clavue-v1 1.2.0 → 1.4.0

package/CHANGELOG.md

@@ -0,0 +1,59 @@
+# Changelog
+
+clavue / 克拉维 发布说明。本文件在构建时注入运行时，驱动启动画面的「新特性」栏和 `/release-notes` 命令。
+
+格式约定（`parseChangelog` 依赖）：二级标题为 `## <版本> - <日期>`，条目以 `- ` 开头，一行一条，命令与模型名保留英文。
+
+## 1.4.0 - 2026-09-02
+
+- 启动画面改为 clavue 仪表盘：`路由`（Provider · 主机 · 有效模型 · effort）、`槽位`（四个 `CLAVUE_COMBO_*`）、`公告`、`最近会话`、`新特性`
+- 发布说明改读内置 `CHANGELOG.md`：`新特性` 与 `/release-notes` 只显示当前运行版本的内容，不再拉取任何上游 changelog
+- 新增官方信息源 `www.clavue.com/tui/feed.json`：公告与轮播提示可远程更新，`CLAVUE_TUI_FEED=0` 关闭
+- 帮助改进 Clavue（数据共享）：官方云会话经脱敏、假名化后用于改进模型，30 天后自动删除；`/privacy-settings on|off|delete`，`CLAVUE_DATA_SHARING=0` 或项目级 `dataSharing: false` 可关闭
+- 状态栏与页脚中文化：`可信运维 已开启 (shift+tab 切换)`；过滤 Provider 冒烟测试会话
+- 移除 Anthropic 专属推广（guest passes、overage credit、Desktop / web / mobile / Slack / GitHub App）并新增 clavue 使用提示
+- 新增 `npm run check:branding`：用户可见文案中的上游品牌残留只降不升
+- 修复：`dist/openai-responses-adapter.js` 在不同构建间字节不一致（stub 插件不再拦截 `node_modules` 内的相对导入）
+
+## 1.3.0 - 2026-09-02
+
+- `/goal` 成为证据门控的任务控制器：无证据不可 complete，预算 20 轮 / 6 小时
+- `/goal criteria` 持久化成功标准，跨压缩与重启注入续跑提示
+- `/retro` 以 PRODUCT.md / ARCHITECTURE.md / AGENTS.md 为准绳，推荐 `npm run test:fast`
+- `/review` 统一评审规则：`P0/P1/P2/nit` 定位到 `path:line`，单行 Verdict 收尾
+- 子代理跟随组合槽位：`haiku` 级代理走 `CLAVUE_COMBO_LIGHT`，可直接声明 `model: light|main|plan|review`
+- 修复：子代理不再被重路由到 `CLAVUE_COMBO_MAIN`；plan hop 只在主线程触发
+- 非 Anthropic 网关上 MCP 工具内联发送，回归测试锁定该契约
+- `clavue OAuth` 取代 Anthropic 控制台登录，`/provider` 与 `clavue-v1 auth login` 共用设备码流程
+- 终端配色切换到 clavue 银色系；成功 / diff 语义色保持绿色
+
+## 1.2.0 - 2026-09-02
+
+- 跨家族组合评审 `CLAVUE_COMBO_REVIEW`：评审与开发模型并行，下一轮边界注入结论
+- 评审风暴防护：显著性门控 + 每条编辑链的评审预算
+- 严格 `P0:` 结论契约，可选一轮修复循环 `CLAVUE_COMBO_REVIEW_FIX_LOOP=1`
+- 新增 `clavue-official` 预设：`https://api.clavue.com` 会员 API Key，精确主机识别
+- 会员契约 v1：设备登录、更新清单、积分账本（`/provider current` 可见）
+- 学习型上下文上限：真实 "prompt is too long" 拒绝会收紧该模型的执行窗口
+- `/provider probe` 与网关 `/v1/models` 交叉校验，缺失模型直接报告
+- `CI=true` 下无凭据不再静默挂起，首个 API 调用处明确失败
+- 构建期 `feature()` 替换容忍换行调用并在残留时硬失败
+
+## 1.1.0 - 2026-09-01
+
+- TypeScript 7 原生 typecheck 门禁，错误基线只允许下降
+- Biome 变更文件 lint 门禁 `npm run lint`
+- 精选快速测试套件 `npm run test:fast`，20 秒墙钟预算
+- 发布契约与 `clavue-v1` 启动器对齐，重建过期的 dist
+
+## 1.0.1 - 2026-09-01
+
+- 要求 Node >= 22.18，文档与安装脚本对齐 `clavue-v1` bin
+- 去掉 `clavue` bin，避免全局安装 EEXIST 冲突
+- 混合槽位模型仅作建议，不再是硬门禁
+
+## 1.0.0 - 2026-09-01
+
+- v8.9.1 执行引擎之上的串行四槽位组合层：main / light / plan / review
+- 通过 `CLAVUE_COMBO_*` 环境变量按需开启，未配置时行为与 v8.9.1 一致
+- 槽位模型为任意字符串直通 API 层，不做白名单与家族过滤

