diff --git a/.changeset/activity-collapsed-rows.md b/.changeset/activity-collapsed-rows.md
deleted file mode 100644
index f7bb992e..00000000
--- a/.changeset/activity-collapsed-rows.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"scream-code": patch
----
-
-Collapsed activity blocks now default to eight rows instead of three. At three rows a busy run only showed its header plus one step, which read as a frozen agent; the default now surfaces the newest steps of the timeline. `/blockrows` lets each user pick 5, 8 or 10, and a stored choice overrides the default; a previously stored 3 falls back to the new default.
diff --git a/.changeset/config-entry-menu.md b/.changeset/config-entry-menu.md
deleted file mode 100644
index a3ea2412..00000000
--- a/.changeset/config-entry-menu.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"scream-code": patch
----
-
-Give `/config` an entry menu: a bare `/config` (or `/login`) now asks which configuration flow to enter — the shortcut provider directory, the custom DIY setup, or image generation — instead of jumping straight into the catalog. `/config diy` and `/config image` keep their direct paths, and the first-run nudge opens the same menu.
diff --git a/.changeset/cross-platform-robustness.md b/.changeset/cross-platform-robustness.md
deleted file mode 100644
index 2d10567c..00000000
--- a/.changeset/cross-platform-robustness.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"scream-code": patch
----
-
-Make the agent behave consistently on macOS, Linux and Windows. The bundled ripgrep binary is now picked by probing the host libc instead of inferring it from the CPU architecture, Windows falls back to PowerShell when Git Bash is absent, and command execution resolves `.cmd`/`.bat` shims through `PATHEXT` rather than relying on a shell. Timed-out hooks and update steps terminate the whole process tree on Windows. Path safety checks understand Windows drive letters and UNC paths, the external editor no longer assumes a POSIX shell, and installing the package no longer hard-fails on platforms without a prebuilt local-embedding binary. State files are located through the shared home resolver and written atomically.
diff --git a/.changeset/dream-digest-induction.md b/.changeset/dream-digest-induction.md
deleted file mode 100644
index 9ea171dd..00000000
--- a/.changeset/dream-digest-induction.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-"scream-code": patch
----
-
-`/dream` now distills experience into reusable rules instead of deleting similar memos.
-
-- Dream folds clusters of memos into **digest cards** (`fact` / `preference` / `procedure` / `pitfall`) with an explicit conclusion, evidence ids, confidence and three separate timestamps (statement updated, re-confirmed, last hit).
-- Memos are marked `digested`, kept for a 14-day grace window, then physically deleted; nothing is deleted before its information is in a card, and un-digested episodic memos expire after 90 days.
-- Cards are capped at 200 and evicted dormant-first; cards nobody re-confirmed or used for 180 days stop being injected but are not deleted.
-- New sessions inject the five most relevant cards (fact / procedure / pitfall) with their update month, ranked by relevance × freshness.
-- `/memory` keeps its notes view unchanged and now hides digested entries.
diff --git a/.changeset/embedding-model-selfhost.md b/.changeset/embedding-model-selfhost.md
deleted file mode 100644
index 4cd2354d..00000000
--- a/.changeset/embedding-model-selfhost.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"scream-code": patch
----
-
-Fix the embedding-model setup card reappearing on every startup on installs without a pre-existing model cache. The pinned model archive is now staged by the app itself from a first-party GitHub release with HTTP status validation and an on-disk sha256 check, instead of relying on the third-party model mirror that stopped serving anonymous downloads — its downloader never checks the response status, so a 403 error page used to be silently written into the staged archive and every subsequent extract failed. Lint ratchet baseline lowered to the new low.
diff --git a/.changeset/first-party-user-agent.md b/.changeset/first-party-user-agent.md
deleted file mode 100644
index f2a6efff..00000000
--- a/.changeset/first-party-user-agent.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"scream-code": patch
----
-
-Send the product user agent with requests to third-party model endpoints. The identity used to be attached only to providers configured with a session header, so most OpenAI-compatible and Anthropic endpoints saw the SDK's own library user agent instead of the product's. Device fingerprint headers remain host-scoped and are not forwarded to third-party endpoints.
diff --git a/.changeset/first-token-wave-ramp.md b/.changeset/first-token-wave-ramp.md
deleted file mode 100644
index 8cbd263d..00000000
--- a/.changeset/first-token-wave-ramp.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-"scream-code": patch
----
-
-The status-bar pulse wave now reports silence. While the agent is working but receiving nothing — a request awaiting its first token, a reasoning or text stream that stopped delivering, or a tool that has been running without progress — the wave ramps from the brand colour toward amber, reaching pure amber at 15s and pure red at 25s, then stays red. Any inbound event returns it to the brand colour immediately.
