@cjhyy/code-shell 0.9.26 → 0.9.28

package/CHANGELOG.md

@@ -6,6 +6,71 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and while the project is pre-1.0 we treat any 0.x → 0.(x+1) bump as potentially
 breaking.
 
+## [Unreleased]
+
+## [0.9.28] - 2026-10-09
+
+### Added
+
+- Discover eligible tools progressively: select tools before exposing their full
+  definitions to subsequent model requests, and recheck permissions before use.
+- Recover committed long output for persistent Desktop/Web sessions through a
+  Session-owned journal, durable cursors and bounded pages across disconnects and
+  worker/Main restarts. The journal is capped at 128 MiB per Session and 16 MiB per
+  logical event; old peers, mobile, retention and repair retain separate limits.
+
+### Fixed
+
+- Raise the Core/Server/Desktop MCP SDK floor to 1.31.0 and preserve OAuth issuer
+  binding in Desktop. Existing client secrets cannot follow replacement endpoints;
+  legacy credentials can still refresh at their saved endpoint.
+- Preserve normal message, attachment and queued steering identities during live
+  delivery and output recovery. Child Agent input no longer creates or overwrites
+  a parent user message; machine-injected inputs remain hidden.
+- Confirm accepted npm submissions against public exact-version and requested-tag
+  metadata under one bounded batch budget. Delayed visibility never triggers
+  another publish command or a dist-tag write.
+
+## [0.9.27] - 2026-10-09
+
+### Added
+
+- Complete the configured remote Link adapters for ten providers, retain exact
+  account/resource grants, and support rotating local GitHub/GitLab OAuth tokens
+  and system-browser authorization handoffs. Real account acceptance and service
+  deployment remain separate from these Host changes.
+- Add verified GitHub issue creation and single-repository Star/Unstar actions
+  with durable operation receipts, independent readback and no automatic resend
+  after an unknown result. New Star actions require explicit grants.
+- Parse bounded Office and PDF uploads and search authorized local text chunks.
+  Desktop uses its verified managed Node runtime for PDF parsing; Core PDF support
+  requires Node 22.13+ and the optional parser dependency.
+- Add cross-session request receipts and cost estimates to existing activity
+  records and TUI usage views, with visible unknown usage and pricing coverage.
+- Add durable model request boundaries and Host-owned signing of actual provider
+  request projections. Desktop requires available OS key storage and rejects
+  plaintext backends before sending; Node/TUI retain explicit plaintext custody.
+- Add isolated, tool-free Optimization Lab Agent trials, frozen instruction
+  revisions, native scope-specific adoption and revocation. The Lab remains off
+  by default; authorized reports and budget evidence remain durable.
+
+### Changed
+
+- Simplify Desktop navigation: move Task center into Settings → Activity, and
+  move credentials, Cloud workbench and the optional Optimization Lab into the
+  settings menu. Keep their existing pages, controls and feature flags available.
+- Bound Skill metadata by model context budget and provide permission-filtered
+  search and pagination without loading Skill bodies into the initial context.
+- Manage Host/Engine/Session/run resources with explicit ownership and cleanup.
+- Restrict CLI Link bindings to reads: reviewed HTTP adapters handle writes.
+
+### Fixed
+
+- Require complete zero-failure Bun shard reports and private test environments.
+  Native packed consumers and spawned workers receive isolation before Core loads.
+- Exercise actual Linux SecretService in Electron acceptance instead of