package/README.md

@@ -35,6 +35,7 @@ Canonical primary command surfaces:
 - `/provider`: configure, switch, validate, repair, copy, edit, delete, or save provider profiles.
 - `/permissions` (`/approvals` compatibility alias): set the default permission mode so trusted development environments can run with less friction; use `/permissions autonomous` for an opt-in high-autonomy local development lane.
 - `/team`: inspect local team readiness, active team config, and capability state.
+- `/goal`: run a durable, evidence-gated goal loop with a persistent ledger and a bounded auto-continuation budget.
 - `/retro`: run a multi-round repo retrospective and upgrade loop.
 - `/tasks`: inspect task-board state for long-running work.
 - `/resume`: continue saved sessions.
@@ -64,8 +65,8 @@ npx -y clavue-v1
 Run a specific version with `npx`:
 
 ```bash
-npx -y clavue-v1@1.2.0 --version
-npx -y clavue-v1@1.2.0
+npx -y clavue-v1@1.4.0 --version
+npx -y clavue-v1@1.4.0
 ```
 
 Install globally from npm when you want the `clavue-v1` command to stay available:
@@ -87,7 +88,7 @@ curl -fsSL https://unpkg.com/clavue-v1/install.sh | bash
 Install a specific version globally:
 
 ```bash
-curl -fsSL https://unpkg.com/clavue-v1@1.2.0/install.sh | bash -s -- 1.2.0
+curl -fsSL https://unpkg.com/clavue-v1@1.4.0/install.sh | bash -s -- 1.4.0
 ```
 
 ## Quick Start: Official Clavue Cloud
@@ -96,10 +97,10 @@ Official mode is a provider profile, not a second runtime: the same tools,
 compaction, permissions, and route inspection as every custom-API profile —
 only the credential source and the model catalog differ.
 
-1. Create a member API key at `https://www.clavue.com/account` (`cv_live_…`).
-2. Start `clavue-v1`, choose `自定义 API 配置` → `1. 添加配置`, pick the
-   `Clavue 官方` preset (API URL `https://api.clavue.com`), paste the key as
-   the auth token, and set model slots from the official family:
+1. Run `clavue-v1 auth login` (or choose `使用 clavue OAuth` during first
+   launch), sign in at `www.clavue.com`, and approve the device code.
+2. Clavue stores the session as the `Clavue 官方` provider profile and activates
+   the official family automatically:
 
 ```text
 主模型:   clavue-2.1        (official 27B coding model, 128K, premium pool)
@@ -109,8 +110,11 @@ Opus:     clavue-2.1-rev    (review-oriented; a different family from clavue-2.1
                              also works as CLAVUE_COMBO_REVIEW for cross-family review)
 ```
 