-
-A retry floors the wave at amber, so a known failure never renders next to a "reconnecting" label while the wave still claims everything is healthy. Switching sessions clears the work phase and the liveness clock, so a new session cannot inherit a stalled indicator.
-
-Red is an early warning only: retries still come from real transport failures (the stall timeout, disconnects, rate limits). Colours come from the active palette (`primary` / `warning` / `error`), so light and dark themes each ramp between their own contrast-checked values, and a live theme switch repaints the wave on the next frame.
diff --git a/.changeset/fix-stream-error-retries.md b/.changeset/fix-stream-error-retries.md
deleted file mode 100644
index ebfd6601..00000000
--- a/.changeset/fix-stream-error-retries.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"scream-code": patch
----
-
-Recover explicit status codes from OpenAI-compatible streaming errors and classify status-less provider messages so transient failures enter the existing retry policy instead of immediately failing agent tasks.
diff --git a/.changeset/generated-artifacts-out-of-tree.md b/.changeset/generated-artifacts-out-of-tree.md
deleted file mode 100644
index 84222ae4..00000000
--- a/.changeset/generated-artifacts-out-of-tree.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"scream-code": patch
----
-
-Generated plan files no longer create a visible `plan/` folder in the project root when an agent has no session home: they now go to `.scream/plans`, which is already gitignored. The coverage report also moved out of the repository root to `node_modules/.cache/coverage`, so running the test suite no longer leaves a 27 MB `coverage/` directory behind.
diff --git a/.changeset/knowledge-document-formats.md b/.changeset/knowledge-document-formats.md
deleted file mode 100644
index 99b8c803..00000000
--- a/.changeset/knowledge-document-formats.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-"scream-code": patch
----
-
-`/knowledge` can now ingest PDF, Word (.docx) and Excel (.xlsx) files alongside Markdown and plain text. Binary documents are converted to Markdown by the document engine that already ships with the runtime, then follow the exact same chunking and embedding path as a `.md` file, so the shared vector index and `/memory` are unaffected.
-
-Details:
-
-- The converter engine moved into the knowledge package (no new dependencies, no new package). It is imported lazily, so startup and `/memory` searches never pay for it.
-- Images are dropped and their placeholders stripped; a document with no text layer (scanned PDF) fails with a clear message instead of storing an empty record.
-- Documents are fingerprinted by their raw bytes, so an identical file is skipped and a changed one is re-ingested.
-- Directory ingestion skips hidden entries, Office lock files (`~$…`) and unsupported formats.
-- Ingest prompts now recommend Markdown first and warn that scans, image-heavy files and wide tables extract poorly.
diff --git a/.changeset/mcp-uninstall-plugin-ownership.md b/.changeset/mcp-uninstall-plugin-ownership.md
deleted file mode 100644
index 30e32c50..00000000
--- a/.changeset/mcp-uninstall-plugin-ownership.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"scream-code": patch
----
-
-Make /mcp uninstall honest for plugin-provided servers: the management panel now tags servers contributed by a plugin, refuses to "uninstall" them with a pointer to /plugin (that removal used to be undone on the next startup by the plugin hot-apply pass), and reports a real error instead of a fake success when a removed server is still listed.
diff --git a/.changeset/plan-mode-reminder-trigger.md b/.changeset/plan-mode-reminder-trigger.md
deleted file mode 100644
index 33f0eb5e..00000000
--- a/.changeset/plan-mode-reminder-trigger.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"scream-code": patch
----
-
-Stop reading injected reminders as a fresh user message when deciding whether to repeat the plan-mode reminder: only a real user prompt resets the cadence to the full reminder, so the periodic refresh threshold holds instead of re-emitting the long reminder on every step.
diff --git a/.changeset/runtime-hardening.md b/.changeset/runtime-hardening.md
deleted file mode 100644
index 8881f00c..00000000
--- a/.changeset/runtime-hardening.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-"scream-code": patch
----
-
-Harden the runtime and close two discoverability gaps:
-
-- Dependency install scripts are denied by default (`onlyBuiltDependencies: []`), so a future dependency cannot silently run code at install time — the failure mode that once let a GPU download in an optional dependency break the vector feature.
