@lawaty/lacode 1.0.2 → 1.1.0

package/CHANGELOG.md

@@ -7,6 +7,81 @@ All notable changes to LaCode are recorded here. The format follows
 Versions come from git release commits; the npm version is bumped in the same
 commit as the changelog entry it describes.
 
+## [1.1.0] — a map contract, feedback, and host credential sync
+
+### Added
+
+- **A one-time feedback hint, the `lacode feedback` command, and GitHub issue
+  templates.** The hint is local only: no telemetry, no analytics, and it sends
+  nothing anywhere. It shows at most once, only when a TUI sink exists, and a
+  toast that fails does not consume it. Opt out with `feedbackHint: false` or
+  `LACODE_NO_FEEDBACK_HINT=1`; the flag is
+  `~/.local/share/opencode/lacode/feedback.json`.
+- **The post-publish host sync now syncs provider credentials.** After
+  `npm publish`, `scripts/sync-hosts.mjs` copies the allowlisted providers from
+  the local opencode auth store (`OC_AUTH_PROVIDERS`, default
+  `opencode-go opencode`) to each host, keeps host-only providers, and writes
+  the remote `auth.json` atomically with a timestamped backup.
+
+### Changed
+
+- **The context map has one entry schema, a per-file budget and a per-file
+  lifecycle.** Every navigation entry is a provenance marker (`[binding]`,
+  `[provisional]` or `[disputed]`), a rule of at most three non-blank lines, and
+  a `— See <path>[ §Section] (verified YYYY-MM-DD)` pointer. No Context /
+  Decision / Consequences / Alternatives blocks. Every file has a hard cap in
+  non-blank lines (architecture 150, contexts 200, conventions 150, workflows
+  150, decisions 120, active 60). The 30-day provisional window generalises the
+  active backlog's 7-day finished-task window; binding and disputed entries are
+  exempt, and an entry whose source is gone is never auto-dropped.
+- **The prompt now lives in `src/lib/cartographer-prompt.ts`,** with the tracked
+  copy at `.opencode/prompts/context.txt`; a test pins equality so a reviewer
+  reads the text the model actually runs.
+
+### Fixed
+
+- **`LACODE_SYNC_DRY_RUN=1` no longer contacts a host.** It used to print the
+  plan and then SSH to every host to exercise the credential helper when a local
+  auth store existed, which sent provider credentials during a “dry run”. It now
+  reads only the local plan and prints the auth summary; no SSH and no `npm view`.
+- **The post-publish host sync accepts a real `opencode.jsonc`.** Comments and
+  trailing commas no longer make a host fail as “config not normalized
+  (unparseable)”.
+- **A constraints file is no longer a deliberation ledger.** `decisions.md` is
+  capped, decision-record blocks are a schema violation, and the prompt tells
+  the cartographer to state the constraint and point at the page that owns it.
+- **Restatement and drift are now reported instead of silently trusted.** After
+  every run the map is audited for dangling paths/sections, a numeric claim
+  absent from its cited source, a possible negation conflict, a source modified
+  after `verified`, tables/fenced blocks/verbatim spans, duplicate rules,
+  archive-of-record language and charter degeneration. The audit is
+  **report-only**: it never rewrites a claim and never deletes content with no
+  source, because the map may be the only copy and the page may be the stale
+  side. A failure is a loud `context map validation failed` error.
+- **The lifecycle no longer belongs to one file.** `active.md` still uses its
+  seven-day finished-task window; every other file now expires provisional
+  entries after 30 days, and only when the cited source still resolves.
+
+## [1.0.3] — one notification even when the plugin is loaded twice
+
+### Fixed
+
+- **A question or permission popup is raised once when two LaCode instances share
+  a process.** opencode auto-discovers every file under
+  `~/.config/opencode/plugins/`, so a host that also lists `@lawaty/lacode` in
+  `opencode.jsonc` loaded two copies. `done` was already deduplicated by the
+  completion marker, but the notification claim treated any claim holding our
+  own pid as ours — indistinguishable between two instances in one process. The
+  claim now carries a per-instance token, so the second instance loses while the
+  same instance may still raise a new prompt.
+
+### Changed
+
+- **Publishing syncs the published version to every host.** `postpublish` runs
+  `scripts/sync-hosts.mjs`: it installs `@lawaty/lacode@<version>`, normalises
+  each host's config to a single LaCode entry (preserving its options), disables
+  stale auto-discovered shims, and warns when a host cannot run the helper.
+
 ## [1.0.2] — the permission chime plays when the popup appears
 
