Changelog

Added

• /pause — turns off the parts of Boost OS that act on their own: the always-on guards and the instructions file your agent reads at the start of every chat. Your slash commands, project memory, and saved notes stay exactly where they are. Nothing is deleted, so there's no confirmation step.
• /resume — the other half. It reconnects the guards and puts the instructions file back exactly as it was. If new instructions appeared in your project while Boost OS was paused, it keeps both files and tells you which two to look at instead of overwriting either one.
• Boost OS now ships twenty-two slash commands.

Changed

• Updating a paused project keeps it paused — installing a new release won't quietly turn the guards back on.
• /uninstall now suggests /pause first when you only want Boost OS quiet for a while, not gone.

Fixed

• The memory reminder (the note asking your agent to save what the session learned) was meant to appear once per chat, but it kept coming back after every reply while you had unsaved work. It now remembers which conversation it already reminded and stays quiet for the rest of that chat. New chats still get their one reminder. Already installed? Pick up the fix with `npx -y boostmyagent@latest update`.

Added

• A push guard: before your agent pushes commits, Boost OS re-checks every outgoing change for secret keys and blocks the push if one slipped in earlier. The commit guard catches secrets as they happen; this catches the ones from before it was watching.
• An install guard: when your agent installs a package, Boost OS warns if the name is one typo away from a famous package (a common trick for spreading malicious code) or if the package is less than 30 days old. It warns and steps aside — the install still runs. Boost OS now ships six always-on guards.
• An env guard: when your agent edits your settings file (.env), Boost OS checks it against the shared example copy and points out any setting that exists in one but not the other — the quiet mistake that breaks the next deploy.
• An optional usage counter, off by default: turn it on with one command and Boost OS counts which slash commands you run — never what you typed, your files, or their contents. Turn it off any time. It helps us decide what to improve first.

Changed

• The mechanical checks inside /vibe, /security, and /sync — secret scanning, leftover debug lines, settings-file hygiene, outdated packages — now run as real code in the Boost OS command-line tool instead of written instructions the AI follows. Same checks, but the results no longer depend on how carefully the AI reads. If the tool isn't available, the commands fall back to the old way.
• Fixed the wiring so multiple guards can watch the same moment (the commit, push, and install guards all watch shell commands) without overwriting each other. Existing installs pick up all six guards on the next update.

Added

• /whats-new — type it in your AI chat to see what shipped since the version you have installed, in plain bullets, with the one-line update command at the end. It only reports; nothing installs until you say so. Boost OS now ships twenty slash commands.
• The /os menu now ends with a short "start here" suggestion matched to your project: brand-new projects get pointed at /design and /explain, active products at /vibe and /security.
• Installing Boost OS now marks the risky parts of your app — payment webhooks (the code that hears back from your payment provider), login checks, database change history — as hands-off in project memory, so the always-on guard warns your agent the moment it touches them. Previously you had to write those entries yourself.

Changed

• The install now finishes with a three-step first-five-minutes checklist (/os, then /vibe, then /remember) so you know exactly what to type first.
• The secret-key patterns that /vibe, /security, and the commit guard scan for now live in one shared file that ships with every release — so a new leak pattern we add reaches all three at once. GitHub tokens joined the list.
• The /sync command's catalog of outdated-code patterns now ships as its own data file, so it can grow with every release.
• The installer is better at telling us which AI tool you use (anonymously, for prioritizing fixes) when you run it from a plain terminal.

Fixed

• The commit guard (and the other two guards) waited for a signal Cursor never sends before answering, which could freeze every command your agent tried to run. Guards now read the event as it arrives and answer immediately.
• Guard entries written to Cursor's hook settings now include a 10-second timeout, so even a misbehaving guard gets skipped instead of freezing anything.
• Already installed v1.1.0 in Cursor and seeing commands hang? Run `npx -y boostmyagent@latest update` in your own terminal (not the agent's chat), then reload the Cursor window.

Added

• Always-on hooks (checks your coding tool runs automatically, no command needed). Three ship today: a commit guard that stops a commit (a saved snapshot of your code) when it contains secret keys, env files (the files holding your app's private settings), or leftover merge-conflict text; a fragile-file guard that warns the agent the moment it edits a file you've marked hands-off in project memory; and a memory nudge that reminds the agent to save what the session learned before it wraps up.
• Hooks wire up automatically at install for the tools that support them — Cursor, Claude Code (GitHub Copilot reads the same setup), Codex, and Gemini CLI. Your own existing hooks stay untouched. Skip with `--no-hooks` at install, or remove any time with `npx -y boostmyagent hooks uninstall`.
• Memory sync. `npx -y boostmyagent memory push` backs up your project memory and reference notes to your account; `memory pull` restores them on another computer or a fresh copy of the project; `memory status` tells you whether the two match. Installing Boost OS on a new machine restores your latest backup automatically. Nothing local gets overwritten without your say-so.

Changed

• /remember now also backs up your notes to your account after saving them locally. If you're offline or signed out it skips the backup quietly — the local save always wins.