-- Concurrent writes to the same file are serialized (per-path queue): parallel edits from one tool batch or from sibling sub-agents can no longer lose an update, while different files still write in parallel.
-- An abnormal exit is reported once on the next launch, pointing at `/sessions` to recover; clean exits and terminal hangups stay silent.
-- New `/hotkeys` (keyboard shortcut reference) and `/copy` (copy the last reply to the clipboard) commands.
diff --git a/.changeset/runtime-robustness-fixes.md b/.changeset/runtime-robustness-fixes.md
deleted file mode 100644
index dd399fbf..00000000
--- a/.changeset/runtime-robustness-fixes.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@scream-code/agent-core': patch
----
-
-Fix three runtime robustness gaps: the per-step tool-call block index no longer leaks one Map entry per step; approval timeouts clear their rejection timer when the response arrives first; and a provider-wrapped context-overflow error now fails fast instead of burning the full retry budget (compaction handles it). Session deletion no longer reports success when the directory could not be removed (new `session.delete_failed` error code), and session index/state writes all go through the shared atomic write. Tool name sets are centralized in one catalog module.
diff --git a/.changeset/session-header-injection.md b/.changeset/session-header-injection.md
deleted file mode 100644
index 30c854a4..00000000
--- a/.changeset/session-header-injection.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"scream-code": patch
----
-
-Support an optional per-provider session header that carries the stable conversation id, stamp known catalog entries when connecting, and surface an actionable config hint when a gateway reports a missing session header.
diff --git a/.changeset/tips-offer-placement.md b/.changeset/tips-offer-placement.md
deleted file mode 100644
index 575ccc87..00000000
--- a/.changeset/tips-offer-placement.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"scream-code": patch
----
-
-Add a weighted offer tip to the empty-session tips carousel above the editor: the placement tip carries a clickable domain link (OSC 8) and is opened with Ctrl+F, rotations favor it at an 80% probability, and Ctrl+B still hides all tips.
diff --git a/.changeset/todo-reconcile-before-answer.md b/.changeset/todo-reconcile-before-answer.md
deleted file mode 100644
index 5005bce7..00000000
--- a/.changeset/todo-reconcile-before-answer.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"scream-code": patch
----
-
-Stop appending a todo reconciliation round after the final answer: the reminder is now injected before the answer is written, inside the work the turn is already doing. The TodoList suggestion now waits for the third step so short two-step tasks are no longer nudged, and the periodic todo reminder fires half as often and only while the list still has unfinished items. Goal turns no longer continue after the answer just because TodoList was not updated this turn, and a turn counts as having touched the list only when the TodoList call actually succeeded.
diff --git a/.changeset/turn-queue-and-todo-reconcile.md b/.changeset/turn-queue-and-todo-reconcile.md
deleted file mode 100644
index 26be2226..00000000
--- a/.changeset/turn-queue-and-todo-reconcile.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"scream-code": patch
----
-
-Buffer prompts that arrive while a turn is active so queued user input joins the steer path instead of failing as busy, and flush leftover steers at the start of the next turn.
diff --git a/.changeset/wasm-embedding-engine.md b/.changeset/wasm-embedding-engine.md
deleted file mode 100644
index 606e1a1e..00000000
--- a/.changeset/wasm-embedding-engine.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"scream-code": patch
----
-
-Move the local embedding engine off native binaries onto a self-contained WebAssembly pipeline. Installing no longer pulls a compiler toolchain or an unused GPU runtime on Linux (and can no longer lose the whole vector feature when that download fails), the dependency tree drops its deprecated packages, and the model download now reports byte progress with stall and overall timeout guards plus verify/load phases. A cache is only considered installed when the weights and both tokenizer files are present, so a half-restored cache repairs itself instead of failing at load time. Vectors are bit-compatible with the previous engine.
diff --git a/apps/scream-code/CHANGELOG.md b/apps/scream-code/CHANGELOG.md
new file mode 100644
index 00000000..c8166d4e
--- /dev/null
+++ b/apps/scream-code/CHANGELOG.md
@@ -0,0 +1,64 @@
+# scream-code
+
+## 0.18.10
+
+### Patch Changes
+
+- [`e53d2f9`](https://github.com/LIUTod/scream-code/commit/e53d2f9e9da0e2e7e8ea9141e8bc8fed847d4d8e) - Collapsed activity blocks now default to eight rows instead of three. At three rows a busy run only showed its header plus one step, which read as a frozen agent; the default now surfaces the newest steps of the timeline. `/blockrows` lets each user pick 5, 8 or 10, and a stored choice overrides the default; a previously stored 3 falls back to the new default.
