@murphai/murph 0.1.17 → 0.2.3

package/CHANGELOG.md

@@ -2,6 +2,368 @@
 
 All notable changes to `@murphai/murph` will be documented in this file.
 
+## [0.2.3] - 2026-04-10
+
+### Fixed
+- harden resolved runtime config ownership
+- restore hosted and release boundaries
+- include imessage in runner bundle closure
+
+### Changed
+- privacy
+- resolve hosted env semantics at the Cloudflare boundary
+- cut duplicated workflow guidance
+- isolate node-runner env from device sync
+- restore explicit audit-pass authorization
+- trim workflow defaults
+- simplify task router table
+
+## [0.2.2] - 2026-04-09
+
+### Fixed
+- tighten workspace dependency boundary checks
+- serialize workspace artifact writers
+- scrub oauth callback state
+- wake automation loop for next-turn batching
+- align incur command-surface descriptors
+
+### Changed
+- clean coordination ledger
+- restore hosted web build env placeholders
+- bump review-gpt to 0.5.52
+- prepare built cli runtime artifacts
+- restore hosted web verify env plumbing
+- commit current worktree updates
+- unify health registry family seams
+- split parser helpers
+- remove dead vault upgrade seam
+- centralize hosted wake hint parsing
+- simplify deploy scripts
+- clean ledger and restore green verification
+- use native incur config schema output
+- simplify incur surface helpers
+- require gpt-5.4-mini coverage audit
+
+## [0.2.1] - 2026-04-09
+
+### Added
+- add hosted telegram typing feedback
+- add hosted linq typing feedback
+- add blood-test bootstrap overview signal
+- add automation overview signal
+- add journal and document overview signals
+- add more user-centric overview signals
+- add experiment and wearable overview signals
+- add bootstrap vault overview prompt
+- batch adjacent chat auto-replies
+- add vercel ai gateway support
+
+### Fixed
+- unblock app verification and acceptance
+- stabilize cron handling and prompt guidance
+- split memory create and update commands
+- stabilize profile hard-cut follow-ups
+- make prompt access mode explicit
+- update Murph identity prompt copy
+- restore release check assertions
+- skip local first-contact intro
+- inject user-local day into system prompt
+- recover safe auto-replies on startup
+- load prisma env.local for prisma cli
+- recover stale codex resume sessions
+- link setup runtime modules
+- point hosted auth legal links at bundled pdfs
+- restore green verification
+- clean smoke bundle build output
+- default hosted vercel gateway zdr
+- add gateway-core source alias
+- canonicalize cloudflare dispatch outcomes
+- split hosted execution outbox outcome state
+- ignore local incur config in hosted cli runs
+- land residual review seams
+- remove query boundary leak
+- simplify assistant wizard flow test
+
+### Changed
+- stabilize cli and setup coverage harnesses
+- restore audit prompt references
+- trim completion workflow duplication
+- stabilize package coverage lane
+- share workspace source import resolution
+- require owner coverage verification
+- add coverage seam regression suite
+- lower shared per-file thresholds
+- generalize vitest tooling coverage
+- keep typecheck package-local
+- widen typecheck coverage
+- Update first-contact-welcome.ts
+- update system prompt
+- simplify prompt helper wiring
+- simplify murph prompt guidance
+- rename bound vault cli tool
+- centralize telegram typing transport
+- clarify blood-test prompt wording
+- trim dead unit preference state
+- share hosted typing lifecycle
+- extract hosted typing orchestration
+- clean history prompt wording
+- fix widened typecheck failures
+- drop dead history helper
+- hard-cut history into projected events
+- hard-cut profile into preferences and memory
+- clean prompt access surface copy
+- simplify vault overview aggregation
+- simplify local verification lanes
+- centralize build cleanup paths
+- align acceptance command docs
+- sync verification command docs
+- drop profile query and assistant surfaces
+- clarify smoke integrity lane
+- restore sane shared timeouts
+- default app verifies to serial
+- add explicit acceptance alias
+- split local and acceptance verification scripts
+- speed up local typecheck harness
+- hard-cut unit preferences to canonical singleton
+- relabel activity overview as workout
+- finalize
+- aggregate package coverage failures
+- add optional coverage-write audit pass
+- simplify startup auto-reply recovery
+- trim duplicate web verify work
+- raise local coverage parallelism
+- stabilize coverage verification
+- remove greenfield compatibility baggage
+- restore inbox loader ownership
+- speed up coverage lane
+- fix telegram env ownership
+- cache package no-emit state
+- stabilize release-check regressions
+- extract next review seams
+- simplify hosted smoke parser proof
+- extract follow-up review seams
+- add hosted runner image smoke
+- clear hosted cleanup coordination row
+- finish greenfield lookup and dispatch seams
+- extract setup and operator helper seams
+- finalize hosted legal pdfs
+- upgrade Node baseline to 24.14.1
+- forbid docs-only data-model patches
+- clear remaining repo acceptance blockers
+
+## [0.2.0] - 2026-04-08
+
+### Added
+- auto-submit hosted phone auth code
+- add hosted phone sign-in dialog
+- add hosted Stripe billing portal handoff
+- normalize auth action sizing
+- increase default input height
+- autofocus invite verification code input
+- add vercel analytics providers
+- delete linq messages after hosted commit
+
+### Fixed
+- restore green clean workspace
+- narrow runner container build context
+- harden hosted runtime redaction
+- harden attachment path persistence
+- restore root verification green
+- harden device ingest boundaries
+- unblock hosted deploy bundle
+- add built package smoke proof
+- harden runner bundle contract
+- align package coverage configs and restore typecheck
+- move section labels above cards, remove duplicates
+- remove extra top padding from messaging cards
+- deduplicate messaging labels and hide save button when unlinked
+- derive local service contracts from owners
+- restore runtime error entrypoints
+- restore inboxd-imessage package shape
+- restore workspace verification
+- keep hosted auth redirect local
+- restore homepage public auth mode
+- hide homepage auth for signed-in users
+- simplify hosted phone auth cta
+- tidy hosted sign-in phone copy
+- shorten hosted sign-in dialog copy
