@creatornader/agent-bridge 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -6,8 +6,173 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 
 ## [Unreleased]
 
-The changes in this section are implemented on the 0.3.0 development line. They are
-not released until the matching tag, GitHub release, and npm package exist.
+## [0.4.0] - 2026-07-19
+
+### Added
+
+- Add v6 managed-client endpoint cutover and finalization commands. A
+  committed v5 stage authorizes a credential-free v6 journal only after both live
+  gateways negotiate HTTP 2.1, bind the recorded principal and credential IDs, report
+  one immutable authority ID, and complete a route challenge. Cutover drains the
+  source edge under an exclusive lease before changing a host registration. The initial
+  proof uses the predecessor and successor. Once a journal exists, every proof and
+  replay uses the successor credential at both URLs, then drains the source edge
+  through the target gateway. Finalization retires the source only after the
+  predecessor grace cutoff. Dry runs inspect edge state without opening SQLite for
+  write access or contacting a gateway. Resume classifies durable before and after
+  proofs and cannot take over a live lease.
+
+- Add migration 019 for successor-only endpoint-migration challenges. A challenge now
+  accepts either a direct predecessor-to-successor pair or the same active successor
+  credential on both endpoints. The migration preserves the migration 018 challenge
+  records and readiness controls, adds v2 endpoint and v6 owner attestations, and does
+  not grant cutover authority. Authenticated HTTP 2.1 capabilities now return the
+  credential's `grantedScopes`.
+
+- Add migration 017 with an immutable PostgreSQL gateway authority UUID. Production
+  request authority now uses a bound opener without changing the released opener's
+  return shape. Authenticated gateway status adds optional `gatewayAuthorityId` and
+  `credentialId` fields under HTTP 2.1. Native DR preserves the UUID as logical
+  authority continuity, not live-clone fencing. Deployments must drain old gateway
+  instances before the migration.
+
+- Add `clients migrate stage <runtime>` for inert gateway-client migration
+  preparation. The command probes the active and successor bearer credentials, records
+  enrollment credential IDs and credential-free source and target bindings, and
+  prepares a private successor backend without changing the active registration or
+  backend. It does not authorize cutover. The source SQLite edge gate prevents new
+  outbox inserts once a later drain starts, including from a client that opened the
+  database before the gate changed. Staging requires an absolute, normalized source
+  edge database path and rejects in-memory edge state.
+
+- Add explicit, plan-first `clients rollback <update-operation-id> --identity <name>`
+  for committed same-host v4 updates. `--apply` creates a separate reverse journal.
+  It verifies the source inverse contract and current forward metadata and
+  registration before it removes the forward native entry, restores the prior entry,
+  and writes prior metadata last. Claude Desktop replaces only its Agent Bridge entry.
+  Generic `clients resume` also resumes a reverse journal. The v4 source completion
+  keeps only a bounded credential-free inverse contract. Repair remains monotonic and
+  uninstall stays forward-only. Managed operation summaries preserve the durable
+  manifest version and include the `rollback` kind.
+
+- Add forward-only `clients uninstall` for metadata-owned Codex, Claude Code, and
+  Claude Desktop registrations. Uninstall proves and removes the managed
+  registration, deletes an already private backend file, then deletes management
+  metadata. It never snapshots backend bytes or reverses a completed step. POSIX
+  deletion syncs the private parent directory. Windows verifies deletion and records
+  unavailable directory durability. Native and Desktop writes retain their documented
+  same-user advisory race boundaries.
+  Add `clients resume <operation-id> [--recover-lock]`, which derives repair and
+  uninstall authority from recorded v3 requests, and update or rollback authority
+  from recorded v4 requests. It also accepts pre-v4 update journals. It accepts no
+  replacement identity, runtime, instance, launch, or file locator. Version 2
+  journals remain inspectable only. Generic resume also completes an uninstall
+  interrupted after its final metadata deletion.
+
+- Add plan-first `clients repair` and `clients update` for metadata-owned Codex,
+  Claude Code, and Claude Desktop registrations. Runtime and stable instance locate
+  strict owner-private metadata. Identity binds the record and immutable repair or
+  update request. Repair restores the stored launch contract, while update journals a
+  normalized credential-free launch request.
+  Applied native changes prove remove, absence, add, and exact target before a
+  metadata-last launch update. Desktop replaces only the Agent Bridge entry and
+  preserves unrelated JSON values. Backend privacy repair records only policy proofs
+  and tightens permissions without reading or snapshotting backend content. Full
+  metadata and bounded registration proofs prevent drifted state from advancing a
+  prior journal. Unknown environment keys and unsafe registration fields stop before
+  journal creation. Native update commands reject argument, credential, and URL-like
