@stackbone/cli 0.6.3 → 0.7.1

package/CHANGELOG.md

@@ -7,6 +7,203 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.1] - 2026-11-04
+
+### Added
+
+- `stackbone rag ingest --metadata '<json object>'` sets document values, and
+  `stackbone rag query --filter '<json object>' --ranges '<json array>'` filters
+  retrieval by containment and number/date bounds. Invalid flags fail locally
+  with a suggestion before file reads or requests (STA3-61).
+
+- **`stackbone rag collections create <name> --hybrid`: hybrid search for codes
+  and names.** A hybrid collection answers a text query with a search by
+  meaning and a search for the exact terms of the query, merged by reciprocal
+  rank fusion, so a product code such as `1239asd/OK` finds its product.
+  `--number-format eu|us` sets how the collection reads prices and dates
+  (`eu` by default). An unknown format fails before the request.
+  `stackbone rag query --no-hybrid` searches by meaning only, and with `--json`
+  each hit of a hybrid query carries `mixed_score` next to `score`, which stays
+  the similarity by meaning. A create without the flags sends the same request
+  as before, so an older box still accepts it (STA3-57).
+- **Hybrid search in the box.** `POST /api/rag/collections` accepts
+  `hybrid_enabled` and `number_format`, `GET /api/rag/collections` returns them,
+  and `POST /api/rag/collections/{name}/query` takes `hybrid: false` and returns
+  `mixed_score` on a hybrid search. Migration 0116 adds the columns and the
+  index; hybrid stays off on every existing collection. Studio's new-collection
+  dialog gets a **Hybrid search** toggle and a **Number and date format**
+  select, and says when a box ignored them (STA3-57).
+- **`stackbone rag collections update <name>`: change hybrid search on an
+  existing collection.** `--hybrid` or `--no-hybrid` turns it on or off and
+  `--number-format eu|us` changes the format; a flag left out keeps its value,
+  and a command with none fails before the request. The command prints
+  `Rebuilding collection <name>…` on stderr, waits for the box, and fails when
+  the answer does not confirm the settings sent. A box older than the command
+  answers exit `4` with "update the box" (STA3-57).
+- **Changing hybrid search in the box.** `PATCH /api/rag/collections/{name}`
+  takes `hybrid_enabled`, `number_format` or both. The collection pauses as
+  `rebuilding`, so searches and ingests into it answer 409
+  `rag_collection_unavailable`, while the box recomputes every chunk's exact
+  terms from its stored text, with no embedding call; turning hybrid off clears
+  them. It answers 200 with the settings once the collection is ready, 409 while
+  an embedding rebuild or another change holds it, and 500 when the recompute
+  fails, which leaves the collection failed until the same change is sent
+  again. An embedding rebuild of a hybrid collection now keeps the exact terms.
+  Studio's collection screen gets **Edit search settings**, which shows the
+  collection rebuilding until the box answers (STA3-57).
+- **Hybrid search reads prices and dates by the collection's number format.**
+  On an `eu` collection, `1250 euros` finds `1.250,00 €`,
+  `3 de noviembre de 2026` finds `03/11/2026`, and `3 de noviembre` finds it in
+  any year. On `us`, `03/11/2026` is March 11 and `1,250.00 €` is the amount.
+  Dates with a Spanish or English month name read the same in both formats,
+  and the euro is the only currency read. A number format change with
+  `rag collections update --number-format` now changes which chunks a date or
+  a price finds. A hybrid collection indexed before this release keeps its old
+  exact terms until its search settings are saved again
+  (`rag collections update` with its current settings, or Save in Studio) or
+  its embeddings are rebuilt (STA3-57).
+
+### Changed
+
+- **Connector credentials from before CLI 0.6.1 must be reconnected.**
+  `stackbone dev` no longer moves grants written under the old shared dev key
+  onto the box's own key; it removes them at boot and Studio asks to reconnect
+  them. A box with neither its own Connect keys nor an install identity now
+  refuses to boot (STA3-43).