Added

• /mobile — Check category. Point it at one screen (by file, route, or component name) and it first works out whether you're building a web app or a phone app, then checks that screen against what breaks on phones: text that's hard to read without zooming, tap targets too tiny for a thumb, layouts that scroll sideways, images that spill off the edge, and content hidden behind the notch. You get back a numbered to-do list you can hand to /preflight. It tells you what to change — it doesn't touch your code.

Changed

• Boost OS now ships nineteen slash commands. Build: /cost, /design, /explain, /next, /spawn. Check: /audit, /health, /mobile, /preflight, /security, /sync, /vibe. Memory: /forget, /recall, /remember. Customize: /new, /uninstall, /update.

Added

• /design — Build category. Walks you through a four-step conversation: define the feature in one sentence, see which files it touches, pick the simplest version, then render a numbered plan you hand to /preflight before any code gets written.
• /security — Check category. A pre-deploy safety pass across four checks: a secrets sweep (looks at your working tree and the last 50 commits, with any token values redacted in the report), env hygiene (makes sure `.env*` is in `.gitignore` and `.env.example` only holds placeholders), a dependency advisory check (the worst-rated security advisories grouped by package), and risky API-route patterns (raw SQL stitched into template strings, handlers with no auth check, bare `eval`, and wildcard CORS that lets any site call your API).
• /sync — Check category. Catches the agent up on the libraries you actually have installed, so it stops writing code against the older version it was trained on. Three layers: lists your outdated packages (grouped by safe patch / careful minor / risky major / abandoned), pulls the release notes for any package that's a major version behind, then scans your own code for old API patterns (next/getStaticProps, React class components, zod .nonempty(), and so on). Outputs a paste-ready "Current API context for the agent" block you can drop into your next prompt.

Changed

• Boost OS now ships eighteen slash commands. Build: /cost, /design, /explain, /next, /spawn. Check: /audit, /health, /preflight, /security, /sync, /vibe. Memory: /forget, /recall, /remember. Customize: /new, /uninstall, /update.

Changed

• /update now stays a thin layer over `npx -y boostmyagent@latest update`: it checks Boost OS is installed, runs the command, and prints what the installer actually said.
• /update no longer carries fake example versions or tries to parse changelogs in its own instructions — release details come from the installer, not a guess.

Changed

• /remember now has two modes. Session mode keeps the one-note-at-a-time flow when the chat already has concrete findings. Fresh-context mode inspects the project first, then fills in the reference file's standard sections: Entry points, Key files, Data flow, External services, Conventions, and Last task notes.
• A broad /remember request can split the work across up to five parallel passes (after asking you first), so wide feature areas get mapped before the reference file is written.

Added

• /uninstall: asks before removing anything, then runs the installer's uninstall path from chat.
• Installer: `boostmyagent uninstall` removes the Boost OS command folders, the Boost OS kernel file (AGENTS.md), project memory, references, the install record, and any empty folders left behind. Your saved license stays so you can install in other projects, unless you pass `--logout`. Custom commands you built with /new also stay.

Changed

• Boost OS now ships fifteen slash commands, with /uninstall in the Customize category beside /new and /update.

Added

• /next: new Build command. Reads the recent chat and drafts 2-3 copy-pasteable prompts you could send next, each written in plain language with technical terms explained inline. Built for the moment you know what you want but not how to phrase it.

Changed

• Check commands (/spawn, /health, /preflight, /vibe, /audit) now end with a short "Next moves" list tied to the actual findings — specific files, commands, and decisions — so a report always tells you what to do about it.

Added

• AGENTS.md kernel: a tiny set of always-on rules — read project memory before any work, stop on requests with no code to change (hosted dashboards, external manual workflows), preserve your changes, debug from evidence, route everything else through /os.
• Build category — /cost (money, build time, learning curve, lock-in, maintenance), /explain (rewrite any agent output in plain language), /next (draft 2-3 builder-friendly prompts you could send next when you don't know what to ask), /spawn (split a task across parallel helper agents).
• Check category — /vibe (sanity-check your uncommitted work for leaked secrets, broken builds, and design smells), /audit (find legacy and dead code with a yes/no prompt for each file), /preflight (check a plan against your existing code before you start coding), /health (pull recent production error logs for any service in your stack).
• Memory category — /remember, /recall, /forget for per-area reference notes (one note file per feature area of your app).
• Customize category — /new (build your own slash commands through a short conversation; they survive every update), /update (check for and install Boost OS updates from any AI chat — newer commands, kernel improvements, bug fixes).
• /os menu groups commands in workflow order: Build → Check → Memory → Customize. Your own custom commands appear in a separate "Your skills" section.
• Project memory created at install time at `.agents/memory/project.md` from a one-time project scan (your stack, deployment, verification commands, and which feature areas exist).
• A blank reference file is created at install for every feature area the scan finds, ready to fill in.
• Installer commands: install, update, status, logout. Plus a focused storage layer the slash commands use to read and write project memory.
• Install targets: `--target auto` (default) writes to `.agents/skills/`, and falls back to `.claude/skills/` when only Claude project signals are present. `--target claude` and `--target agents` force the destination.
• Compatibility with Cursor, Claude Code, Codex, GitHub Copilot, Replit, Windsurf, Cline, and Aider.