+  surfaces. Desktop publication uses a private operation-scoped temporary file and
+  detects the checked races that Node can observe, but it cannot provide an OS
+  transaction with Claude Desktop. Same-action same-host resume and stale-lock recovery
+  use the existing operation substrate.
+  New journals use operation format version 3. Version 2 journals remain inspectable,
+  but incomplete records cannot resume without an identity-bound request.
+
+- Give local and edge SQLite initialization a 15-second minimum busy-retry window
+  for concurrent first-start schema work. Normal database operations retain their
+  configured timeout. Concurrency tests also terminate hung child processes before
+  temporary-directory cleanup.
+
+- Add the crash-safe managed-client operation substrate and read-only `clients
+  operations [<operation-id>]` inspection. Owner-private revisioned manifests,
+  immutable ordered step plans, snapshot artifacts, pinned directory identities,
+  per-client locks, and same-host stale-lock proof keep private contents out of JSON
+  and errors. Restart classification distinguishes exact before-state retries,
+  verified after-state advancement, and blocked ambiguity. Snapshot publication never
+  replaces residue, every step requires a verified before-state snapshot, and bounded
+  manifests reject contradictory state. Typed credential-agnostic requests,
+  no-replace before/after artifacts, lock-covered begin, and same-host resume now feed
+  distinct resumable, classification-required, blocked, and complete inspection.
+  Crash-restartable per-artifact cleanup advances `applied` through `cleaning` to a
+  `committed` manifest after verified unlink and POSIX directory sync, or an explicit
+  Windows unavailable-durability result. Exact after-publication and post-intent unlink
+  residue can resume; every other missing or extra artifact blocks. Terminal manifests
+  retain a bounded credential-free completion record. Windows mutations reuse native
+  ACL results only within one held lock and for the same verified directory path
+  identity. File checks, new or resumed locks, and passive inspection recheck the
+  policy. POSIX checks remain per-access. Repair, update, and uninstall use this substrate.
+
+- Add read-only `clients inspect` and plan-first `clients adopt` for Codex, Claude
+  Code, and Claude Desktop. Exact unmanaged registrations can be adopted only with
+  `--apply`, which writes owner-only credential-free management metadata. Inspection
+  reports absent, unmanaged, managed, or drifted state without reading backend values
+  or contacting a gateway. Registration comparison is structural and health-neutral,
+  backend paths enforce the owner-only no-link policy, Desktop inspection shares the
+  installer launch resolver, and apply re-inspects its postcondition. Enrollment-based
+  provision collision behavior is unchanged. Managed metadata also binds Desktop to
+  its normalized config path, Codex to its active profile config, and Claude Code
+  local or project scope to its invocation directory so later operations cannot guess
+  at a registration target.
+
+- Add a pinned, non-root gateway image and a loopback-only Compose development stack.
+  The stack runs migrations separately, creates a restricted runtime login, reads
+  database passwords from private secret files, and retains PostgreSQL data in a named
+  volume.
+- Add a Linux Compose acceptance test for credential-bound identity, targeted delivery,
+  lease settlement, denied runtime access to credential hashes, and PostgreSQL
+  persistence across a full stack restart.
+- Add a deployment guide for production TLS, network isolation, secret handling,
+  backup, upgrade order, and rollback.
+
+### Fixed
+
+- Defer Windows SQLite sidecar ACL application until the opened connection establishes
+  WAL and completes its serialized schema transaction. Concurrent first-open processes
+  no longer race a transient sidecar before their own connection holds it. Replacement
+  during one ACL validation still fails.
+- Treat a Windows SQLite sidecar that disappears during ACL validation as an expected
+  race only when the path remains absent. A replacement or reparse object still fails
+  validation.
+- Handle `-h` and `--help` before command parsing and dispatch so help never opens a
+  backend or performs a command side effect.
+
+### Changed
+
+- Require the exact release commit to pass the full `test.yml` matrix on `main` before
+  release packaging begins. Pin GitHub Actions and reusable workflows to verified
+  commit SHAs.
+- Keep Dependabot's grouped npm updates to patch and minor versions. Major updates now
+  require separate review.
+
+## [0.3.1] - 2026-07-15
+
+### Added
+
+- Add `agent-bridge --version` and `agent-bridge -V` commands that print the
+  installed package version without loading backend configuration.
+
+### Changed
+
+- Clarify the boundary between agent harnesses, host applications, host adapters, and
+  MCP, CLI, HTTPS, and Node library access. Define `AGENT_BRIDGE_INSTANCE` as the
+  stable consumer key used for cursor paths, leases, and presence. Supported installers
+  generate this key, while direct clients may supply it. Document the released
+  no-instance fallbacks and the fact that the key is not a unique live process or
+  session.
+- Require manual release recovery to run the workflow at the tag it publishes so npm
+  provenance identifies the checked-out release source.
+
+## [0.3.0] - 2026-07-15
 