+- remove hosted sign-in phone hint
+- move hosted privy provider to app shell
+- resume hosted invites after checkout cancel
+- guard hosted invite verify rehydration
+- restore workspace metadata after bundle build
+- prepare hosted artifacts before verify
+- scope raw assets by owner
+- wire food autolog hooks in assistant flows
+- land downloaded audit patch
+- tighten helper public surface
+- guard hosted billing portal route origin
+- show hosted activation progress after checkout
+- rely on privy hook state during signup
+- align hosted privy auth with local-storage sessions
+- warm per-user runner containers safely
+- pin active phone auth attempt
+- reduce hosted privy auth burst traffic
+- keep invite code flow out of phone entry
+- trim hosted latency regressions
+- tune prisma pooled runtime
+- raise hosted onboarding transaction max wait
+- stabilize prisma singleton
+- improve hosted onboarding route diagnostics
+- repair package test regressions
+- drain active webhook dispatches
+- make join invite send-code button full width
+- tighten package export boundaries
+- defer assistant cli adapter path resolution
+- green and speed up cloudflare verify
+- surface hosted onboarding config errors
+- remove duplicate join invite CTA
+
+### Changed
+- stabilize runner timeout assertion
+- close remaining active plan paths
+- tighten package entrypoints
+- narrow assistant delivery seams
+- land code-quality patch cleanup
+- remove hosted fallback paths
+- split command factory seams
+- simplify timeline helpers
+- green package coverage and harden runtime-state tests
+- narrow identity and stripe lookups
+- drop legacy assistant vault path helper
+- consolidate shared helper owners
+- narrow assistant-delivery journal seam
+- extract edit command input helpers
+- simplify shared vault cli bootstrap
+- remove legacy verifier guards
+- add composability seam notes
+- close package coverage gaps
+- simplify hosted onboarding stores
+- get package coverage green
+- tighten leaked package surfaces
+- share knowledge contracts
+- add deterministic coverage seams
+- extract setup wizard and http protocol seams
+- drop legacy raw manifest and imessage shims
+- close final test cleanup plans
+- get package-local coverage green
+- get package green above local coverage thresholds
+- share query runtime owner types
+- clean up remaining test seams
+- get package green
+- unify package coverage policy
+- remove dead internal helpers
+- dedupe prompt output capture helpers
+- mark assistant-engine threshold lane complete
+- remove http test seam
+- finish assistant-engine threshold coverage
+- simplify importer test seams
+- simplify package seam coverage
+- narrow assistant-engine coverage gaps
+- remove assessment test barrel seam
+- dedupe wizard inference assertions
+- add event attachment coverage
+- add event threshold coverage
+- raise package coverage
+- raise package-local coverage
+- finish package coverage
+- add deterministic memory wrapper coverage
+- raise package coverage proof
+- add core coverage branches
+- cover Oura normalization branches
+- restore package coverage
+- simplify cli-entry imports
+- clean up runtime and workout imports
+- simplify built runtime loader helpers
+- dedupe vault-usecases imports in canonical lock test
+- simplify record service barrel imports
+- drop redundant device-sync reset
+- simplify device-sync imports
+- dedupe device daemon process mocks
+- clean up more test import patterns
+- clean up more test import patterns
+- dedupe bin import helper
+- clean up more test import patterns
+- clean up hacky import patterns
+- clean up settings page design and copy
+- remove lazy package boundary import
+- add package-local coverage suite
+- add product marketing context
+- inline device-daemon child fixture
+- align foreground logging assertions
+- clear coverage rollout ledger
+- add package coverage commands
+- add memory and shares coverage cases
+- raise package coverage
+- use published murph package in runner bundle
+- forbid pnpm verify-deps bypass
+- add hosted privy session diagnostics
+- finish package-wide coverage rollout
+- align package coverage helper usage
+- load imessage via optional seam
+- split imessage owner package
+- align inbox imessage split seams
+- finalize runner leaf artifact cleanup
+- trim hosted phone auth wrappers
+- stop enforcing pnpm verify-before-run
+- split invite phone auth wrapper
+- raise telegram and persist coverage
+- tighten cloudflare runner artifact contract
+- harden runner bundle assembly
+- raise rollout package gates
+- remove file whitelists from coverage and split runners
+- close package coverage thresholds plan
+- add scoped coverage thresholds
+- expand follow-up helper coverage
+- split oversized hosted components
+- expand package coverage
+- align cloudflare runner artifact contract
+- expand helper coverage
+- expand package coverage rollout
+- expand helper coverage
+- expand package helper coverage
+- expand client coverage
+- expand config helper coverage
+- add package boundary hygiene rules
+- centralize vault family registry
+- stand up initial vitest suites
+- tighten assistant package boundaries
+- finish deploy artifact cleanup
+- tighten public surface
+- unify canonical markdown document writes
+- remove assistant-engine inbox runtime duplicates
+- package hosted runner as built artifact
+- add diff-aware verification lane
+- widen package coverage acceptance lane
+- simplify hosted phone auth flow
+- Update button.tsx
+- move invite send-code confirm off critical path
+- split invite and public phone auth flows
+- clear closed review-gpt row
+- bump to 0.5.51
+- remove shadow thread wake helpers
+- clear stale coordination ledger entries
+- clear full hosted assistant env in node-runner cases
+- make cloudflare node-runner env-stable
+- remove dead compatibility helpers
+- keep hosted member slices nested
+- refresh data-model seam review
+- share deploy automation helpers
+- simplify chatgpt watch helpers
+- split telegram webhook payload helpers
+- speed up backpressure route tests
+- Update deploy-cloudflare-hosted.yml
+
+## [0.1.18] - 2026-04-07
+
+### Fixed
+- tweak first-contact onboarding copy
+- update hosted deploy secret wiring
+- support interactive npm publish auth
+
+### Changed
+- tighten workspace package exports
+
 ## [0.1.17] - 2026-04-07
 
