What changed in caveman from 1 to 2

Caveman 2.6.0 ships a Firefox build of the Caveman Mode extension, folds an ASD-STE100 clarity register into the caveman skill, and fixes the routing, hook, and compression bugs found since 2.5.0.

Highlights:

• Skill: caveman prose now always mixes in an ASD-STE100 clarity register, so compressed answers stay unambiguous without dropping out of caveman voice.
• Extension: Firefox port of the Caveman Mode extension (#810), AMO-clean manifest and addons-linter pass, a Firefox pack target in the zip builder and the release gate, and a real-Firefox injection guard behind npm run test:firefox. Dropped an indicator font-face that 404'd on every chat page.
• Codex: array-shaped tool output is compressed, route eligibility is recorded, and the wrap no longer self-corrupts its config or stacks duplicate hooks.
• Pi: per-model originals and compat-mount routing for custom providers; only the default provider's endpoints are routed (#972).
• Proxy: x-api-key is sent on compat /v1/messages (#969), and the native-hook bridge returns on the first complete JSON payload instead of waiting for EOF (#965). Same first-JSON rule applied to the CLI's host hook callbacks.
• Hooks: stronger per-turn caveman reinforcement so competing mid-conversation instructions do not drift the style (#951).
• Agents: cavecrew subagents dropped the Claude-only tools frontmatter so Gemini CLI loads them (#966).
• Stats: number formatting pinned to en-US (#954).
• CLI: a freshly started proxy's run state is awaited before judging its owner.

Artifacts:

• Signed binaries: bin-v1.1.6 (built by CI from that tag)
• CLI: npm install -g @caveman-ai/cli@1.3.3 (npm publish pending)

Validation:

• tests/verify_repo.py: all local verification checks passed.
• Go proxy suite (go test ./... in proxy/): green.
• Installer bootstrap pin lockstep test: green.

Caveman 2.5.0 closes this week's issue and PR queue, drops the standalone cache engine from the repository, and ships a fail-closed fix for proxy-port takeover.

Highlights:

• Security: a wrap that finds a listener on the proxy port it did not start and cannot verify now launches the agent directly, so provider keys never go to a foreign process (#945).
• Qwen Code and Kilo Code wraps refuse extension, ACP, session-restore, control-command, daemon, and console surfaces that could carry model traffic outside the locked route.
• Standalone proxies prove MCP recovery from the request's own tool list, so subscription sessions compress without a wrap (#908).
• Provider-native cache optimizers and the breakpoint planner default on in optimization modes; explicit off still wins.
• caveman-compress validates each candidate in a staging file before touching the live file (#544, #938) and tolerates a leading tool_use block.
• caveman-stats counts each multi-block response once (#793, #794).
• Claude Code Remote Control is documented as incompatible with a proxied base URL and launches direct under wrap (#947).
• README rewritten around measured savings with static charts rendered from the committed benchmark table.
• cacheengine/ removed from this repository.

Artifacts:

• CLI: npm install -g @caveman-ai/cli@1.3.2 (npm publish pending)
• Signed binaries: bin-v1.1.5 (built by CI from this tag)

Validation:

• Full CLI suite locally: 943 tests, 942 passed, 18 skipped; the one failure is the raw-wrap base-URL test on a machine whose own caveman proxy already holds port 8787, which the new fail-closed path treats as unverifiable.
• Go proxy suite green except the pre-existing learn_retro store failures, unchanged from v2.4.0.
• verify_repo, Python, hook, and installer pin tests green.

Caveman 2.4.0 closes the full weekly issue and PR queue with adversarial review, targeted fixes, and release-grade validation.

Highlights:

• Hardened proxy redirect, authentication, cancellation, and TLS behavior.
• Request-scoped MCP recovery and per-session native-runtime locking.
• Safer Windows hooks and lifecycle handling.
• Stronger compression masking, isolation, accounting, and semantic doctor checks.
• Integrated accepted contributor work with explicit attribution and closure messages.
• Restored documented caveman --version behavior.

Artifacts:

• CLI: npm install -g @caveman-ai/cli@1.3.1
• Signed binaries: bin-v1.1.4

Validation:

• Full CLI suite: 665 tests, 647 passed, 18 skipped, 0 failed.
• Required Linux, macOS, Windows, Go, TypeScript, Python, extension, and root CI passed.
• Clean npm install, signed-binary checksum verification, direct wrap, compression, and byte-exact retrieval smoke passed.

