@moikapy/lich 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -1,6 +1,79 @@
 # Changelog
 
-## 0.7.0 (unreleased)
+## 0.8.0 (unreleased)
+
+- TUI session resume (Phase 1): `lich --resume <id|latest>` loads an existing
+  JSONL transcript into the TUI history and shows a `resumed <id> (n messages)`
+  banner. One-shot, chat, and gateway reject `--resume`.
+- Incremental session persistence (Phase 2): Agent appends transcript records
+  as the loop emits (`llm_end`, `tool_call_end`, `budget_exhausted`,
+  `compress_end`) instead of a post-run bulk write. TUI opens one
+  `SessionHandle` per launch and passes it into every `agent.run`; one-shot,
+  chat, and gateway keep per-run files. Append failures warn and never fail
+  the run.
+- TUI `/resume <id|latest>` (Phase 3): same resolve + load path as `--resume`,
+  resets the on-screen transcript with a meta notice, seeds agent history for
+  the next turn, and updates the resume banner. Does not change persistence.
+
+## 0.7.1
+
+- close agent-core review must-fixes A-1–A-4: multi-turn runs stop
+  duplicating history, tool pairs survive compression and gateway history
+  caps, and a mid-call abort becomes `stopped_reason: aborted` with the
+  abort signal reaching in-flight tools.
+- harden the webhook gateway (G-1/G-2/G-3/G-5): binds to loopback by
+  default and requires a token when exposed, defaults public platforms
+  (telegram/discord/twitch) to deny with a configurable allowlist plus a
+  reduced safe toolset, catches telegram/discord reply send failures
+  instead of crashing the run, and forces `platform=webhook` on the HTTP
+  adapter.
+- close MCP exit (M-1), empty Anthropic text, and env provider fallback:
+  one-shot/chat/TUI/gateway runs call `Agent.close()` so stdio MCP
+  sessions release; node children are still `unref`'d so the event loop
+  can drain (bun keeps the child attached — see below). an empty
+  Anthropic text block no longer 400s the session permanently, and
+  mcp-only project configs no longer shadow `LICH_MODEL` / env providers.
+- close tools must-fixes S-1–S-5: file writes/edits resolve realpath so
+  symlink escapes are confined, `fetch_url`/`http_request` block private
+  and loopback URLs, `.lich/config.json` and `.env` are forbidden write
+  targets, terminal child env is scrubbed of provider secrets, and
+  dash-leading `run_tests` filters are rejected so they cannot open the
+  commit gate. `http_request` also strips IPv6 brackets before SSRF IP
+  classification so `[::1]` literals are not skipped, and asserts headers
+  through `Headers` after the `safe_fetch` merge.
+- isolate usage per run (A-5) and memoize MCP attach (A-6): concurrent
+  `Agent.run` calls no longer mix `usage_total`, and attach races can
+  neither skip nor permanently fail.
+- TUI: ignore message submit while a run is in flight (U-1), and walk the
+  newest-first recall ring so Up moves to older entries instead of
+  clamping on the newest (U-2).
+- pin outbound HTTP: `fetch_url` and `http_request` keep the https
+  hostname for TLS/SNI and the `Host` header while `safe_fetch` pins the
+  connect to a vetted public IP through a custom DNS `lookup`, and
+  re-validates every redirect hop. the operator opt-out is exact:
+  `LICH_ALLOW_PRIVATE_URLS=1`; unset or any other value is fail-closed
+  (private/loopback URLs blocked).
+- harden `grep_files`: the directory walk skips symbolic links (same
+  skip path as `SKIP_DIRS`), and every candidate read runs
+  `assert_file_tool_access`, so `.lich/config.json` is denied with
+  `forbidden_path: .lich/config.json`.
+- twitch gateway: `PRIVMSG` matching is anchored (`^:... PRIVMSG #...
+  :...$` after the optional tags strip), so `USERNOTICE` and
+  `WHISPER` lines are not chat and cannot spoof the allowlist.
+- bun stdio MCP children are no longer `unref`'d: one-shot and
+  short-lived runs wait for the MCP answer instead of letting the child
+  detach and exit early.
+- add CI (tsc + vitest on Node 20/22), sync the 0.7.0 user docs with this
+  tree, and make `edit_file` treat `$` sequences literally while allowing
+  an empty `new_string` (#57).
+- sync docs/architecture with the outbound-HTTP pin, grep hardening,
+  twitch anchor, and bun MCP exit changes (#61).
+- add a manual Release workflow: Actions → Release → Run workflow (from
+  `main`) with a `patch|minor|major` bump runs `bun release`, then
+  publishes the packed tarball to npm with `NPM_TOKEN`. maintainer
+  plumbing, not a runtime change (#62).
+
+## 0.7.0
 
 - add a general MCP client. `mcp_servers` is a closed record of named
   stdio or loopback-http entries, default off. tool names are
@@ -14,10 +87,7 @@
   add uses the catalog or `--command`/`--url`, stays disabled, and
   updates `.lich/config.json` through the existing writer without
   dropping other keys.
-- sync user docs with this tree. the published package is 0.6.0
-  (`lich --version` reads package.json). MCP commands are not in that
-  package. CLI, config, plugin load, and sidebar links match the code.
-  0.7.0 is not released.
+- sync user docs with this tree. MCP is included in the 0.7.0 package.
 