+
+## [0.7.0] - 2026-10-30
+
+### Added
+
+- **`stackbone runs list --tag <key:value>` — the runs a caller labelled.** A
+  chat caller can label the run its turn opens with the `x-stackbone-run-tags`
+  header (every turn of a voice call carries `channel:voice` and its `room`), and
+  `--tag` lists only the runs carrying that tag: split on the first colon, exact
+  and case-sensitive. A malformed tag is refused before any request (FDE-62).
+- **`stackbone package` documents the voice recording key pair.** The `.env`
+  carries `STACKBONE_VOICE_RECORDING_S3_ACCESS_KEY` and
+  `STACKBONE_VOICE_RECORDING_S3_SECRET_KEY`, commented out: the key LiveKit Cloud
+  uploads call recordings with, in place of the box's own. The README says that a
+  folder left on the bundled MinIO records no call, since LiveKit Cloud cannot
+  reach it (FDE-62).
+- **`stackbone dev` starts the voice worker.** When the workspace has a deep
+  agent with `voice: true` and the box has LiveKit credentials saved in Studio
+  (Settings › Voice settings), `dev` runs the LiveKit voice worker on your
+  machine and prints `Voice worker ready (stackbone-voice-dev-<8 hex>)` once
+  LiveKit registers it. It stops the worker when either goes away and restarts
+  it when the credentials change, with no restart of `dev`. Each session
+  registers under its own name and its box dispatches calls to that name only,
+  so a worker deployed to LiveKit Cloud on the same project takes none of them.
+  The worker ships inside the CLI. The first session installs its dependencies
+  once, about 350 MB, into `~/.cache/stackbone/voice-worker/<version>/`, and
+  later sessions reuse them. A worker that fails is started once more, then
+  `dev` warns and keeps running. `STACKBONE_VOICE_WORKER_BIN` points it at
+  another worker `main.js` (FDE-62).
+- **`stackbone limits` — operate a workspace's concurrency limits.** `list`
+  shows each limit with its capacity and its busy and waiting counts.
+  `slots <name>` lists the held and granted slots, then the queue in order.
+  `release <slotId> --yes` gives back a slot whose release was lost and grants
+  the next run in the queue. `capacity <name> <n|reset>` and
+  `max-hold <name> <duration|reset>` override the declared values; a new
+  max hold applies only to slots granted after the change. Each verb targets
+  the local-dev installation unless `--agent <id>` names another.
+- **Concurrency limits in the box.** The box enforces the `limits` declared in
+  `stackbone.config.ts` for the SDK's `acquireSlot`, `releaseSlot` and
+  `withLimit`, takes back a slot held past `maxHold`, and frees a run's slots
+  when the run ends. It serves `GET /api/limits`,
+  `GET /api/limits/{name}/slots`, `POST /api/limits/slots/{id}/release` and
+  `PATCH /api/limits/{name}`, records a manual release or override in the
+  activity log, and Studio gets a limits screen to change capacity and max
+  hold and release a slot. A build fails on a limit the box would refuse.
+- **Trigger links can start an agent.** A trigger link can target a deep agent
+  instead of a workflow. The event maps onto the agent's `message` field, and
+  Test, Auto-map and arming validate it. Each delivery is acknowledged once
+  queued and then runs as one agent turn with its own session; guardrails and
+  approvals use the existing inbox. Workflow links behave as before (PLA-968,
+  PLA-969).
+- **A conversation key groups an agent link's events into one session.** The
+  key is a JSONata expression on the raw event, such as a Gmail thread id or a
+  WhatsApp sender. Events that yield the same value continue one session of
+  the agent, scoped to that link; anything unusable opens a fresh one. Turns
+  of one conversation never overlap: a new event waits for the running turn,
+  gives up after 10 minutes, and waits for the decision when an approval is
+  pending. Studio authors the key on the link's Correlation card, and Test
+  shows the key it would extract (PLA-971, PLA-972).
+- **An agent answers a burst of chat messages once.** An agent link with a
+  conversation key can carry a wait, `debounceMs` (1 to 10000 ms). The box
+  holds one customer's messages until they have been quiet for the wait, or
+  10 s have passed since the first, and answers them in one turn. Two
+  customers are never merged, and a link without a wait behaves as before.
+  Studio sets the wait on the link (STA3-25, STA3-27).
