@stackbone/cli 0.3.4 → 0.4.0-alpha.0

package/CHANGELOG.md

@@ -7,6 +7,117 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.0-alpha.0] - 2026-08-31
+
+### Added
+
+- **`stackbone package --target byoc | self-host` picks which folder the command
+  writes.** It used to write one artifact, the two-service self-host stack.
+  `byoc` is the default and the historic folder — the agent alone, registered
+  from app.stackbone.ai — while `self-host` keeps the control plane and Studio
+  beside it. The exclusion is the point, not a convenience: a box that finds
+  `STUDIO_STANDALONE_TOKEN` on its boot env authenticates the operator by static
+  bearer and turns the browser identity gate off, so a BYOC folder carrying that
+  variable would be a box anyone holding one string could drive, with every
+  container still healthy. The BYOC inputs have no field to write it into
+  (PLA-1056).
+
+- **The `self-host` target generates both application services.** The shipped
+  Compose started the control plane, Postgres, Redis and MinIO and no agent at
+  all, so nothing served the box-owned routes Studio needs. It now brings up the
+  control plane with the Studio SPA and the workspace image beside it, on
+  separate configurable host ports, sharing one database, one `HMAC_SECRET` and
+  one operator token, with health checks and real startup ordering. The control
+  plane addresses the box as `http://agent:8080`, its Compose service name
+  (PLA-1069).
+
+### Changed
+
+- **The offline archives are named apart.** `agent-image.tar` carries one image
+  and never pulls a control plane; `stackbone-images.tar` carries both. A script
+  that hardcoded the single old name has to pick the one its target writes.
+
+### Fixed
+
+- **A rejected payload prints the fields it names, not just the sentence.**
+  `stackbone secrets set` printed `Request body failed schema validation.` and
+  nothing else, because the per-field detail rides under `details.issues` and
+  the reader took only `message`. It now prints the server's sentence followed
+  by one `  - name: Required` line per offending field, three at most and then a
+  `  (+<n> more)` line. A refusal carrying no issues prints its sentence
+  byte-for-byte, and a malformed or non-JSON body still prints `HTTP <status>`.
+  A local `ZodError` renders through the same bound, so the CLI's own rejections
+  and the box's read alike. SSE and multipart inherit it through the same
+  function (PLA-1044).
+
+## [0.3.5] - 2026-08-27
+
+### Added
+
+- **`stackbone dev` boots a workspace that declares nothing of the creator's
+  yet.** A workspace from `stackbone init --with empty` used to be refused
+  outright. It now boots and prints a notice naming what is missing, so the
+  control surface, the box API reference and the emulator are all reachable
+  before the first workflow exists (PLA-775).
+
+- **`prompts publish`, `prompts unpublish` and `prompts remove-version`.**
+  Writing a prompt and choosing which version runs are two separate steps now.
+  `publish --version <n>` points the agent at an existing version without
+  copying its text forward; `unpublish` takes that pointer away;
+  `remove-version` deletes one stored version.
+
+- **A prompt belongs to a workflow or an agent, not to the workspace.** Every
+  `prompts` verb takes owner flags naming which workflow or deep agent holds the
+  key, so two agents can carry the same key without colliding.
+
+- **The build inventories the prompt keys the creator's code asks for.** The
+  scan reads the source with an AST rather than running it, and records each
+  catalogue lookup: the key, the variable names handed over, and the workflow or
+  deep agent whose source made the call. A key written in Studio that no line of
+  code reads, and a key read by code that nothing ever wrote, are both visible
+  from the inventory.
+
+- **The boot output names the box's own API reference.** `dev` prints where the
+  box serves its OpenAPI document and Scalar reference alongside the rest of the
+  banner (PLA-857).
+
+- **`link` says where each installation resolves.** A box registered against a
+  deployment now shows its target in the listing instead of reading as
+  unregistered, and the box is told which installation its deployment resolves
+  through.
+
+### Fixed
+
+- **`dev` ends the session on one Ctrl-C, whatever the teardown does.** A
+  teardown step that never settled used to leave the session alive past the
+  first interrupt.
+
+- **The workflow validator sidecar loads inside the image.** It is bundled
+  self-contained, so `/start` validation no longer depends on files the image
+  does not carry. When it still cannot load, validation falls back to a
+  structural check rather than accepting anything (PLA-394).
+
+- **`link --url` is no longer offered as the remedy for a local-dev install.**
+  It never applied to one.
+
+- **A deployment link that was just registered says it cannot be reached yet**,
+  instead of reading as though the box were already live.
+
+- **Agent ids are pointed at where they come from**, not at the local emulator.
+
+- **Packaging a box tells the operator where its telemetry goes** (PLA-744).
+
+- **The scaffolded `.gitignore` also ignores a `node_modules` symlink.**
+
+- **The dev watcher specs no longer flake on macOS.**
+
+### Removed
+
+- **BREAKING: `prompts rollback` is gone.** It copied an older version's text
+  forward into a new version. `prompts publish --version <n>` replaces it by
+  moving the pointer to the version that already exists, leaving no duplicate
+  text behind.
+
 ## [0.3.4] - 2026-08-19
 
 ### Added