+
+- [`ca795a1`](https://github.com/LIUTod/scream-code/commit/ca795a1a3e6dea6a1928e71d8bb4781ae85fa471) - Give `/config` an entry menu: a bare `/config` (or `/login`) now asks which configuration flow to enter — the shortcut provider directory, the custom DIY setup, or image generation — instead of jumping straight into the catalog. `/config diy` and `/config image` keep their direct paths, and the first-run nudge opens the same menu.
+
+- [`49a3542`](https://github.com/LIUTod/scream-code/commit/49a3542835bbdd4a6043a346b9c1ad45369e698c) - Make the agent behave consistently on macOS, Linux and Windows. The bundled ripgrep binary is now picked by probing the host libc instead of inferring it from the CPU architecture, Windows falls back to PowerShell when Git Bash is absent, and command execution resolves `.cmd`/`.bat` shims through `PATHEXT` rather than relying on a shell. Timed-out hooks and update steps terminate the whole process tree on Windows. Path safety checks understand Windows drive letters and UNC paths, the external editor no longer assumes a POSIX shell, and installing the package no longer hard-fails on platforms without a prebuilt local-embedding binary. State files are located through the shared home resolver and written atomically.
+
+- [`4614f1a`](https://github.com/LIUTod/scream-code/commit/4614f1a539da23404466528a256ed9be99ddd867) - `/dream` now distills experience into reusable rules instead of deleting similar memos.
+
+  - Dream folds clusters of memos into **digest cards** (`fact` / `preference` / `procedure` / `pitfall`) with an explicit conclusion, evidence ids, confidence and three separate timestamps (statement updated, re-confirmed, last hit).
+  - Memos are marked `digested`, kept for a 14-day grace window, then physically deleted; nothing is deleted before its information is in a card, and un-digested episodic memos expire after 90 days.
+  - Cards are capped at 200 and evicted dormant-first; cards nobody re-confirmed or used for 180 days stop being injected but are not deleted.
+  - New sessions inject the five most relevant cards (fact / procedure / pitfall) with their update month, ranked by relevance × freshness.
+  - `/memory` keeps its notes view unchanged and now hides digested entries.
+
+- [`5290a2a`](https://github.com/LIUTod/scream-code/commit/5290a2a9d6ba94b51587fb4ad1478b335ce6924b) - Fix the embedding-model setup card reappearing on every startup on installs without a pre-existing model cache. The pinned model archive is now staged by the app itself from a first-party GitHub release with HTTP status validation and an on-disk sha256 check, instead of relying on the third-party model mirror that stopped serving anonymous downloads — its downloader never checks the response status, so a 403 error page used to be silently written into the staged archive and every subsequent extract failed. Lint ratchet baseline lowered to the new low.
+
+- [`965f7df`](https://github.com/LIUTod/scream-code/commit/965f7df148bfe9c0d39bcb2756b22ebdd8f4df9f) - Send the product user agent with requests to third-party model endpoints. The identity used to be attached only to providers configured with a session header, so most OpenAI-compatible and Anthropic endpoints saw the SDK's own library user agent instead of the product's. Device fingerprint headers remain host-scoped and are not forwarded to third-party endpoints.
+
+- [`74904e9`](https://github.com/LIUTod/scream-code/commit/74904e9f3832466a8f16d2e35e5b9568c36f35fc) - The status-bar pulse wave now reports silence. While the agent is working but receiving nothing — a request awaiting its first token, a reasoning or text stream that stopped delivering, or a tool that has been running without progress — the wave ramps from the brand colour toward amber, reaching pure amber at 15s and pure red at 25s, then stays red. Any inbound event returns it to the brand colour immediately.
+
+  A retry floors the wave at amber, so a known failure never renders next to a "reconnecting" label while the wave still claims everything is healthy. Switching sessions clears the work phase and the liveness clock, so a new session cannot inherit a stalled indicator.