+- **Agent memory is isolated per agent and configurable.** Each agent keeps
+  its own facts and call records per customer. Read and save are separate
+  settings, off by default, and Studio edits them per agent. A text agent gets
+  only the memory tools that are on; a voice agent recalls before it answers
+  and saves the heard transcript once after the call. Studio's System screen
+  edits the memory extractor's model and its published guidance (FDE-87).
+- **"Delete all" on a person's memory also erases their run history on that
+  agent.** The runs, their steps and the deep agent's checkpoints for those
+  sessions go with the memory, after a confirmation that lists every run. Runs
+  are matched on the identity stored on each run, never on transcript text.
+  While one of the person's runs is open, the box refuses with a 409 and
+  deletes nothing (STA3-21).
+- **Per-collection embeddings and rebuilds.** Studio creates a RAG collection
+  with its own provider and model and probes its dimension. Changing the model
+  later rebuilds every stored version through a durable workflow the CLI
+  seeds; queries and conflicting writes on the collection wait until the
+  rebuild commits, and a failed rebuild keeps its progress for a retry. Managed
+  uploads and Studio searches use the collection's saved model, and
+  `stackbone rag` reads a collection's saved provider, model, dimension and
+  `exact` search mode (STA3-18).
+- **Voice agents search their knowledge.** When the caller finishes a
+  sentence, the box searches the agent's RAG collection and hands the passages
+  above the score threshold (default 0.2) to the model for that turn, with no
+  tool call. The collection is set in code (`voiceSettings.rag`) or on a new
+  Knowledge tab in Studio. Short utterances skip the search, and a failed or
+  slow search logs one warning and the agent answers without passages
+  (FDE-67).
+- **Voice agents in the box.** A `voice: true` agent shows a Voice tab on its
+  Catalog entry. The box stores LiveKit credentials saved in Studio (Settings ›
+  Voice settings) and checks it can reach LiveKit with them. Studio places a
+  test call to the agent, edits its voice settings field by field over the
+  ones in code, and plays back a call's recording from its session when the
+  agent turns `recording` on (STA3-2, FDE-62).
+
+### Changed
+
+- **`stackbone init` and `stackbone add deep-agent` pin `langchain`.** A deep
+  agent declared with `harness: 'minimal'` builds with it, so the workspace root
+  now pins it exactly at `1.5.2`, a version inside the `^1.5.0` range
+  `deepagents` declares whose `@langchain/core` peer range the pinned core meets,
+  and the box image bakes the same version (FDE-62).
+
+### Fixed
+
+- **`stackbone package` includes workflow npm dependencies.** A creator
+  dependency such as `pdf-lib` could stay a bare import, so the packaged box
+  passed `/health` and every workflow failed on load. Creator dependencies are
+  now bundled with the workflow steps, and a loader that needs package-local
+  code or assets the bundle lacks is refused before the manifest is written,
+  with `build.external` guidance. Optional `require` calls whose fallback is
+  `undefined` are accepted (PLA-2353).
+- **Approval decisions keep the reviewer.** Studio records the verified
+  reviewer's email, and the decision, approver and decision time reach
+  `requestApproval()`, `approval.get()` and `approval.list()` (PLA-2360).
+- **A long workflow step no longer runs twice.** A step callback longer than
+  300 s hit the HTTP client's own transport deadline and was retried next to
+  the original, duplicating side effects. The configured
+  `WORKFLOW_HTTP_TIMEOUT_MS` now governs it (PLA-2363).
+- **A failed workflow run and its error event are written together**, so the
+  run is never marked failed without the event that carries its error.
+- **`stackbone.memory.add` from a workflow step no longer fails** when the
+  run's row lands after the call; the run link stays and opens a not-found
+  state if the run never lands (STA3-20).
+- **Insights queries on the box are bounded.** One query never holds a
+  connection more than 8 s, and a breakdown by an id reads only its
+  top groups instead of every group (STA3-6).
+- **`stackbone db migrate create` works on Windows.** The schema and output
+  paths passed to drizzle-kit use `/`, which its glob reads on every OS.
+
 ## [0.6.3] - 2026-10-26
 
 ### Added