+  Playwright's default plaintext and mock-keychain switches.
+
 ## [0.9.26] - 2026-10-08
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell",
-  "version": "0.9.26",
+  "version": "0.9.28",
   "description": "Code Shell — meta package. Installs @cjhyy/code-shell-core and @cjhyy/code-shell-tui.",
   "type": "module",
   "packageManager": "bun@1.3.11",
@@ -26,9 +26,9 @@
     "dev:desktop": "bun run --filter '@cjhyy/code-shell-desktop' dev",
     "dev:tui": "CODE_SHELL_DEV=1 CODESHELL_UI_PERF=1 bun run packages/tui/src/cli/main.ts",
     "dev:bigtranscript": "bun run scripts/render-bigtranscript-dev.ts",
-    "test": "bun test --timeout 30000 tests packages",
-    "test:core": "bun test --timeout 30000 packages/core/src",
-    "test:mimi-chat": "bun test --timeout 30000 tests/mimi-chat-replay.test.ts tests/mimi-bound-session-replay.test.ts packages/chat/src packages/pet/src packages/desktop/src/main/pet packages/desktop/src/main/im-gateway-service.test.ts packages/core/src/engine/engine.profile-max-turns.test.ts packages/core/src/engine/engine.profile-input-change.test.ts packages/core/src/engine/turn-loop-steer-backfill.test.ts",
+    "test": "node scripts/run-bun-test-shard.mjs --timeout 30000 tests packages",
+    "test:core": "node scripts/run-bun-test-shard.mjs --timeout 30000 packages/core/src",
+    "test:mimi-chat": "node scripts/run-bun-test-shard.mjs --timeout 30000 tests/mimi-chat-replay.test.ts tests/mimi-bound-session-replay.test.ts packages/chat/src packages/pet/src packages/desktop/src/main/pet packages/desktop/src/main/im-gateway-service.test.ts packages/core/src/engine/engine.profile-max-turns.test.ts packages/core/src/engine/engine.profile-input-change.test.ts packages/core/src/engine/turn-loop-steer-backfill.test.ts",
     "test:coverage": "bun run scripts/check-builtin-coverage.ts",
     "test:e2e": "bun run build && bun run --cwd packages/desktop build && bun run --cwd packages/desktop test:e2e",
     "smoke": "bun run build && bun run --cwd packages/desktop build && bun run --cwd packages/desktop smoke",
@@ -37,7 +37,7 @@
     "evals:list": "node evals/harness/runner.mjs --list",
     "evals:validate": "node evals/harness/runner.mjs --validate",
     "evals:live": "node evals/harness/runner.mjs --live",
-    "test:evals": "bun test tests/harness-evals-*.test.ts",
+    "test:evals": "node scripts/run-bun-test-shard.mjs tests/harness-evals-*.test.ts",
     "test:package-release": "bun run scripts/package-release-smoke.ts",
     "test:watch": "bun test --timeout 30000 --watch tests packages",
     "bench:render": "bun run bench/render-tail.bench.ts && bun run bench/render-streaming.bench.ts && bun run bench/render-spinner.bench.ts && bun run bench/render-wheel.bench.ts",
@@ -47,11 +47,15 @@
     "lint:engine-bypass": "bash scripts/check-no-engine-bypass.sh",
     "lint:workflow-test-paths": "node scripts/check-workflow-test-paths.mjs",
     "lint:baseline": "node scripts/check-lint-baseline.mjs",
-    "format": "prettier --write 'packages/**/*.ts'"
+    "format": "prettier --write 'packages/**/*.ts'",
+    "test:upload-documents": "node scripts/run-isolated-node-smoke.mjs scripts/smoke-upload-documents.mjs",
+    "test:github-star": "node scripts/run-isolated-node-smoke.mjs scripts/smoke-github-star.mjs",
+    "test:output-journal": "node scripts/run-isolated-node-smoke.mjs scripts/smoke-output-journal.mjs",
+    "test:deferred-tools": "node scripts/run-isolated-node-smoke.mjs scripts/smoke-deferred-tools.mjs"
   },
   "dependencies": {
-    "@cjhyy/code-shell-core": "0.9.26",
-    "@cjhyy/code-shell-tui": "0.9.26"
+    "@cjhyy/code-shell-core": "0.9.28",
+    "@cjhyy/code-shell-tui": "0.9.28"
   },
   "workspaces": [
     "packages/*"