+
+  Red is an early warning only: retries still come from real transport failures (the stall timeout, disconnects, rate limits). Colours come from the active palette (`primary` / `warning` / `error`), so light and dark themes each ramp between their own contrast-checked values, and a live theme switch repaints the wave on the next frame.
+
+- [#18](https://github.com/LIUTod/scream-code/pull/18) [`2fda5b7`](https://github.com/LIUTod/scream-code/commit/2fda5b7ce50f060d09875a54f35f26e5fa7d8c58) - Recover explicit status codes from OpenAI-compatible streaming errors and classify status-less provider messages so transient failures enter the existing retry policy instead of immediately failing agent tasks.
+
+- [`165a7ca`](https://github.com/LIUTod/scream-code/commit/165a7caa67c618fa82a6037d2cf0aa7da3c039b0) - Generated plan files no longer create a visible `plan/` folder in the project root when an agent has no session home: they now go to `.scream/plans`, which is already gitignored. The coverage report also moved out of the repository root to `node_modules/.cache/coverage`, so running the test suite no longer leaves a 27 MB `coverage/` directory behind.
+
+- [`7f6bf0d`](https://github.com/LIUTod/scream-code/commit/7f6bf0d9b49026ced29de226884849add0a0ec32) - `/knowledge` can now ingest PDF, Word (.docx) and Excel (.xlsx) files alongside Markdown and plain text. Binary documents are converted to Markdown by the document engine that already ships with the runtime, then follow the exact same chunking and embedding path as a `.md` file, so the shared vector index and `/memory` are unaffected.
+
+  Details:
+
+  - The converter engine moved into the knowledge package (no new dependencies, no new package). It is imported lazily, so startup and `/memory` searches never pay for it.
+  - Images are dropped and their placeholders stripped; a document with no text layer (scanned PDF) fails with a clear message instead of storing an empty record.
+  - Documents are fingerprinted by their raw bytes, so an identical file is skipped and a changed one is re-ingested.
+  - Directory ingestion skips hidden entries, Office lock files (`~$…`) and unsupported formats.
+  - Ingest prompts now recommend Markdown first and warn that scans, image-heavy files and wide tables extract poorly.
+
+- [`0baa2ce`](https://github.com/LIUTod/scream-code/commit/0baa2ce006a5a611a2c16b1e02f163369a99108e) - Make /mcp uninstall honest for plugin-provided servers: the management panel now tags servers contributed by a plugin, refuses to "uninstall" them with a pointer to /plugin (that removal used to be undone on the next startup by the plugin hot-apply pass), and reports a real error instead of a fake success when a removed server is still listed.
+
+- [`49a3542`](https://github.com/LIUTod/scream-code/commit/49a3542835bbdd4a6043a346b9c1ad45369e698c) - Stop reading injected reminders as a fresh user message when deciding whether to repeat the plan-mode reminder: only a real user prompt resets the cadence to the full reminder, so the periodic refresh threshold holds instead of re-emitting the long reminder on every step.
+
+- [`71379e3`](https://github.com/LIUTod/scream-code/commit/71379e35d8d184f1481312d97a5d5a674fb52c16) - Harden the runtime and close two discoverability gaps:
+
+  - Dependency install scripts are denied by default (`onlyBuiltDependencies: []`), so a future dependency cannot silently run code at install time — the failure mode that once let a GPU download in an optional dependency break the vector feature.
+  - Concurrent writes to the same file are serialized (per-path queue): parallel edits from one tool batch or from sibling sub-agents can no longer lose an update, while different files still write in parallel.
+  - An abnormal exit is reported once on the next launch, pointing at `/sessions` to recover; clean exits and terminal hangups stay silent.
+  - New `/hotkeys` (keyboard shortcut reference) and `/copy` (copy the last reply to the clipboard) commands.
+
+- [`dbbf1d6`](https://github.com/LIUTod/scream-code/commit/dbbf1d6f59f0123dd263f69c2583e8bd534ca67a) - Support an optional per-provider session header that carries the stable conversation id, stamp known catalog entries when connecting, and surface an actionable config hint when a gateway reports a missing session header.