 ### Fixed

package/README.md

@@ -104,6 +104,23 @@ In a repository with no `.opencode/context/` yet, the first session builds it in
 the background; `/context-init` forces it, and [Context map](#context-map)
 explains what it is for.
 
+## Feedback
+
+The feedback path has no telemetry and no analytics — it sends nothing anywhere
+— but I would still like to hear from you.
+
+- **Bug or feature request?** [Open an issue](https://github.com/lawaty/lacode/issues).
+- **Question, or want to say how you use it?** [Start a discussion](https://github.com/lawaty/lacode/discussions).
+- **Found it useful?** A ⭐ on [the repo](https://github.com/lawaty/lacode) helps
+  other people find it.
+
+`lacode feedback` prints both links. The one-time hint that points at the issue
+tracker is opt-out: set `feedbackHint: false` in the plugin options, or
+`LACODE_NO_FEEDBACK_HINT=1` in the environment. It is shown at most once, only
+when there is a TUI to show it in; piped, CI and test runs leave the flag
+untouched. A toast that fails does not consume the note, so a later interactive
+run can still show it.
+
 ## Configure
 
 Plugin options are a tuple — the package name, then an options object. Every
@@ -133,6 +150,7 @@ option is optional:
 | `reapMs` | `30000` | Hang-reaper interval. |
 | `probeMs` | `900000` | How often benched models are checked by actually using them. `0` turns the periodic check off and leaves the `pool_recheck` tool as the only way to ask. |
 | `selfUpdate` | `true` | Check for a newer release at most once per ~6h and install it in the background; it applies on the next opencode start. `false` — or `LACODE_NO_SELFUPDATE=1` — turns the check off. |
+| `feedbackHint` | `true` | Show the one-time feedback note on the first interactive run. `false` — or `LACODE_NO_FEEDBACK_HINT=1` — turns it off. The flag lives in `~/.local/share/opencode/lacode/feedback.json`; nothing is sent anywhere. |
 | `sound` | `true` | Play a short tone with each notification, one per outcome, so you can tell a finished session from a question or a permission prompt without reading the popup. It is opt-out: `false` — or `LACODE_SOUND=0` (`false`, `off`, `no` work too, and beat the option) — turns the sound off, and anything else, a typo included, leaves it on. |
 | `omniroute` | — | Optional [OmniRoute](docs/OMNIROUTE.md) gateway integration. Absent or `{ enabled: false }` changes nothing. |
 | `watchMs` | `1000` | How often the pool files are checked for changes. `0` disables live reload. |
@@ -393,12 +411,13 @@ and **Deny**, and macOS gets a plain notice without buttons.
 `lacode forward HOST -- COMMAND` runs a command on another host over ssh and
 exits with its status.
 
-The full CLI is `notify`, `forward`, `doctor`, `version`, `update`, `receive`
-and `tunnel setup`. `version` reports which copy of LaCode is running — and
-whether opencode is loading that same copy — and `update [--check]` refreshes an
-installed one. `receive` is the desktop end of the tunnel (the forced command a
-remote key is restricted to) and `tunnel setup` provisions the key and the
-forward.
+The full CLI is `notify`, `forward`, `doctor`, `feedback`, `version`, `update`,
+`receive` and `tunnel setup`. `version` reports which copy of LaCode is running —
+and whether opencode is loading that same copy — and `update [--check]` refreshes
+an installed one. `feedback` prints the Issues and Discussions links; it opens
+nothing and sends nothing. `receive` is the desktop end of the tunnel (the forced
+command a remote key is restricted to) and `tunnel setup` provisions the key and
+the forward.
 
 Configuration, the payload format, the receiver contract and holding the forward
 open are in [docs/TUNNEL.md](docs/TUNNEL.md).