests

- #7 Fix provider loops, onboarding safety, and public docs.