 ## 0.6.0
 

package/README.md

@@ -15,7 +15,7 @@ mythology lives in display strings only.
 | --- | --- | --- |
 | **phylacteries** | JSONL session files in `.lich/sessions/` — conversations survive process death | This glossary; TUI `/sessions` listing label |
 | **vessel-hopping** | Provider failover: 429/5xx retried with backoff, then the next provider takes over | This glossary |
-| **the lair / wards** | `work_dir` confinement + `path_escape` guardrails | This glossary |
+| **the lair / wards** | `work_dir` confinement + `path_escape` guardrails for file tools. Wards do **not** apply to `terminal` or `run_tests` (shell still runs in `work_dir`; secret env names are scrubbed on spawn). | This glossary |
 | **lair actions** | Plugin hooks that observe or veto tool calls | This glossary |
 | **familiars** | Gateway adapters (webhook/telegram/discord/twitch) routing into one shared agent | This glossary |
 | **spells** | Builtin tools in the registry | This glossary |
@@ -101,7 +101,7 @@ snake_case args and are registered under the `builtin` toolset.
 | `edit_file` | Replace a unique string in a file, with an optional replace-all. |
 | `list_dir` | List a directory tree iteratively (dirs first, file sizes). |
 | `terminal` | Run a shell command via `bash -lc` and capture output plus exit code. |
-| `grep_files` | Regex search across files, skipping node_modules/.git/dist and binaries. |
+| `grep_files` | Regex search across files, skipping node_modules/.git/dist, symlinks, and binaries; `.lich/config.json` is denied. |
 | `fetch_url` | GET an http(s) URL and return the body text with a status header. |
 | `web_search` | Web search via DuckDuckGo's HTML endpoint (no api key). |
 | `http_request` | Generic HTTP calls (method/headers/body) for REST-ish APIs. |
@@ -137,6 +137,7 @@ the next self-commit. One gated `git_commit` per run requires
 | `LICH_BASE_URL` | provider base url (ollama default: `http://localhost:11434`) |
 | `LICH_API_KEY_ENV` | env var holding the api key (unused by ollama) |
 | `LICH_ALLOW_SELF_COMMIT` | set to `1` to allow one gated `git_commit` per run; unset is fail-closed |
+| `LICH_ALLOW_PRIVATE_URLS` | set to exactly `1` to let `fetch_url` / `http_request` reach private or loopback URLs; unset or any other value is fail-closed (blocked) |
 | `LICH_TEST_COMMAND` | command `run_tests` runs (default: `node node_modules/vitest/vitest.mjs run`) |
 
 ## Ollama
@@ -254,12 +255,13 @@ command, or loopback HTTP). The game connects **to** lich through the webhook
 and [`examples/game_bridge`](examples/game_bridge/README.md). Default is off.
 `mcp_servers` is a closed record. Names are `mcp_<server>_<tool>`. `npx`,
 `npm`, `bunx`, `uvx`, `curl`, `wget`, remote URLs, and shell metacharacters
-are refused.
+are refused. On Bun, stdio children are not `unref`'d, so a one-shot or
+other short-lived run waits for the MCP answer instead of exiting while
+the child is still working; `agent.close()` (which every CLI mode calls)
+kills the child.
 
-This source has `lich mcp list|add|enable|disable|remove` (changelog 0.7.0,
-unreleased). The published npm package is 0.6.0 and does not include those
-commands; `lich --version` still prints `0.6.0` because it reads
-`package.json`. From a clone: `bun src/cli.ts mcp list`. Redot is a catalog
+This source has `lich mcp list|add|enable|disable|remove` (changelog 0.7.0).
+From a clone: `bun src/cli.ts mcp list`. Redot is a catalog
 entry (`redot --headless --mcp-server`), not a fork inside lich. Godot has
 no official MCP server; lich does not download a community addon. See
 [docs/user-guide/redot.md](docs/user-guide/redot.md).
@@ -277,15 +279,42 @@ packages in /tmp and break dependency resolution.
 
 ## Releasing
 
+Update `CHANGELOG.md` first so the new version notes match what you ship
+(GitHub release labels / automated notes are a follow-up).
+
+### GitHub Actions (preferred)
+
+Requires the `NPM_TOKEN` repository secret (npm **automation** or
+granular token with publish access to `@moikapy/lich` — not a classic
+token that needs interactive OTP, which `npm publish` in CI cannot
+answer). It is typically already configured; if not, add it under
+**Settings → Secrets and variables → Actions → New repository secret**.
+1. Ensure Actions can push commits/tags to `main` (repo
+   **Settings → Actions → General → Workflow permissions**: read and
+   write; if branch protection blocks `GITHUB_TOKEN`, allow GitHub Actions
+   to bypass or push to `main`).
+2. Run: **Actions → Release → Run workflow** (from `main` only) → choose
+   `bump` (`patch` / `minor` / `major`, default `patch`).
+
+The workflow runs `bun release <bump>` (typecheck, test, bump, build,
+pack + audit, commit, tag, push — no force-push), then
+`npm publish test/.tmp/lich-<version>.tgz --access public` with
+`NODE_AUTH_TOKEN` from `NPM_TOKEN`. It refuses to publish if the pack
+file is missing. Permissions include `id-token: write` for a future npm
+OIDC trusted-publishing switch; today the token path is what works.
+
+### Local
+
 ```sh
 bun release patch    # or minor | major
+npm publish test/.tmp/lich-<version>.tgz
 ```
 
 Fails closed on a dirty tree, a non-main branch, a typecheck error, or a
 test failure; bumps via `npm version`, builds, and packs + audits
 `test/.tmp/lich-<version>.tgz` (SHA-512 + scope verification) before
-committing, tagging `v<version>`, and pushing main. Publishing stays manual
-(`npm publish test/.tmp/lich-<version>.tgz`) so npm can prompt for the OTP.
+committing, tagging `v<version>`, and pushing main. Local publish stays
+interactive so npm can prompt for OTP.
 
 ## License