@stackbone/cli 0.2.7 → 0.2.10

package/CHANGELOG.md

@@ -7,6 +7,124 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.10] - 2026-08-02
+
+### Added
+
+- **`stackbone eval <suite>` runs a saved evaluation suite from the terminal
+  and fails the command when it misses its pass mark.** The suite has to
+  already exist on the box — nothing is defined from the terminal, so the CLI
+  and the Studio screen can never disagree about what was tested. A run that
+  was stopped, that broke, or that finished having measured fewer cases than
+  it planned is also a failing gate, with the reason printed before the
+  failure; a run cut short by the suite's own case cap is not. The summary
+  links straight to the run in Studio, and `Ctrl-C` / `--timeout` stop the
+  watcher, never the run.
+- **`stackbone link` reports whether the box is verifying browser identity.**
+  A box that never got an identity configuration looks healthy from every
+  angle while Studio silently keeps reaching it through the control-plane
+  proxy. `link` now prints a warning (and includes it in `--json`) naming
+  `STACKBONE_CONTROL_PLANE_URL` and what it costs until it is set.
+
+### Changed
+
+- **Every Studio command now reaches a BYOC box directly instead of going
+  through the control plane, the same datapath the browser already uses.**
+  Commands mint a short-lived identity token off the CLI's own session
+  instead of sending the operator's control-plane credentials to the box, and
+  retry once on a token expiry. A deployment that isn't registered, or a
+  session that can't mint a token, still falls back to the control-plane
+  proxy — but a registered box that simply doesn't answer now surfaces as a
+  real connection error instead of a silent proxy retry.
+- **`stackbone dev`: one broken workflow file no longer empties the whole
+  catalog.** A `*.workflow.ts` that fails to compile now shows up in the
+  catalog with its own error, the same way a broken deep agent always has,
+  instead of taking every other workflow in the workspace down with it.
+
+### Fixed
+
+- **Commands against a deleted or unregistered deployment fail with a clear,
+  specific error instead of a raw `Cannot GET ...` from a route that no
+  longer exists.** Each failure mode — no box registered, session can't
+  authenticate, box registered but unreachable — gets its own message and
+  remedy (`stackbone link`, `stackbone login`, or a plain connection error).
+- **New projects no longer scaffold a `stackbone publish` script that doesn't
+  exist.** The generated `package.json` and the `AGENTS.md` / `CLAUDE.md`
+  templates now point at `build`, the command that actually ships.
+
+## [0.2.9] - 2026-07-28
+
+### Changed
+
+- **The scaffolded README and the inline docs describe the guided first run.**
+  `stackbone init` used to hand you a README documenting exactly the path that
+  fails on a clean machine: install, run the dev command, done. It now says the
+  first `stackbone dev` stops before your code, prints a Studio link to point the
+  deployment at a **model provider**, and starts your workspace the moment you
+  save. The environment escape hatch (`MODEL_PROVIDER_BASE_URL` /
+  `MODEL_PROVIDER_API_KEY`) is documented next to it, under the neutral names.
+  The scaffolded `AGENTS.md` says the same thing to your coding agent, and no
+  longer claims a bare model id is "resolved through OpenRouter".
+- **`stackbone docs cli/local-development` documents the boot gate**: the real
+  stage order (the emulator and tunnel come up before the gate, your workflows
+  and agents after it), the two ways the gate opens (a model provider resolves,
+  or somebody completed the first run), the `gate` object in `--json`, and how to
+  run the guided setup again from Studio. The old promise that a workspace with
+  no provider "boots fine" and only `client.ai` 404s is gone: it was never true
+  for the agent `init` scaffolds. `cli/commands`, `cli/configuration`,
+  `cli/getting-started` and `cli/troubleshooting` follow, with a new
+  troubleshooting entry that tells "waiting for a model provider" apart from
+  "your agent has a bug".
+- **`stackbone init` no longer implies the dev command runs with nothing
+  configured.** Its "Next steps" note says the first run stops for setup.
+
+## [0.2.8] - 2026-07-22
+
+### Fixed
+
+- **A failing run no longer takes down `stackbone dev`.** The start-and-wait
+  path read `Run.returnValue` twice, and that property is a getter that starts
+  a fresh poll on every read — so the first read produced a promise nobody was
+  awaiting. While runs succeeded nobody noticed; a FAILED run rejected that
+  orphan, Node escalated it to an uncaught exception, and the whole dev process
+  died. One failing Auto-map was enough to lose the emulator mid-session. The
+  getter is now read once: a failed run returns a 502 and the same process keeps
+  serving.
+- **Auto-map now proposes expressions that actually resolve.** The suggestion
+  prompt handed the model one `{ sourceSample, targetSchema }` envelope, so it
+  wrote paths relative to that envelope (`sourceSample.subject`) — they parse
+  cleanly, the editor accepts them, and then they match nothing against a real
+  event. It also invented `upperCase` for JSONata's `$uppercase`, which only
+  fails at evaluation time. The two documents are now passed as separately
+  labelled blocks, the event itself is stated as the root context, and only
+  `$`-prefixed builtins are allowed. A plain copy is asked for as a bare field
+  reference too, unless the target field's type, format, enum or description
+  genuinely asks for a shape.
+- **An agent no longer loses every surface because the runtime advertises one
+  unknown capability.** The contract's capability list was validated as a strict
+  enum, so a single unrecognised entry failed the whole document and took `ai`,
+  `storage`, `rag`, `queues`, `secrets`, `config` and `approval` down with it —
+  even though capability membership is additive by design. It is validated as
+  plain strings now, so an unknown capability is simply one no gate matches.
+
+### Changed
+
+- **`stackbone link` proves `--secret` against the container before it registers
+  anything.** It signs a challenge to the box's public
+  `GET /api/proxy-challenge`, which verifies it against the `HMAC_SECRET` the
+  container was actually booted with, and registers the deployment only on a
+  2xx. A mistyped or stale secret now fails right there with an actionable
+  error and nothing is persisted, instead of surfacing later as a fully broken
+  Studio proxy. Deployments registered before this need a re-link.
+- **Connector credentials live in the agent's own box.** The Connect broker —
+  connector registrations with their write-only `client_secret`, the grants, the
+  OAuth code exchange and the token cache — runs inside the box and is encrypted
+  under the box key; the control plane only forwards to it and holds none of it
+  at rest. `stackbone dev` keeps its existing dev fallbacks, and now also arms
+  the proactive token-refresh worker whenever Redis is up — including in a
+  workspace that only has deep agents and no workflows, so a local session
+  refreshes expiring grants the same way the production image does.
+
 ## [0.2.7] - 2026-07-21
 
 ### Removed

package/README.md

@@ -25,7 +25,7 @@ That's it. `init` scaffolds a new workspace shell (agents + workflows + coding-a
 | `stackbone add <kind> <name>` | Add an agent / workflow / workflow-agent to the workspace (offline).   |
 | `stackbone dev`               | Boot the whole workspace locally + Stackbone Studio.                   |
 | `stackbone workflows <verb>`  | List, inspect the schema of, or start the install's workflows.         |
-| `stackbone publish`           | Compile every agent + workflow and pack the workspace bundle.          |
+| `stackbone build`             | Compile the workspace into the bundle your container image bakes in.   |
 | `stackbone login` / `logout`  | Authenticate the CLI via the device-code flow (RFC 8628).              |
 | `stackbone whoami`            | Show the active user and organization.                                 |
 | `stackbone current`           | Print the organization currently linked to this session.               |