@njeybe/nativ 2.3.0 → 2.4.0

package/CHANGELOG.md

@@ -1,5 +1,58 @@
 # Changelog
 
+## 2.4.0
+
+### Added
+
+- **Learnings.** `nativ learn propose` (and the `nativ_learn_propose` MCP tool) records a project
+  lesson the contracts do not capture. A human approves it with `nativ learn approve` in an
+  interactive terminal, after seeing the full lesson; a lesson that changed during review is not
+  decided. Approved lessons reach `nativ task next --json` as `learnings`, scoped to the task's
+  role and target files, at most five.
+- **Verify phases.** `verifyPhases` in `.nativ/config.json` lists checks (type check, lint) that
+  run before every task's own command in `nativ verify` (once per batch), the `task complete`
+  gatekeeper and Studio dispatch. They are always read from the main checkout, and an unreadable
+  config fails verification instead of skipping it. A failure names the phase, in Studio too.
+- **Escalation history.** `nativ task next --json` adds `priorEscalations`: the task's settled
+  escalations with how each was settled, so a worker does not raise a settled gap again.
+- **Explorer agent.** An `explorer` subagent with only Read, Grep and Glob (Sonnet; the project
+  manager passes Haiku for a quick lookup) maps existing code: layout, components, routes, data
+  models, conventions, drift against the contracts, and suggested target files for a feature. The
+  architect saves its report as `.ai/codebase_map.md` after the human approves, stamped with the
+  commit it describes.
+- **Harness checks in `nativ doctor`.** Flags `disableAllHooks` (fail) and `bypassPermissions`
+  (warning) in project or local Claude settings, settings files it cannot read, well-known
+  credential formats in files agents read (file and line only, never the value), roles with no
+  guide, hand-edited role guides, lessons waiting for approval, an unreadable lessons file,
+  and a `ui_specs.md` that predates the Marketing pages checks.
+
+### Changed
+
+- `nativ task unlock`, `nativ task complete --no-verify` and `nativ db sync --yes` now refuse to run
+  without an interactive terminal, like `nativ learn approve`. Agents run headless, so this holds
+  even where no permission rule is installed. `task unlock --revoke` still works anywhere.
+- Completing a task closes its pending escalations, and Studio's Needs you no longer lists
+  completed tasks.
+- The enforcement hook reads the enforcement mode and unlocks from the main checkout, also inside a
+  task worktree, and guards `../..` paths from a worktree into the main checkout's `.ai/`, `.nativ/`
+  and secrets.
+- `.nativ/` is protected like `.ai/`: the enforcement hook flags agent edits there, setup adds ask
+  rules for it, and Studio's native runner refuses it. Agents are also denied reading
+  `.nativ/*.local.json`.
+- Design-time rules (fonts, color, marketing page layout) moved into the Anti-Generic Checklist of
+  the `ui_specs.md` template, checked by the architect. The frontend guide keeps build-time rules,
+  and its design read applies only to Standard or Full work that renders a screen.
+
+## 2.3.1
+
+### Fixed
+
+- Studio Dispatch on Windows: task text with quotes or symbols like > could cut off the agent's instructions and send its output to a stray file.
+
+### Removed
+
+- The simulation endpoints (`/api/pipeline/simulation/start` and `/stop`) that fed the old Workflow Canvas.
+
 ## 2.3.0
 
 ### Changed