+
+- [`4d9c653`](https://github.com/LIUTod/scream-code/commit/4d9c6530bf9d10505e7649082bf7dd80912faf59) - Add a weighted offer tip to the empty-session tips carousel above the editor: the placement tip carries a clickable domain link (OSC 8) and is opened with Ctrl+F, rotations favor it at an 80% probability, and Ctrl+B still hides all tips.
+
+- [`49a3542`](https://github.com/LIUTod/scream-code/commit/49a3542835bbdd4a6043a346b9c1ad45369e698c) - Stop appending a todo reconciliation round after the final answer: the reminder is now injected before the answer is written, inside the work the turn is already doing. The TodoList suggestion now waits for the third step so short two-step tasks are no longer nudged, and the periodic todo reminder fires half as often and only while the list still has unfinished items. Goal turns no longer continue after the answer just because TodoList was not updated this turn, and a turn counts as having touched the list only when the TodoList call actually succeeded.
+
+- [`e4b54e1`](https://github.com/LIUTod/scream-code/commit/e4b54e1e13c05551755e92d8ab6798851d989933) - Buffer prompts that arrive while a turn is active so queued user input joins the steer path instead of failing as busy, and flush leftover steers at the start of the next turn.
+
+- [`641f335`](https://github.com/LIUTod/scream-code/commit/641f3353706fb03a7eeadc8860fb5b27126042f8) - Move the local embedding engine off native binaries onto a self-contained WebAssembly pipeline. Installing no longer pulls a compiler toolchain or an unused GPU runtime on Linux (and can no longer lose the whole vector feature when that download fails), the dependency tree drops its deprecated packages, and the model download now reports byte progress with stall and overall timeout guards plus verify/load phases. A cache is only considered installed when the weights and both tokenizer files are present, so a half-restored cache repairs itself instead of failing at load time. Vectors are bit-compatible with the previous engine.
diff --git a/apps/scream-code/package.json b/apps/scream-code/package.json
index f19cc071..4a475d03 100644
--- a/apps/scream-code/package.json
+++ b/apps/scream-code/package.json
@@ -1,6 +1,6 @@
 {
   "name": "scream-code",
-  "version": "0.18.9",
+  "version": "0.18.10",
   "description": "A terminal-native AI agent for builders",
   "license": "MIT",
   "author": "ScreamCli",
diff --git a/packages/agent-core/CHANGELOG.md b/packages/agent-core/CHANGELOG.md
new file mode 100644
index 00000000..d1fb0830
--- /dev/null
+++ b/packages/agent-core/CHANGELOG.md
@@ -0,0 +1,13 @@
+# @scream-code/agent-core
+
+## 0.18.10
+
+### Patch Changes
+
+- [`6867cde`](https://github.com/LIUTod/scream-code/commit/6867cde2fb1dd7b8951d12a3f4d9316a4aad3b8a) - Fix three runtime robustness gaps: the per-step tool-call block index no longer leaks one Map entry per step; approval timeouts clear their rejection timer when the response arrives first; and a provider-wrapped context-overflow error now fails fast instead of burning the full retry budget (compaction handles it). Session deletion no longer reports success when the directory could not be removed (new `session.delete_failed` error code), and session index/state writes all go through the shared atomic write. Tool name sets are centralized in one catalog module.
