cctally 1.4.0 → 1.6.0

package/CHANGELOG.md

@@ -5,41 +5,40 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.6.0] - 2026-05-12
+
+### Added
+- Dashboard share GUI: per-panel `↗` share icon opens a modal with 24 infographic templates (8 panels × 3 archetypes), live preview, themed export to MD/HTML/SVG, client-side PNG, and browser-native Print → PDF. Keyboard: `S` shares the focused panel, `B` opens the basket composer.
+- Multi-section composer: collect template recipes from any panel into a `📋 basket` (localStorage-persisted, hard cap 20), then stitch them with `/api/share/compose` into one document under composite chrome (single title, single frontmatter, one footer). Sections show "Outdated" when underlying data or kernel version has shifted; per-section refresh re-renders without losing the basket order.
+- Share presets + history: save the current template + knob recipe under a panel-scoped name (`/api/share/presets`); recall presets and the last 20 export recipes via the gallery's `presets ▾` dropdown.
+- New endpoints: `GET /api/share/templates`, `POST /api/share/render`, `POST /api/share/compose`, full CRUD on `/api/share/presets` and `/api/share/history`. All write paths CSRF-gated; compose is recipe-only (client-supplied bodies are silently ignored — privacy chokepoint preserved).
+
+### Changed
+- Markdown exports now carry YAML frontmatter (title, generated_at, period, panel, anonymized, cctally_version). Same set of v1 share goldens churn once with this release. Stripped by `--no-branding`.
+
+### Docs
+- New user-facing reference: `docs/commands/share-v2.md`.
+
+## [1.5.0] - 2026-05-11
+
+### Added
+- `cctally update` subcommand for self-updating npm and Homebrew installs, with auto-suggest banner in CLI and amber update badge in the dashboard, plus `--check`, `--skip`, `--remind-later`, `--version` (npm only), `--json`, `--dry-run` flags. Source/dev installs fall through to a manual-recipe message. Dashboard modal streams live subprocess output and survives subprocess `execvp` restart via SSE auto-reconnect.
+- `update.check.enabled` and `update.check.ttl_hours` config keys for opting out of automatic version checks or extending the 24-hour default TTL up to 30 days.
+- `cctally setup` auto-detects hooks from prior install patterns under `~/.claude/hooks/` (`record-usage-stop.py`, `usage-poller-{start,stop}.py`, `usage-poller.py`) and offers to migrate them: unwires the matching `settings.json` entries, moves the `.py` files to a timestamped `~/.claude/cctally-legacy-hook-backup-<UTC ts>/` directory (reversible — files moved, not deleted), and best-effort stops any currently-running background daemon those hooks spawned. Before sending SIGTERM, the migration verifies the PID at `/tmp/claude-usage-poller.pid` is actually the legacy `usage-poller.py` process (via `ps -p <pid> -o command=`) so a stale sentinel pointing at a recycled PID is treated as `stale-pid` rather than risking a kill against an unrelated user process. The backup directory is resolved before the settings write so a directory-creation failure (unwriteable parent, name collision, disk full) exits 1 with `~/.claude/settings.json` byte-identical, never leaving a half-applied state. New flags `--migrate-legacy-hooks` / `--no-migrate-legacy-hooks` for non-interactive control (install-mode only; rejected with exit 2 against `--status` / `--uninstall`). `setup --status` reports the migration state in both text and JSON (`legacy.bespoke_hooks`); `setup --dry-run --migrate-legacy-hooks` previews without touching disk and warns when `~/.claude/settings.json` is malformed.
+- `npm install -g cctally` now prints a one-time hint pointing to `cctally setup` after install, mirroring what brew already shows via `Formula#caveats`. The postinstall hook (`bin/cctally-npm-postinstall.js`) is gated on `npm_config_global=true` so per-project node_modules pulls stay silent, never auto-executes `cctally setup` (which is interactive and writes outside the package surface), and honors `CCTALLY_NPM_POSTINSTALL_QUIET=1` as an escape hatch for CI / fixtures.
+
+### Fixed
+- `release` Phase 6 now refuses (exit 2) to write a brew formula whose URL pins a *lower* SemVer than the on-disk `Formula/cctally.rb` — the monotonic-version gate that closes the regression class behind issue #30, where the brew tap silently rolled back from v1.3.0 to v1.0.0 twice in one day. The gate compares with SemVer-aware ordering (stable > prerelease at the same MAJOR.MINOR.PATCH per §11.4) so prerelease promotions still flow through. New `--allow-formula-downgrade` flag overrides the gate for genuine yank/revert cases and prints a loud stderr warning when invoked.
+
 ## [1.4.0] - 2026-05-09
 
