@stackbone/cli 0.3.0 → 0.3.2

package/CHANGELOG.md

@@ -7,6 +7,91 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.2] - 2026-08-10
+
+### Added
+
+- **`stackbone link` refuses a box the control plane could not work with, before
+  it writes anything.** The command registered whatever answered the URL, so a
+  container too old to be registered from the browser could still be linked from
+  the terminal without a word — and the failure surfaced later, on the first
+  screen that needed something the box does not speak, with a deployment row on
+  file to explain it. `link` now reads the box's public handshake
+  (`GET <url>/api/contract`, no credential) right after it resolves the agent and
+  before it verifies `--secret`, and refuses with the same sentence the browser
+  wizard prints. A box that never answers, one that answers with something that
+  is not a handshake, and one that is simply too old each fail in their own
+  words. Nothing is written on refusal: no deployment, no local project file.
+
+### Changed
+
+- **The agent protocol the box reports goes from 14 to 15, `stackbone dev`
+  included.** The box now permits the `stackbone-signature` request header on a
+  cross-origin preflight, which is what lets a browser sign a challenge against
+  it. Nothing on the wire changes shape and no capability moves — the number is
+  the change, and it is what a caller reads to know the box has it. The origin
+  allowlist is untouched: one more permitted header is not one more permitted
+  origin.
+- **`stackbone package` says how a managed Redis URL is written.** The generated
+  `.env` and README carried `redis://host:6379`, which no managed provider
+  accepts: they all hand out a password, some require TLS, and a password
+  containing `/`, `+`, `=` or `@` has to be percent-encoded or the URL does not
+  parse. All three are now spelled out where the operator reads them, next to the
+  note that the agent PINGs Redis before starting and stops with the reason if it
+  cannot.
+
+## [0.3.1] - 2026-08-06
+
+### Added
+
+- **`stackbone dev` links a project that arrived without a link.** `.stackbone/`
+  is gitignored — by the very block `init` and `link` write — so a project
+  cloned from someone else's repository has none, and there was no clean way to
+  get one: `dev` refused and pointed at `stackbone init`, which registers a
+  _new_ agent and scaffolds its own `package.json` over the project you were
+  handed, or at `stackbone link`, which registers an already-deployed box and so
+  requires its URL, HMAC secret and image tag. Neither describes "I was given
+  this project and want to run it".
+
+  Now `dev` lists the agents your organization owns, lets you pick one or create
+  a new one named after the folder, writes the link, gitignores it, and carries
+  on booting. Non-interactive runs (`--json`, `--yes`, CI, no terminal) still
+  fail rather than guessing, with a message naming the options that apply.
+
+## [0.3.0] - 2026-08-06
+
+### Added
+
+- **`stackbone package` turns a project into a folder someone else can run.**
+  It compiles the workspace and writes a two-line Dockerfile over the published
+  Stackbone runtime base, a `docker-compose.yml` that also brings up a Postgres
+  and a Redis, an `.env` carrying a freshly generated `STACKBONE_SECRET_KEY`,
+  and a README written for whoever receives it. On the far end it is two
+  commands: `docker compose up -d`, then a health check. Building the image is
+  one `COPY` over a base that already carries the server and its dependencies,
+  so it takes seconds and needs neither the Stackbone monorepo nor an install.
+
+  The command always compiles rather than packaging whatever is sitting in
+  `dist/`: the folder gets run by someone else, days later, and there is nobody
+  left to notice it was built from yesterday's code.
+
+  `--offline` also saves the image into the folder (around 150 MB) for a
+  network that cannot reach a registry. That variant emits no build
+  instructions, since the image arrives by loading the archive.
+
+  Two things the generated files say that nothing said before: **the database
+  needs the `pgvector` extension** — without it the first boot applies most of
+  the schema and then stops, which reads like a bug in the agent rather than a
+  missing extension — and the agent serves on **8080** unless `PORT` says
+  otherwise, with `/live` as the health check a managed host should use.
+
+### Changed
+
+- **`stackbone build` no longer has to be followed by hand-written deployment
+  files.** It still emits just the workspace bundle, for anyone who already
+  owns their image and their deployment; `stackbone package` is now the route
+  to take when you do not.
+
 ## [0.2.10] - 2026-08-02
 
 ### Added