@stackbone/cli 0.3.1 → 0.3.3

package/CHANGELOG.md

@@ -7,6 +7,111 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.3] - 2026-08-11
+
+### Added
+
+- **The folder `stackbone package` writes now brings object storage, not just a
+  database and a queue.** The generated compose already shipped a pgvector
+  Postgres because of managed RAG, but managed RAG stores the ingested original
+  in a bucket before it chunks and embeds it. So an operator who ran
+  `docker compose up -d` got the vector database and nowhere to put files:
+  ingestion died on the first upload, `client.storage` answered
+  `s3_credentials_missing`, and the file browser had nothing to talk to, while
+  `/health` said `ok` throughout because it only probes Postgres and Redis. The
+  compose now brings a MinIO plus a one-shot container that creates the bucket,
+  and the agent waits for the bucket to exist rather than for MinIO to be
+  healthy. Unlike the two datastores, this one publishes a port and generates
+  its own password: a presigned download link carries the endpoint it was
+  signed with, so a link signed against an address only the compose network
+  resolves is useless to a browser.
+- **The folder also gains a `.env.example`,** rendered from the same template as
+  the real `.env` so the committable copy cannot drift into a stale list of
+  variables.
+- **`STACKBONE_S3_FORCE_PATH_STYLE` picks how the box addresses its bucket.** It
+  was hardcoded to path-style, which made every subdomain-only backend (AWS S3,
+  Railway Buckets) unusable. Additive, and still defaulting to path-style, which
+  is what the bundled MinIO speaks.
+
+### Fixed
+
+- **`stackbone build` now ships the config schema itself, not just a flag saying
+  one exists.** `stackbone dev` extracted the creator's `config.schema.ts` and
+  served the Studio config form off it; `build` stamped `config: { schema: true }`
+  on the manifest and emitted no schema. A packaged box found nothing on disk and
+  degraded the form to a raw JSON field with writes unvalidated, so a config that
+  worked in dev silently did not in the box. The compiler now writes the artifact
+  using the same extractor `dev` runs. A declared schema that will not convert
+  warns and ships without the file rather than failing the build.
+- **`stackbone link` teaches the box which installation it answers for.** The box
+  learns its organization and installation id at registration, and the browser
+  wizard already did this; `link` registered a deployment and taught nothing, so
+  every box linked from the terminal refused all Studio and CLI traffic with a
+  401 blaming a tenant mismatch that did not exist. `link` now holds the same
+  prove, teach, then write order as the wizard, and fails closed: a box that
+  cannot be taught is not registered at all.
+- **A box locks its secrets with the key the agent opens them with.** A secret
+  written from Studio or the CLI landed encrypted under the documented dev seed,
+  while `client.secrets.get()` inside the agent decrypts with the per-agent
+  `STACKBONE_SECRET_KEY`. The row was there and the read still failed, so a
+  workflow reported the secret as missing. Only deployed boxes were affected;
+  `stackbone dev` falls back to the same seed on both sides. **Secrets stored
+  under the old key cannot be recovered and have to be set again once the new
+  image is running.**
+- **A box defaults to the Stackbone control plane and says so at boot.**
+  `STACKBONE_CONTROL_PLANE_URL` had no default and nothing in the product set
+  it, so a box armed no browser-identity verifier and answered 401 on every
+  Studio screen. It now falls back to `https://api.stackbone.ai`, and the boot
+  line prints which control plane it armed against and whether the operator
+  chose it. A box belonging to a self-hosted control plane still has to name it.
+
+### Changed
+
+- **An identity token is minted per organization, and names the box it is for.**
+  The old mint read the caller's earliest-joined membership, so an operator in
+  two organizations got a token no box in the second one accepts, carrying their
+  role from the first. The token now also carries the installation it was minted
+  for, and a box admits a request only when that claim matches the installation
+  it answers for: a token lifted off one box is worthless against the next.
+- **The box says which check refused the request.** One code answered three
+  different refusals, and the copy named the signature, so an operator whose real
+  problem was the token's organization went and checked a secret, a clock and a
+  container that were all fine. Now `invalid_signature`, `invalid_token` and
+  `invalid_token_tenant` are distinct. Nothing about who is admitted changed.
+
+## [0.3.2] - 2026-08-10
+
+### Added
+
+- **`stackbone link` refuses a box the control plane could not work with, before
+  it writes anything.** The command registered whatever answered the URL, so a
+  container too old to be registered from the browser could still be linked from
+  the terminal without a word — and the failure surfaced later, on the first
+  screen that needed something the box does not speak, with a deployment row on
+  file to explain it. `link` now reads the box's public handshake
+  (`GET <url>/api/contract`, no credential) right after it resolves the agent and
+  before it verifies `--secret`, and refuses with the same sentence the browser
+  wizard prints. A box that never answers, one that answers with something that
+  is not a handshake, and one that is simply too old each fail in their own
+  words. Nothing is written on refusal: no deployment, no local project file.
+
+### Changed
+
+- **The agent protocol the box reports goes from 14 to 15, `stackbone dev`
+  included.** The box now permits the `stackbone-signature` request header on a
+  cross-origin preflight, which is what lets a browser sign a challenge against
+  it. Nothing on the wire changes shape and no capability moves — the number is
+  the change, and it is what a caller reads to know the box has it. The origin
+  allowlist is untouched: one more permitted header is not one more permitted
+  origin.
+- **`stackbone package` says how a managed Redis URL is written.** The generated
+  `.env` and README carried `redis://host:6379`, which no managed provider
+  accepts: they all hand out a password, some require TLS, and a password
+  containing `/`, `+`, `=` or `@` has to be percent-encoded or the URL does not
+  parse. All three are now spelled out where the operator reads them, next to the
+  note that the agent PINGs Redis before starting and stops with the reason if it
+  cannot.
+
 ## [0.3.1] - 2026-08-06
 
 ### Added