 ### Added
-- Shareable reports — all 8 reporting subcommands (`report`, `daily`,
-  `monthly`, `weekly`, `forecast`, `project`, `five-hour-blocks`, `session`)
-  now accept `--format md|html|svg` to emit shareable artifacts to a
-  filename like `cctally-<cmd>-<utcdate>.<ext>`. Flags: `--theme light|dark`,
-  `--no-branding`, `--reveal-projects` (project labels are anonymized to
-  `project-N` by default), `--output <path>` / `--output -` for stdout,
-  `--copy` (markdown only), `--open` (html/svg only). `session --format`
-  also accepts `--top-n N` to cap the chart's project breakdown.
-  See `docs/commands/share.md` and the per-command "Shareable output"
-  sections.
+- Shareable reports — all 8 reporting subcommands (`report`, `daily`, `monthly`, `weekly`, `forecast`, `project`, `five-hour-blocks`, `session`) now accept `--format md|html|svg` to emit shareable artifacts to a filename like `cctally-<cmd>-<utcdate>.<ext>`. Flags: `--theme light|dark`, `--no-branding`, `--reveal-projects` (project labels are anonymized to `project-N` by default), `--output <path>` / `--output -` for stdout, `--copy` (markdown only), `--open` (html/svg only). `session --format` also accepts `--top-n N` to cap the chart's project breakdown. See `docs/commands/share.md` and the per-command "Shareable output" sections.
 
 ### Fixed
-- Dashboard 5-hour row now shows the post-reset delta (`⚡ Δ +Xpp this
-  block`) when a 5h block spans a weekly reset, instead of suppressing
-  the number behind a `⚡ reset` line. The cross-reset flag now detects
-  natural weekly boundaries from `weekly_usage_snapshots.week_start_at`
-  in addition to Anthropic-shifted mid-week resets, and all interval
-  comparisons normalize through `unixepoch()` so the flag flips
-  correctly on non-UTC hosts (the prior lex-compare silently failed
-  for `+03:00` and other non-zero offsets, leaving the panel showing
-  a misleading `Δ −94pp this block`).
-- `record-usage`: self-heal `percent_milestones` and `five_hour_blocks` rows
-  that were silently dropped when an earlier invocation was killed between
-  snapshot insert and milestone insert (e.g. Claude Code self-update kill
-  window). On a dedup'd tick, re-runs the idempotent milestone helpers
-  against the latest snapshot — recovering missed rows at the next
-  status-line tick instead of waiting for the percent to advance.
-- Root `.gitignore` now anchors `/node_modules` and `/package-lock.json`,
-  preventing `npm install` next to the repo-root `package.json` (the
-  npm-publish sentinel) from leaving the working tree dirty and blocking
-  `cctally release`. `dashboard/web/node_modules` and the tracked
-  `dashboard/web/package-lock.json` are unaffected by the anchored entries.
+- Dashboard 5-hour row now shows the post-reset delta (`⚡ Δ +Xpp this block`) when a 5h block spans a weekly reset, instead of suppressing the number behind a `⚡ reset` line. The cross-reset flag now detects natural weekly boundaries from `weekly_usage_snapshots.week_start_at` in addition to Anthropic-shifted mid-week resets, and all interval comparisons normalize through `unixepoch()` so the flag flips correctly on non-UTC hosts (the prior lex-compare silently failed for `+03:00` and other non-zero offsets, leaving the panel showing a misleading `Δ −94pp this block`).
+- `record-usage`: self-heal `percent_milestones` and `five_hour_blocks` rows that were silently dropped when an earlier invocation was killed between snapshot insert and milestone insert (e.g. Claude Code self-update kill window). On a dedup'd tick, re-runs the idempotent milestone helpers against the latest snapshot — recovering missed rows at the next status-line tick instead of waiting for the percent to advance.
+- Root `.gitignore` now anchors `/node_modules` and `/package-lock.json`, preventing `npm install` next to the repo-root `package.json` (the npm-publish sentinel) from leaving the working tree dirty and blocking `cctally release`. `dashboard/web/node_modules` and the tracked `dashboard/web/package-lock.json` are unaffected by the anchored entries.
 
 ## [1.3.0] - 2026-05-08