+Manual fallback: create a member API key at `https://www.clavue.com/account`,
+then add the `Clavue 官方` preset in `clavue-v1 provider`.
+
 `auto` is also accepted. The CLI talks to `api.clavue.com/v1/messages`
-(Anthropic Messages API) and `/provider current` shows your plan and remaining
+(Anthropic Messages-compatible protocol) and `/provider current` shows your plan and remaining
 points from the `x-clavue-points-*` response headers. Official identity is
 decided by exact host match only — a third-party gateway can never be
 mistaken for the official cloud.
@@ -145,7 +149,8 @@ clavue-v1 provider doctor # diagnose source-of-truth, drift, validation, and nex
 clavue-v1 provider validate
 ```
 
-Use `clavue-v1 auth login` only if you want the official Anthropic login path. Custom API users do not need official login.
+`clavue-v1 auth login` is the clavue OAuth entry point. Custom API users can
+continue to use `clavue-v1 provider` without an OAuth login.
 
 ## First Useful Session
 
@@ -157,19 +162,48 @@ Inspect the failing test around provider routing, make the smallest source fix,
 
 Clavue should inspect files directly, edit the source, run commands such as `node --test tests/<file>.test.mjs`, and report what was verified.
 
+### Welcome dashboard
+
+The startup box is a single-column dashboard rather than a marketing panel. Under the identity header it answers the questions that matter before the first prompt:
+
+```text
+路由      Clavue 官方 · api.clavue.com · clavue-2.1 · high effort
+槽位      main — · light — · plan gpt-5.4 · review —
+最近会话  6h  修复 provider 校验超时
+新特性    /goal 成为证据门控的任务控制器…
+快速开始  /init 生成 clavue.md 项目规则
+```
+
+- `路由` is where the next request goes: provider preset (or host for a custom route), effective main-slot model, and effort. When no route is configured it becomes the `/provider` call to action.
+- `槽位` shows the four `CLAVUE_COMBO_*` slots; unset slots render as `—`.
+- `新特性` and `/release-notes` read the bundled root `CHANGELOG.md` for the version you are running.
+- `公告` comes from the official feed at `https://www.clavue.com/tui/feed.json` (source: `docs/tui-feed/feed.json`, format in `docs/tui-feed/README.md`). It is cached in `~/.clavue/cache/tui-feed.json`, refreshed in the background, and can be disabled with `CLAVUE_TUI_FEED=0` or pointed at a mirror with `CLAVUE_TUI_FEED_URL`.
+- Provider smoke-test sessions (`Reply with exactly: OK`, `ping`, …) are hidden from `最近会话`.
+- The full dashboard appears after an upgrade or during project onboarding; routine startups use the condensed header. Set `CLAVUE_FORCE_FULL_LOGO=1` to always show it.
+
+### Data sharing (帮助改进 Clavue)
+
+Sessions that run on the **official Clavue cloud** (`api.clavue.com`) are used to improve Clavue models, in the same shape as Claude and Grok: participation is on by default, the CLI tells you once at startup, and you can turn it off at any time.
+
+- `/privacy-settings` shows the current state; `/privacy-settings off|on` switches the account; `/privacy-settings delete` erases everything already collected (completed within 24 hours).
+- Machine- or repository-level off switch without touching the account: `CLAVUE_DATA_SHARING=0`, or `{"dataSharing": false}` in `.clavue/settings.json`. Every request then carries `x-clavue-data-sharing: 0` and the gateway stores nothing.
+- Enterprise and education plans never participate. Third-party provider routes (OpenRouter, GLM, your own keys) are never seen by Clavue and therefore never collected.
+- What is stored: only the new message blocks of each turn plus the model reply, redacted (keys, JWTs, emails, home paths, IPs) and pseudonymized; private keys, `.env`, `id_rsa`, `.pem`, `credentials.json` contents are dropped whole. Raw data lives in R2 for **30 days** and is then deleted.
+- The CLI itself uploads nothing; capture happens on the gateway (`ops/training-capture/`, design in `docs/training-data-capture-plan-2026-09-02.md`).
+
 ## First-Run Setup Modes
 
 On first launch, Clavue should make the setup choice obvious:
 