 ### Control, portability, and recovery
 
@@ -77,7 +242,7 @@ not released until the matching tag, GitHub release, and npm package exist.
 - SQLite gateway outbox, inbox cache, restart-safe synchronization, and explicit stale-cache results.
 - Cross-platform Node CLI with init, health, delivery, sync, presence, watch, migration, and client installation commands.
 - Cheap `pending` process gate for unread context or due delivery work.
-- Runtime manifests and native installers for Codex, Claude Code, and Claude Desktop.
+- Host-adapter manifests and native installers for Codex, Claude Code, and Claude Desktop.
 - Runtime-neutral `SKILL.md` guidance and an `llms.txt` package map.
 - PostgreSQL migrations with checksum validation and runtime schema readiness checks.
 - Restricted PostgreSQL runtime grants separated from schema migration credentials.
@@ -86,7 +251,8 @@ not released until the matching tag, GitHub release, and npm package exist.
 ### Changed
 
 - Package identity is `@creatornader/agent-bridge` at version `0.2.0`. The first npm publication was performed manually. OIDC trusted publishing was configured afterward for later releases.
-- Agent identity is process-scoped. Shared config no longer supplies `AGENT_BRIDGE_AGENT`.
+- Agent principal is injected through the client process. Shared config no longer
+  supplies `AGENT_BRIDGE_AGENT`.
 - Exact idempotent replays deduplicate. Reusing a key for changed content returns a conflict.
 - Gateway clients authenticate through separate principal-bound credentials stored in owner-only client backend files.
 - Package-root imports expose the provider-neutral API without starting the MCP server.
@@ -118,5 +284,8 @@ First tagged release. Marks the point where agent-bridge has shipped its initial
 - Narrative-leak detection in CI + on commit via `creatornader/textleaks@v0.2.0` (renamed from leakguard).
 
 [0.1.0]: https://github.com/creatornader/agent-bridge/releases/tag/v0.1.0
-[Unreleased]: https://github.com/creatornader/agent-bridge/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/creatornader/agent-bridge/compare/v0.4.0...HEAD
+[0.4.0]: https://github.com/creatornader/agent-bridge/compare/v0.3.1...v0.4.0
+[0.3.1]: https://github.com/creatornader/agent-bridge/compare/v0.3.0...v0.3.1
+[0.3.0]: https://github.com/creatornader/agent-bridge/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/creatornader/agent-bridge/compare/v0.1.0...v0.2.0