 ### Added

package/README.md

@@ -10,7 +10,7 @@ The repo implementation happens to live in `packages/cli`, but that is a maintai
 
 If you want a local, inspectable assistant that keeps durable truth in normal files you can read, this is the package you install.
 
-Runtime: Node `>= 22.16.0`.
+Runtime: Node `>= 24.14.1`.
 
 Supported host setup path: macOS and Linux. iMessage remains macOS-only.
 
@@ -57,8 +57,8 @@ When you need to read from the vault, use this chooser:
 - `vault-cli show <id>` for one exact canonical read id, including stable family ids such as `meal_*` or `doc_*`
 - `vault-cli list` for structured filtering by family, kind, status, stream, tag, or date range
 - `vault-cli search query --text "..."` for fuzzy recall or remembered phrases
-- `vault-cli timeline` for chronology across journals, events, assessments, profile snapshots, and sample summaries
-- `vault-cli profile show current` for the current synthesized profile
+- `vault-cli timeline` for chronology across journals, events, assessments, and sample summaries
+- `vault-cli memory show` plus targeted `vault-cli knowledge ...` reads for saved user context
 - `vault-cli wearables day` or `wearables ... list` for semantic wearable summaries
 - family `manifest` commands for immutable import provenance
 
@@ -91,6 +91,20 @@ pnpm install --frozen-lockfile
 pnpm onboard --vault ./vault
 ```
 
+For package-local CLI iteration, use the source-first test lane:
+
+```bash
+pnpm --dir packages/cli test
+```
+
+For the explicit built-runtime and package-shape acceptance lane, use:
+
+```bash
+pnpm --dir packages/cli verify
+# or the repo-composed CLI acceptance entrypoint
+pnpm verify:cli
+```
+
 If `pnpm` is not available yet, use:
 
 ```bash
@@ -99,11 +113,13 @@ If `pnpm` is not available yet, use:
 
 ## Config defaults
 
-The CLI supports incur's built-in config loading for command option defaults. By default it searches `~/.config/murph/config.json` and then `~/.config/vault-cli/config.json`.
+The CLI supports incur's built-in config loading for command option defaults. By default it searches `~/.config/murph/config.json`.
+
+Those incur config defaults are local CLI convenience only. Hosted execution does not snapshot or honor `~/.config/murph/config.json`; portable runtime behavior must live in canonical vault state or typed operator config under `~/.murph/config.json`.
 
 - `murph --config <path> ...` selects an explicit config file
 - `murph --no-config ...` disables config loading for a single run
-- the published package now ships `config.schema.json` so editors can validate and autocomplete those config files
+- the published package now ships Incur's native `config.schema.json` so editors can validate and autocomplete those config files
 
 Config files only supply command `options`, following incur's nested `commands` shape. For example:
 
@@ -119,6 +135,8 @@ Config files only supply command `options`, following incur's nested `commands`
 }
 ```
 
+The shipped schema is the direct Incur output for config defaults only. Command help text, hints, examples, and agent-facing discovery stay on Incur's normal `--help` and `--llms` surfaces instead of a Murph-specific schema extension.
+
 To refresh the shipped schema artifact from the built CLI entrypoint during package work:
 
 ```bash