@stackbone/cli 0.6.3 → 0.7.0

package/CHANGELOG.md

@@ -7,6 +7,139 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.0] - 2026-10-30
+
+### Added
+
+- **`stackbone runs list --tag <key:value>` — the runs a caller labelled.** A
+  chat caller can label the run its turn opens with the `x-stackbone-run-tags`
+  header (every turn of a voice call carries `channel:voice` and its `room`), and
+  `--tag` lists only the runs carrying that tag: split on the first colon, exact
+  and case-sensitive. A malformed tag is refused before any request (FDE-62).
+- **`stackbone package` documents the voice recording key pair.** The `.env`
+  carries `STACKBONE_VOICE_RECORDING_S3_ACCESS_KEY` and
+  `STACKBONE_VOICE_RECORDING_S3_SECRET_KEY`, commented out: the key LiveKit Cloud
+  uploads call recordings with, in place of the box's own. The README says that a
+  folder left on the bundled MinIO records no call, since LiveKit Cloud cannot
+  reach it (FDE-62).
+- **`stackbone dev` starts the voice worker.** When the workspace has a deep
+  agent with `voice: true` and the box has LiveKit credentials saved in Studio
+  (Settings › Voice settings), `dev` runs the LiveKit voice worker on your
+  machine and prints `Voice worker ready (stackbone-voice-dev-<8 hex>)` once
+  LiveKit registers it. It stops the worker when either goes away and restarts
+  it when the credentials change, with no restart of `dev`. Each session
+  registers under its own name and its box dispatches calls to that name only,
+  so a worker deployed to LiveKit Cloud on the same project takes none of them.
+  The worker ships inside the CLI. The first session installs its dependencies
+  once, about 350 MB, into `~/.cache/stackbone/voice-worker/<version>/`, and
+  later sessions reuse them. A worker that fails is started once more, then
+  `dev` warns and keeps running. `STACKBONE_VOICE_WORKER_BIN` points it at
+  another worker `main.js` (FDE-62).
+- **`stackbone limits` — operate a workspace's concurrency limits.** `list`
+  shows each limit with its capacity and its busy and waiting counts.
+  `slots <name>` lists the held and granted slots, then the queue in order.
+  `release <slotId> --yes` gives back a slot whose release was lost and grants
+  the next run in the queue. `capacity <name> <n|reset>` and
+  `max-hold <name> <duration|reset>` override the declared values; a new
+  max hold applies only to slots granted after the change. Each verb targets
+  the local-dev installation unless `--agent <id>` names another.
+- **Concurrency limits in the box.** The box enforces the `limits` declared in
+  `stackbone.config.ts` for the SDK's `acquireSlot`, `releaseSlot` and
+  `withLimit`, takes back a slot held past `maxHold`, and frees a run's slots
+  when the run ends. It serves `GET /api/limits`,
+  `GET /api/limits/{name}/slots`, `POST /api/limits/slots/{id}/release` and
+  `PATCH /api/limits/{name}`, records a manual release or override in the
+  activity log, and Studio gets a limits screen to change capacity and max
+  hold and release a slot. A build fails on a limit the box would refuse.
+- **Trigger links can start an agent.** A trigger link can target a deep agent
+  instead of a workflow. The event maps onto the agent's `message` field, and
+  Test, Auto-map and arming validate it. Each delivery is acknowledged once
+  queued and then runs as one agent turn with its own session; guardrails and
+  approvals use the existing inbox. Workflow links behave as before (PLA-968,
+  PLA-969).
+- **A conversation key groups an agent link's events into one session.** The
+  key is a JSONata expression on the raw event, such as a Gmail thread id or a
+  WhatsApp sender. Events that yield the same value continue one session of
+  the agent, scoped to that link; anything unusable opens a fresh one. Turns
+  of one conversation never overlap: a new event waits for the running turn,
+  gives up after 10 minutes, and waits for the decision when an approval is
+  pending. Studio authors the key on the link's Correlation card, and Test
+  shows the key it would extract (PLA-971, PLA-972).
+- **An agent answers a burst of chat messages once.** An agent link with a
+  conversation key can carry a wait, `debounceMs` (1 to 10000 ms). The box
+  holds one customer's messages until they have been quiet for the wait, or
+  10 s have passed since the first, and answers them in one turn. Two
+  customers are never merged, and a link without a wait behaves as before.