What's Changed

• fix(proxy): scope repo intelligence to project source and require direct evidence by @JuliusBrussee in https://github.com/JuliusBrussee/caveman/pull/901
• fix: harden weekly integrations and prepare v2.4.0 by @JuliusBrussee in https://github.com/JuliusBrussee/caveman/pull/929
• fix(hooks): handle stdout/stderr 'error' in UserPromptSubmit hook by @AmirF194 in https://github.com/JuliusBrussee/caveman/pull/795
• fix(cli): honour HTTP_PROXY/HTTPS_PROXY for outbound requests by @dylanneve1 in https://github.com/JuliusBrussee/caveman/pull/889
• fix(compress): block sensitive directory names by @CooperSheroy in https://github.com/JuliusBrussee/caveman/pull/891
• chore(skills): shorten skill descriptions to fit the listing budget by @smoochy in https://github.com/JuliusBrussee/caveman/pull/898
• fix(stats): add Claude 5 model output pricing by @SomSamantray in https://github.com/JuliusBrussee/caveman/pull/900
• fix: scope caveman mode to the session by @pavel-collab in https://github.com/JuliusBrussee/caveman/pull/904
• fix(codex): remove deprecated hooks alias by @cuddy-five in https://github.com/JuliusBrussee/caveman/pull/927
• fix(installer): avoid CLI bin collision by @pttydou in https://github.com/JuliusBrussee/caveman/pull/928
• fix(compress): serialize concurrent compress runs with a cross-session lock by @hunleyd in https://github.com/JuliusBrussee/caveman/pull/798
• fix(cli): support documented version flag by @JuliusBrussee in https://github.com/JuliusBrussee/caveman/pull/930

New Contributors

• @dylanneve1 made their first contribution in https://github.com/JuliusBrussee/caveman/pull/889
• @CooperSheroy made their first contribution in https://github.com/JuliusBrussee/caveman/pull/891
• @smoochy made their first contribution in https://github.com/JuliusBrussee/caveman/pull/898
• @SomSamantray made their first contribution in https://github.com/JuliusBrussee/caveman/pull/900
• @pavel-collab made their first contribution in https://github.com/JuliusBrussee/caveman/pull/904
• @cuddy-five made their first contribution in https://github.com/JuliusBrussee/caveman/pull/927
• @pttydou made their first contribution in https://github.com/JuliusBrussee/caveman/pull/928
• @hunleyd made their first contribution in https://github.com/JuliusBrussee/caveman/pull/798

Full Changelog: https://github.com/JuliusBrussee/caveman/compare/v2.3.1...v2.4.0

Everything in v2.3.0 — learn v3 spend and attributed savings — plus the installer-pin fix below. Install v2.3.1, not v2.3.0.

Installer pin fix

v2.3.0 bumped bin/install.js and the documented one-liners but left install.sh and install.ps1 pinned at v2.2.0. The curl-pipe path reads the shim's own default ref, so the v2.3.0 one-liner bootstrapped the previous release. The root installer package version had drifted the same way.

A test now asserts that the three bootstrap pins, the installer package version, and every documented one-liner name the same release, so the next bump cannot miss one silently.

Learn v3 (from v2.3.0)

• caveman learn prices the scanned window from provider-counted usage read out of agent transcripts, so the cost figure is the provider's arithmetic rather than an estimate.
• Confirmed savings are attributed to a named method — deterministic_remeasure, controlled_holdout, counterfactual_replay, or interrupted_time_series — and rungs are never summed into one blended headline.
• A controlled-holdout harness runs a fix on and off on the same machine; under 5 sessions per arm it returns insufficient_data rather than a small win.
• caveman learn reconcile checks measured spend against a provider usage export, and a privacy-safe export digest makes that export shareable without shipping prompt text.
• Spend is what the window cost — never what a fix would return, never projected into a month, never called verified.
• Proxy: the gateway buffers non-streaming upstream bodies before replying, and serve-mode warnings land in ~/.caveman/proxy.log.

Runtime

Pins the bin-v1.1.3 companions and CLI 1.2.4. All 36 binaries and the signed manifest are at bin-v1.1.3.

Install

curl -fsSL https://raw.githubusercontent.com/JuliusBrussee/caveman/v2.3.1/install.sh | bash

irm https://raw.githubusercontent.com/JuliusBrussee/caveman/v2.3.1/install.ps1 | iex

Superseded by v2.3.1. This tag's install.sh / install.ps1 are still pinned at v2.2.0, so the v2.3.0 one-liner bootstraps the previous release. Use v2.3.1.

Learn v3: caveman learn now says what the window cost, not just how many tokens moved — and every savings number it reports carries the method that measured it.

Learn v3 — spend and attributed savings

• The scan reads billing buckets and outcome signals straight from agent transcripts (Claude, Codex, Gemini, opencode) and prices the window from provider-counted usage, so the cost figure is the provider's arithmetic rather than an estimate.
• Confirmed savings are attributed to a named method — deterministic_remeasure, controlled_holdout, counterfactual_replay, or interrupted_time_series. Rungs are never summed into one blended headline, because a re-counted file and a before/after median are not the same kind of evidence.
• A controlled-holdout harness runs a fix on and off on the same machine, so a change whose payback lands somewhere other than the file it edited (a distilled skill, say) can still be judged. Under 5 sessions per arm it returns insufficient_data instead of a small win.
• caveman learn reconcile checks measured spend against a provider usage export, and a privacy-safe export digest makes that export shareable without shipping prompt text.
• Spend, the savings ledger, and holdout reports surface in the CLI and in the caveman-learn skill. Spend is what the window cost — never what a fix would return, never projected into a month, and never called verified. On a Max/Plus plan it is the API-equivalent value of the tokens, not money spent.

