@m-kopa/launchpad-cli 0.27.4 → 0.28.0

package/CHANGELOG.md

@@ -6,6 +6,44 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html);
 pre-1.0 minor bumps may carry breaking changes per ADR 0005.
 
+## 0.28.0 — 2026-06-17
+
+PostHog usage telemetry (sp-phcli2).
+
+- The CLI now records one anonymous/signed-in `command_run` event per command
+  (command name, exit code, duration, CLI version, OS, Node version, `ci`,
+  `environment`) so the platform team can see usage and failures. Identified by
+  your M-KOPA email when signed in, by a local anonymous device-id otherwise.
+- **Never sends your data:** a fixed allowlist means command arguments, paths,
+  env, secrets, repo/app names, and group ids can **not** be transmitted — only
+  the fields above. Email is the only PII, and only on signed-in events.
+- **Never slows or breaks a command:** the event is delivered by a detached,
+  `unref`'d background process after the command finishes (the same pattern as
+  the update check), bounded by a timeout and fully fail-silent.
+- This is internal staff tooling: telemetry is **on by default and cannot be
+  disabled** (`DO_NOT_TRACK` is not honored) — see the new
+  [usage analytics](https://get.launchpad.m-kopa.us/docs/concepts/telemetry)
+  disclosure page and ADR 0027 / the ADR 0014 amendment. A one-time notice is
+  printed on first interactive run.
+
+## 0.27.5 — 2026-06-16
+
+Post-deploy verification — `launchpad deploy` confirms the live deployment
+serves what you shipped (sp-dplvfy).
+
+- After a content deploy commits, the CLI now **waits for the Cloudflare Pages
+  build to settle and then checks the served deployment matches your shipped
+  `index.html`** (by hash). A mismatch — the silent-revert class where the
+  build reads the entrypoint from a different path than your files land at —
+  fails the deploy with exit `65` and a build-config diagnosis, instead of a
+  misleading "success". A failed build exits `1` (with a log excerpt); a build
+  still pending within the timeout is a soft, non-failing outcome.
+- Static apps get a byte/hash compare; react/react+api get a reachability check.
+  Content is compared by hash + length only — never echoed back.
+- New `--no-verify` (skip the wait/check) and `--verify-timeout=<seconds>`
+  (default 180) flags. A status-read hiccup degrades to "couldn't verify"
+  rather than failing a committed deploy.
+
 ## 0.27.4 — 2026-06-16
 
 Self-serve developer-access grants (sp-grnted, Bundle 1).