@stackbone/cli 0.3.5 → 0.4.0-alpha.0

package/CHANGELOG.md

@@ -7,6 +7,49 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.0-alpha.0] - 2026-08-31
+
+### Added
+
+- **`stackbone package --target byoc | self-host` picks which folder the command
+  writes.** It used to write one artifact, the two-service self-host stack.
+  `byoc` is the default and the historic folder — the agent alone, registered
+  from app.stackbone.ai — while `self-host` keeps the control plane and Studio
+  beside it. The exclusion is the point, not a convenience: a box that finds
+  `STUDIO_STANDALONE_TOKEN` on its boot env authenticates the operator by static
+  bearer and turns the browser identity gate off, so a BYOC folder carrying that
+  variable would be a box anyone holding one string could drive, with every
+  container still healthy. The BYOC inputs have no field to write it into
+  (PLA-1056).
+
+- **The `self-host` target generates both application services.** The shipped
+  Compose started the control plane, Postgres, Redis and MinIO and no agent at
+  all, so nothing served the box-owned routes Studio needs. It now brings up the
+  control plane with the Studio SPA and the workspace image beside it, on
+  separate configurable host ports, sharing one database, one `HMAC_SECRET` and
+  one operator token, with health checks and real startup ordering. The control
+  plane addresses the box as `http://agent:8080`, its Compose service name
+  (PLA-1069).
+
+### Changed
+
+- **The offline archives are named apart.** `agent-image.tar` carries one image
+  and never pulls a control plane; `stackbone-images.tar` carries both. A script
+  that hardcoded the single old name has to pick the one its target writes.
+
+### Fixed
+
+- **A rejected payload prints the fields it names, not just the sentence.**
+  `stackbone secrets set` printed `Request body failed schema validation.` and
+  nothing else, because the per-field detail rides under `details.issues` and
+  the reader took only `message`. It now prints the server's sentence followed
+  by one `  - name: Required` line per offending field, three at most and then a
+  `  (+<n> more)` line. A refusal carrying no issues prints its sentence
+  byte-for-byte, and a malformed or non-JSON body still prints `HTTP <status>`.
+  A local `ZodError` renders through the same bound, so the CLI's own rejections
+  and the box's read alike. SSE and multipart inherit it through the same
+  function (PLA-1044).
+
 ## [0.3.5] - 2026-08-27
 
 ### Added