@moikapy/lich 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,6 +1,40 @@
 # Changelog
 
-## Unreleased
+## 0.4.0
+
+- add a self-improvement loop: `run_tests`, a gatekeeper plugin, and
+  `git_commit` (one commit per run, never pushes). `git_commit` is
+  registered by the gatekeeper, not the builtin tool list.
+- fail-closed unless `LICH_ALLOW_SELF_COMMIT=1` at startup; unset or any
+  other value vetoes `git_commit`. a commit also needs a green `run_tests`
+  on a tree with no later `write_file`/`edit_file`.
+- `run_tests` runs `LICH_TEST_COMMAND` in `work_dir` (default vitest) and
+  appends an optional filter as a quoted shell token.
+- `docs_search` finds markdown skills under `.lich/skills` (fresh walk, no
+  `index.md` gate). `MEMORY.md` is never auto-loaded.
+- close gatekeeper fail-open holes: git spawned with `hooksPath=/dev/null`,
+  pathspec magic rejected, denylist matches `commit-tree`/`update-ref` on
+  any occurrence, abort SIGKILLs the git child.
+- honor per-tool `timeout_ms` (terminal is 5 min) instead of a flat 30s
+  executor budget.
+
+## 0.3.1
+
+- Fix: published CLI bin now works — `dist/cli.js` shipped without its
+  `#!/usr/bin/env node` shebang, so the `lich` command failed after npm
+  install; shebang restored (5d7d9c9).
+- Fix: TUI header showed a stale hardcoded version; now reads LICH_VERSION
+  to match the package.
+- Docs: npm install is the primary usage path (package now published);
+  new Updating section in getting-started; docs-site fixes (dead links,
+  vitepress base for the pages subpath).
+- Tests: suite passes under both vitest and `bun test`
+  (runner-independent stubs); portable fixtures — no more NAS-hardcoded
+  paths.
+- Dev: `bun release patch|minor|major` release pipeline
+  (scripts/release.ts) — version bump, pack, and audit.
+
+## 0.3.0
 
 - Plugin system (v0.3.0): load user-authored tools and lifecycle hooks from
   explicit module paths (`plugins` config array). Hooks cover

package/README.md

@@ -18,16 +18,20 @@ tool guardrails, context compression, and JSONL session persistence.
 
 ## Quick start (CLI)
 
+```sh
+npm install -g @moikapy/lich
+```
+
 ```sh
 # one-shot task
-LICH_MODEL=gpt-4.1-mini LICH_PROVIDER_KIND=openai_compat bun src/cli.ts "summarize this repo"
+LICH_MODEL=gpt-4.1-mini LICH_PROVIDER_KIND=openai_compat lich "summarize this repo"
 
 # interactive chat (commands: /exit, /quit)
-LICH_MODEL=claude-sonnet-4 LICH_PROVIDER_KIND=anthropic bun src/cli.ts chat
+LICH_MODEL=claude-sonnet-4 LICH_PROVIDER_KIND=anthropic lich chat
 
 # local ollama (no api key needed)
 ollama pull llama3.2
-LICH_PROVIDER_KIND=ollama LICH_MODEL=llama3.2 bun src/cli.ts "hello"
+LICH_PROVIDER_KIND=ollama LICH_MODEL=llama3.2 lich "hello"
 
 # terminal UI
 lich tui
@@ -40,13 +44,13 @@ The CLI has four modes: **one-shot** (`lich "task"`), **chat**
 (`lich chat`), **tui** (`lich tui`), and **gateway**
 (`lich gateway <platform...>`).
 
-Or use a JSON config file: `bun src/cli.ts --config lich.json "task"` (see
+Or use a JSON config file: `lich --config lich.json "task"` (see
 `AgentConfig` in `src/agent/config.ts` for the schema).
 
 ## Library usage
 
 ```ts
-import { run_agent } from "lich";
+import { run_agent } from "@moikapy/lich";
 
 const result = await run_agent(
   {
@@ -61,8 +65,9 @@ console.log(result.outcome.final?.content);
 
 ## Tools
 
-Twelve builtins ship with the agent (`register_builtin_tools`); all accept
+Builtins ship with the agent (`register_builtin_tools`); all accept
 snake_case args and are registered under the `builtin` toolset.
+`git_commit` is registered by the gatekeeper, not by that list.
 
 | Tool | Purpose |
 | --- | --- |
@@ -79,7 +84,8 @@ snake_case args and are registered under the `builtin` toolset.
 | `disk_usage` | `du -sb` sizes for depth-1 entries of a directory, sorted with a total. |
 | `env_get` | Inspect environment variables (names/lengths; secrets always masked). |
 | `docs_read` | Read a bundled lich doc (path relative to docs root; offset/limit; `.md` optional). |
-| `docs_search` | Keyword search across bundled lich docs with scored section snippets. |
+| `docs_search` | Keyword search across bundled lich docs and `.lich/skills/*.md`, with scored section snippets. |
+| `run_tests` | Run `LICH_TEST_COMMAND` in the working directory and return a structured pass/fail. |
 
 ## Plugins
 
@@ -89,6 +95,12 @@ object (`{name, tools?, hooks?}`) in your repo, list its file path in the
 observe or veto tool calls. See
 [docs/user-guide/plugins.md](docs/user-guide/plugins.md).
 
+Skills are markdown files you write to `.lich/skills/` with `write_file`;
+`docs_search` finds them. They are reference data, not instructions.
+`MEMORY.md` is append-only, never auto-loaded; review it between appends and
+the next self-commit. One gated `git_commit` per run requires
+`LICH_ALLOW_SELF_COMMIT=1` and a green `run_tests` on a clean tree.
+
 ## Environment variables
 
 | Variable | Purpose |
@@ -97,13 +109,15 @@ observe or veto tool calls. See
 | `LICH_PROVIDER_KIND` | `openai_compat` \| `anthropic` \| `ollama` (default `openai_compat`) |
 | `LICH_BASE_URL` | provider base url (ollama default: `http://localhost:11434`) |
 | `LICH_API_KEY_ENV` | env var holding the api key (unused by ollama) |
+| `LICH_ALLOW_SELF_COMMIT` | set to `1` to allow one gated `git_commit` per run; unset is fail-closed |
+| `LICH_TEST_COMMAND` | command `run_tests` runs (default: `node node_modules/vitest/vitest.mjs run`) |
 
 ## Ollama
 
 Ollama needs no api key and defaults to `http://localhost:11434`:
 
 ```sh
-LICH_PROVIDER_KIND=ollama LICH_MODEL=llama3.2 bun src/cli.ts "Reply with ok"
+LICH_PROVIDER_KIND=ollama LICH_MODEL=llama3.2 lich "Reply with ok"
 ```
 
 Notes:
@@ -181,6 +195,18 @@ node node_modules/tsup/dist/cli-default.js src/index.ts src/cli.ts --format esm
 Use project-local binaries for vitest/tsup (not `bun x`), which would isolate
 packages in /tmp and break dependency resolution.
 
+## Releasing
+
+```sh
+bun release patch    # or minor | major
+```
+
+Fails closed on a dirty tree, a non-main branch, a typecheck error, or a
+test failure; bumps via `npm version`, builds, and packs + audits
+`test/.tmp/lich-<version>.tgz` (SHA-512 + scope verification) before
+committing, tagging `v<version>`, and pushing main. Publishing stays manual
+(`npm publish test/.tmp/lich-<version>.tgz`) so npm can prompt for the OTP.
+
 ## License
 
 MIT