@stackbone/cli 0.6.0 → 0.6.2

package/CHANGELOG.md

@@ -7,6 +7,73 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.2] - 2026-10-09
+
+### Added
+
+- **`stackbone triggers list` — the trigger links, and which may start
+  themselves.** Lists every trigger → workflow link of an installation: its id,
+  on or off, the connector and trigger it reads, and the workflow it starts. A
+  link whose runs wrote back through its own connector with an `echoPath` and
+  never asked `isOwnEcho` about it in the last hour gets a `warning:` line
+  under it, naming the connector and the operation, in the same words as the
+  banner on the trigger's page in Studio. The JSON carries it as
+  `activity.echoLoop` (PLA-1580).
+
+- **`stackbone runs` names the trigger link that started a run.** `runs get`
+  prints a `link` line, `Gmail · New Email (started)`, and `runs list` ends the
+  row of a linked run with the same names. The JSON carries the link as
+  `triggerLink`, with the names the box's connector catalog gives it. A
+  connector the catalog does not list prints its ids (PLA-1898).
+
+### Changed
+
+- **Every connector comes from the Activepieces catalog.** `stackbone dev`
+  reads the catalog published for the runtime's pin at `catalog.stackbone.ai`,
+  checks it against its digest, and lists the pieces the execution sweep
+  proved, 718 today. A piece's code downloads the first time one of its
+  actions runs. When the catalog cannot be reached at boot, the box starts
+  with no pieces and logs the URL it tried (PLA-1662, PLA-1908).
+- **The hand-written built-ins retire, and their pieces take the ids.**
+  `google-drive`, `gmail`, `github`, `linear`, `stripe` and `supabase` are now
+  pieces under the same id, with the piece's operation names:
+  `drive_list_files`, not `drive.files.list`; `send_email` on Gmail;
+  `rawGraphqlQuery` on Linear. A connection registered with an older CLI must
+  be registered again, and a trigger link on a built-in trigger recreated on
+  the piece's trigger. An `outlook-app-only` connection converts to
+  `microsoft-outlook` on boot, links included (PLA-1911, PLA-1978, PLA-1932,
+  PLA-1982, PLA-1983, PLA-1984, PLA-1985).
+- **A piece's triggers run in the box.** Polling triggers poll from the box,
+  and webhook triggers register at the provider and start a run on each
+  delivery (PLA-1855, PLA-1856).
+
+## [0.6.1] - 2026-10-08
+
+### Added
+
+- **`stackbone dev` says so when the organization's trial has ended.** The
+  control plane refuses the tunnel grant and the local registration of an
+  organization whose trial is over with `trial_expired`. The CLI prints that
+  the trial ended, that nothing was deleted and how to continue, exits `5`, and
+  does not retry. `stackbone init` reads the same refusal the same way. A
+  session that was already running keeps running (PLA-2036).
+- **`stackbone link` stops at an ended trial too.** The control plane now also
+  refuses `trial_expired` when an organization whose trial is over registers a
+  box (`link`) or creates a workspace (`init`), so both commands print the same
+  trial-ended message and exit `5` (PLA-2037).
+
+### Security
+
+- **A `stackbone dev` box no longer verifies connector calls with a key from
+  the public repo.** Every dev box signed `/api/connect/*` with the same
+  constant and encrypted connected accounts under the same key, so anyone
+  holding a tunnel URL could mint tokens for the creator's Gmail, Slack or
+  HubSpot. Each dev box now mints its own pair on its first boot and keeps it
+  in its own dev Postgres, next to the connections it protects. Connections
+  made with an older CLI are moved onto the new key at boot and keep working;
+  one that no known key can open is removed with a warning, and you reconnect
+  it in Studio (PLA-1866).
+
 ## [0.6.0] - 2026-10-06
 
 ### Added