@stackbone/cli 0.3.4 → 0.3.5

package/CHANGELOG.md

@@ -7,6 +7,74 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.5] - 2026-08-27
+
+### Added
+
+- **`stackbone dev` boots a workspace that declares nothing of the creator's
+  yet.** A workspace from `stackbone init --with empty` used to be refused
+  outright. It now boots and prints a notice naming what is missing, so the
+  control surface, the box API reference and the emulator are all reachable
+  before the first workflow exists (PLA-775).
+
+- **`prompts publish`, `prompts unpublish` and `prompts remove-version`.**
+  Writing a prompt and choosing which version runs are two separate steps now.
+  `publish --version <n>` points the agent at an existing version without
+  copying its text forward; `unpublish` takes that pointer away;
+  `remove-version` deletes one stored version.
+
+- **A prompt belongs to a workflow or an agent, not to the workspace.** Every
+  `prompts` verb takes owner flags naming which workflow or deep agent holds the
+  key, so two agents can carry the same key without colliding.
+
+- **The build inventories the prompt keys the creator's code asks for.** The
+  scan reads the source with an AST rather than running it, and records each
+  catalogue lookup: the key, the variable names handed over, and the workflow or
+  deep agent whose source made the call. A key written in Studio that no line of
+  code reads, and a key read by code that nothing ever wrote, are both visible
+  from the inventory.
+
+- **The boot output names the box's own API reference.** `dev` prints where the
+  box serves its OpenAPI document and Scalar reference alongside the rest of the
+  banner (PLA-857).
+
+- **`link` says where each installation resolves.** A box registered against a
+  deployment now shows its target in the listing instead of reading as
+  unregistered, and the box is told which installation its deployment resolves
+  through.
+
+### Fixed
+
+- **`dev` ends the session on one Ctrl-C, whatever the teardown does.** A
+  teardown step that never settled used to leave the session alive past the
+  first interrupt.
+
+- **The workflow validator sidecar loads inside the image.** It is bundled
+  self-contained, so `/start` validation no longer depends on files the image
+  does not carry. When it still cannot load, validation falls back to a
+  structural check rather than accepting anything (PLA-394).
+
+- **`link --url` is no longer offered as the remedy for a local-dev install.**
+  It never applied to one.
+
+- **A deployment link that was just registered says it cannot be reached yet**,
+  instead of reading as though the box were already live.
+
+- **Agent ids are pointed at where they come from**, not at the local emulator.
+
+- **Packaging a box tells the operator where its telemetry goes** (PLA-744).
+
+- **The scaffolded `.gitignore` also ignores a `node_modules` symlink.**
+
+- **The dev watcher specs no longer flake on macOS.**
+
+### Removed
+
+- **BREAKING: `prompts rollback` is gone.** It copied an older version's text
+  forward into a new version. `prompts publish --version <n>` replaces it by
+  moving the pointer to the version that already exists, leaving no duplicate
+  text behind.
+
 ## [0.3.4] - 2026-08-19
 
 ### Added