+  Studio sets the wait on the link (STA3-25, STA3-27).
+- **Agent memory is isolated per agent and configurable.** Each agent keeps
+  its own facts and call records per customer. Read and save are separate
+  settings, off by default, and Studio edits them per agent. A text agent gets
+  only the memory tools that are on; a voice agent recalls before it answers
+  and saves the heard transcript once after the call. Studio's System screen
+  edits the memory extractor's model and its published guidance (FDE-87).
+- **"Delete all" on a person's memory also erases their run history on that
+  agent.** The runs, their steps and the deep agent's checkpoints for those
+  sessions go with the memory, after a confirmation that lists every run. Runs
+  are matched on the identity stored on each run, never on transcript text.
+  While one of the person's runs is open, the box refuses with a 409 and
+  deletes nothing (STA3-21).
+- **Per-collection embeddings and rebuilds.** Studio creates a RAG collection
+  with its own provider and model and probes its dimension. Changing the model
+  later rebuilds every stored version through a durable workflow the CLI
+  seeds; queries and conflicting writes on the collection wait until the
+  rebuild commits, and a failed rebuild keeps its progress for a retry. Managed
+  uploads and Studio searches use the collection's saved model, and
+  `stackbone rag` reads a collection's saved provider, model, dimension and
+  `exact` search mode (STA3-18).
+- **Voice agents search their knowledge.** When the caller finishes a
+  sentence, the box searches the agent's RAG collection and hands the passages
+  above the score threshold (default 0.2) to the model for that turn, with no
+  tool call. The collection is set in code (`voiceSettings.rag`) or on a new
+  Knowledge tab in Studio. Short utterances skip the search, and a failed or
+  slow search logs one warning and the agent answers without passages
+  (FDE-67).
+- **Voice agents in the box.** A `voice: true` agent shows a Voice tab on its
+  Catalog entry. The box stores LiveKit credentials saved in Studio (Settings ›
+  Voice settings) and checks it can reach LiveKit with them. Studio places a
+  test call to the agent, edits its voice settings field by field over the
+  ones in code, and plays back a call's recording from its session when the
+  agent turns `recording` on (STA3-2, FDE-62).
+
+### Changed
+
+- **`stackbone init` and `stackbone add deep-agent` pin `langchain`.** A deep
+  agent declared with `harness: 'minimal'` builds with it, so the workspace root
+  now pins it exactly at `1.5.2`, a version inside the `^1.5.0` range
+  `deepagents` declares whose `@langchain/core` peer range the pinned core meets,
+  and the box image bakes the same version (FDE-62).
+
+### Fixed
+
+- **`stackbone package` includes workflow npm dependencies.** A creator
+  dependency such as `pdf-lib` could stay a bare import, so the packaged box
+  passed `/health` and every workflow failed on load. Creator dependencies are
+  now bundled with the workflow steps, and a loader that needs package-local
+  code or assets the bundle lacks is refused before the manifest is written,
+  with `build.external` guidance. Optional `require` calls whose fallback is
+  `undefined` are accepted (PLA-2353).
+- **Approval decisions keep the reviewer.** Studio records the verified
+  reviewer's email, and the decision, approver and decision time reach
+  `requestApproval()`, `approval.get()` and `approval.list()` (PLA-2360).
+- **A long workflow step no longer runs twice.** A step callback longer than
+  300 s hit the HTTP client's own transport deadline and was retried next to
+  the original, duplicating side effects. The configured
+  `WORKFLOW_HTTP_TIMEOUT_MS` now governs it (PLA-2363).
+- **A failed workflow run and its error event are written together**, so the
+  run is never marked failed without the event that carries its error.
+- **`stackbone.memory.add` from a workflow step no longer fails** when the
+  run's row lands after the call; the run link stays and opens a not-found
+  state if the run never lands (STA3-20).
+- **Insights queries on the box are bounded.** One query never holds a
+  connection more than 8 s, and a breakdown by an id reads only its
+  top groups instead of every group (STA3-6).
+- **`stackbone db migrate create` works on Windows.** The schema and output
+  paths passed to drizzle-kit use `/`, which its glob reads on every OS.
+
 ## [0.6.3] - 2026-10-26
 
 ### Added