+
+- Updated dependencies []:
+  - @scream-code/jian@0.18.10
+  - @scream-code/knowledge@0.18.10
+  - @scream-code/ltod@0.18.10
+  - @scream-code/memory@0.18.10
diff --git a/packages/agent-core/package.json b/packages/agent-core/package.json
index 6bc798ee..e27744c7 100644
--- a/packages/agent-core/package.json
+++ b/packages/agent-core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scream-code/agent-core",
-  "version": "0.18.9",
+  "version": "0.18.10",
   "private": true,
   "description": "The unified agent engine for Scream",
   "license": "MIT",
diff --git a/packages/config/CHANGELOG.md b/packages/config/CHANGELOG.md
new file mode 100644
index 00000000..fb5c4e3b
--- /dev/null
+++ b/packages/config/CHANGELOG.md
@@ -0,0 +1,3 @@
+# @scream-code/config
+
+## 0.18.10
diff --git a/packages/config/package.json b/packages/config/package.json
index d50e4e99..faa1b41c 100644
--- a/packages/config/package.json
+++ b/packages/config/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scream-code/config",
-  "version": "0.18.9",
+  "version": "0.18.10",
   "private": true,
   "description": "Platform configuration and model management for Scream Code",
   "license": "MIT",
diff --git a/packages/evals/CHANGELOG.md b/packages/evals/CHANGELOG.md
new file mode 100644
index 00000000..3d9d1ce3
--- /dev/null
+++ b/packages/evals/CHANGELOG.md
@@ -0,0 +1,3 @@
+# @scream-code/evals
+
+## 0.18.10
diff --git a/packages/evals/package.json b/packages/evals/package.json
index 4ee9edbb..493d818a 100644
--- a/packages/evals/package.json
+++ b/packages/evals/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scream-code/evals",
-  "version": "0.18.9",
+  "version": "0.18.10",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/packages/jian/CHANGELOG.md b/packages/jian/CHANGELOG.md
new file mode 100644
index 00000000..07bcd322
--- /dev/null
+++ b/packages/jian/CHANGELOG.md
@@ -0,0 +1,3 @@
+# @scream-code/jian
+
+## 0.18.10
diff --git a/packages/jian/package.json b/packages/jian/package.json
index a0815f38..75550994 100644
--- a/packages/jian/package.json
+++ b/packages/jian/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scream-code/jian",
-  "version": "0.18.9",
+  "version": "0.18.10",
   "private": true,
   "description": "Execution environment abstraction for AI agent applications",
   "license": "MIT",
diff --git a/packages/knowledge/CHANGELOG.md b/packages/knowledge/CHANGELOG.md
new file mode 100644
index 00000000..cde9ca51
--- /dev/null
+++ b/packages/knowledge/CHANGELOG.md
@@ -0,0 +1,8 @@
+# @scream-code/knowledge
+
+## 0.18.10
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @scream-code/memory@0.18.10
diff --git a/packages/knowledge/package.json b/packages/knowledge/package.json
index 6485af71..d448fde3 100644
--- a/packages/knowledge/package.json
+++ b/packages/knowledge/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scream-code/knowledge",
-  "version": "0.18.9",
+  "version": "0.18.10",
   "private": true,
   "description": "Local knowledge base library for scream-code agent retrieval",
   "license": "MIT",
diff --git a/packages/ltod/CHANGELOG.md b/packages/ltod/CHANGELOG.md
new file mode 100644
index 00000000..a10b8cca
--- /dev/null
+++ b/packages/ltod/CHANGELOG.md
@@ -0,0 +1,3 @@
+# @scream-code/ltod
+
+## 0.18.10
diff --git a/packages/ltod/package.json b/packages/ltod/package.json
index edf79286..1ae372c5 100644
--- a/packages/ltod/package.json
+++ b/packages/ltod/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scream-code/ltod",
-  "version": "0.18.9",
+  "version": "0.18.10",
   "private": true,
   "description": "The LLM abstraction layer for modern AI agent applications",
   "license": "MIT",
diff --git a/packages/memory/CHANGELOG.md b/packages/memory/CHANGELOG.md
new file mode 100644
index 00000000..e942255b
--- /dev/null
+++ b/packages/memory/CHANGELOG.md
@@ -0,0 +1,3 @@
+# @scream-code/memory
+
+## 0.18.10
diff --git a/packages/memory/package.json b/packages/memory/package.json
index 7f35549f..0798abe8 100644
--- a/packages/memory/package.json
+++ b/packages/memory/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scream-code/memory",
-  "version": "0.18.9",
+  "version": "0.18.10",
   "private": true,
   "description": "Persistent memory memo store for cross-session knowledge sharing",
   "license": "MIT",
diff --git a/packages/node-sdk/CHANGELOG.md b/packages/node-sdk/CHANGELOG.md
new file mode 100644
index 00000000..e198d82e
--- /dev/null
+++ b/packages/node-sdk/CHANGELOG.md
@@ -0,0 +1,3 @@
+# @scream-code/scream-code-sdk
+
+## 0.18.10
diff --git a/packages/node-sdk/package.json b/packages/node-sdk/package.json
index 3346bccf..5d08c559 100644
--- a/packages/node-sdk/package.json
+++ b/packages/node-sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@scream-code/scream-code-sdk",
-  "version": "0.18.9",
+  "version": "0.18.10",
   "private": true,
   "description": "TypeScript SDK for the Scream Code Agent",
   "license": "MIT",