Proxy

• The gateway buffers non-streaming upstream bodies before replying.
• Serve-mode warnings land in ~/.caveman/proxy.log instead of vanishing.

Elsewhere

• The caveman ruleset's framing clauses were rewritten, and the bundled agent skill registry regenerated.
• The GitHub Pages landing page is gone.

Runtime

Installs pin the bin-v1.1.3 companions and CLI 1.2.4. All 36 binaries and the signed manifest are published at bin-v1.1.3.

Install

curl -fsSL https://raw.githubusercontent.com/JuliusBrussee/caveman/v2.3.0/install.sh | bash

irm https://raw.githubusercontent.com/JuliusBrussee/caveman/v2.3.0/install.ps1 | iex

Safety fixes across the installer, the uninstaller, and the compress skill.

Install / uninstall

• Uninstall no longer deletes hook files while settings.json still points at them — that is #471 on every session start. A settings file it cannot parse or rewrite is now a hard stop, and the POSIX and PowerShell uninstallers exit non-zero on a missing node for the same reason.
• Install leaves another plugin's hooks/package.json alone; uninstall removes only the manifest caveman ships.
• Installer temp downloads move to a 0700 mkdtemp, so a pre-planted symlink can no longer capture the init script the installer then executes.
• The binary installers give each download its own .part. The fixed name made the O_EXCL guard unreachable, letting concurrent installs publish each other's half-written files as "checksum verified".

Compress skill

• The outer-fence strip no longer merges a document's first and last code blocks into prose. It matched any file that merely started and ended with a fence line.
• The validator now sees CommonMark indented code blocks — a 4-space-indented kubectl delete was prose to it, so a rewritten destructive command passed clean and overwrote the file.
• Lost file paths and renamed headings are errors, not warnings that let the in-place overwrite stand.

Hooks

• cavecrew model overrides no longer rewrite tracked agents/*.md when the plugin root is a source checkout.

Benchmarks

• benchmarks/run.py gains a terse control arm, so the next regenerated table separates what the skill adds from what any "answer concisely" instruction already buys. The published 65% is against an unprompted baseline and now says so.

Install

curl -fsSL https://raw.githubusercontent.com/JuliusBrussee/caveman/v2.2.0/install.sh | bash

irm https://raw.githubusercontent.com/JuliusBrussee/caveman/v2.2.0/install.ps1 | iex

Caveman 2.1.0

caveman learn

• Context-depth report: each session's peak context-window share, bucketed, with over-30%/over-50% counts.
• Report UI: TLDR summary, two-card savings (proxy-measured saved-so-far + replay could-have-saved), 30-day list-price cost illustration.

CLI

• Persisted shortcut and token telemetry (feat/cli).

Skill and hooks

• Skill forbids caveman phrasing that adds tokens; names defect/ticket text.
• Hooks resolve punctuated /caveman levels and stop prose firing mode triggers; degrade instead of crashing when a sibling hook file is missing.
• Compress: indented fence markers no longer break inline-code validation.
• Installer installs Cursor skills globally; SSRF block errors name the allowlist escape hatch; opencode agents drop provider-less model values.

Docs

• New twenty-chapter technical manual under docs/technical/.
• README rewritten as a landing page: proxy-first install, caveman learn showcase with a real report screenshot, skills-as-images.

All local numbers remain inferred; benchmark numbers remain benchmark_counterfactual. Installer pins bumped to v2.1.0.

Caveman 2 — the engine ships. v1 shrank the model's mouth (output). v2 adds the ears: a real compression engine that squeezes what the model reads — tool outputs, logs, code, JSON — before it ever hits the model. One line in front of any LLM app. Free, local, BYOK.

The skill is untouched and still MIT. Nothing about your /caveman install changed.

Real run: a 40-record JSON went 16,098 → 1,091 tokens (93% smaller), byte-safe, fully recoverable via CCR. Savings are inferred — measured on your machine, not projected, not "verified."

Licensing: MIT for the skill, CLI, SDKs, kit, evals, contracts, catalog, and extension shell. BSL-1.1 for the engine/proxy/mcp/shrink/cavemem-core/platform — self-host your own traffic (incl. production) free; only reselling Caveman-as-a-service needs a commercial license. Sunsets to Apache-2.0 in ~4 years.

Ships now: engine, proxy, CLI, SDKs (as the packages resolve). Coming soon: browser extension. Install commands and pip/npm/docker badges go live when the packages publish.

Want to help? New content-type compressors are the highest-leverage contribution — check good first issue.