 ```text
 请选择 API 配置模式:
-  使用官方登录
+  使用 clavue OAuth
   自定义 API 配置
   使用 CCR 代理
   跳过（稍后手动配置）
 ```
 
-- Use official login when you want the official Anthropic account flow.
+- Use clavue OAuth when you want the official Clavue membership flow.
 - Use custom API configuration when you have an API base URL plus API key or auth token.
 - Use CCR proxy when your environment already standardizes on a compatible proxy route.
 - Skip only when you want to configure later with `clavue-v1 provider` or `/provider`.
@@ -224,6 +258,27 @@ CLAVUE_COMBO_REVIEW_FIX_LOOP=1           # opt-in: a chain-end "P0:" verdict gra
   `docs/evals/combo-review/`), so the defaults do not spend your time until
   the discriminating experiment justifies it.
 
+## Subagent Model Matching
+
+Subagents (`Agent` tool, `/agents` definitions, `Explore`, `Plan`, teams) pick their model in this order:
+
+1. `CLAUDE_CODE_SUBAGENT_MODEL` (written by a provider profile's subagent slot) — an explicit global override that wins over everything.
+2. The `model` the caller or agent definition asked for:
+   - a combo slot name — `light`, `main`, `plan`, `review` — resolves to that `CLAVUE_COMBO_*` model verbatim; an unconfigured `light` falls back to `haiku`, the other slots to `inherit`;
+   - `haiku` is the fast tier: with `CLAVUE_COMBO_LIGHT` set it runs there (this is what `Explore` uses), otherwise it follows `ANTHROPIC_DEFAULT_HAIKU_MODEL`;
+   - `sonnet` / `opus` follow the parent's exact model when the parent is the same tier, else `ANTHROPIC_DEFAULT_*_MODEL`.
+3. `inherit` (the default) uses the parent conversation's model.
+
+Safety net for non-Claude routes: a bare tier alias that is not pinned by any of the variables above, on a gateway whose parent model is not a Claude model, inherits the parent instead of asking the route for a `claude-*` ID it cannot serve. Set `CLAVUE_COMBO_LIGHT` (or the `ANTHROPIC_DEFAULT_*_MODEL` pins that provider profiles write) to route tiers deliberately.
+
+```bash
+CLAVUE_COMBO_MAIN=deepseek-v4            # developer
+CLAVUE_COMBO_LIGHT=deepseek-v4-flash     # Explore / haiku-tier subagents / agents with `model: light`
+CLAVUE_COMBO_REVIEW=glm-5.3              # cross-family reviewer; agents with `model: review` run here too
+```
+
+The `/agents` wizard lists configured slots first and shows what each tier currently resolves to, so an agent can be pinned to "the fast slot" without knowing the underlying model ID. Parallel subagents run through the same concurrency-safe tool batching as every other tool (`CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY`, default 10); use `run_in_background` for independent work and foreground for results you need before continuing.
+
 ## Long-Running Session Memory
 
 Clavue automatically restarts normal long-running sessions with `--max-old-space-size=8192` before loading the full CLI. This prevents the common Node default ~4GB heap limit from killing large coding sessions with `Reached heap limit Allocation failed - JavaScript heap out of memory`.
@@ -244,7 +299,7 @@ Version check:
 
 ```bash
 npx -y clavue-v1 --version
-npx -y clavue-v1@1.2.0 --version
+npx -y clavue-v1@1.4.0 --version
 # available after a global install
 clavue-v1 --version
 ```
@@ -255,14 +310,28 @@ Provider/config entry point:
 clavue-v1 provider
 ```
 
-Anthropic account login/token commands:
+clavue OAuth:
 
 ```bash
 clavue-v1 auth login
-clavue-v1 setup-token
+clavue-v1 auth status --text
+clavue-v1 auth logout
 ```
 
-`clavue-v1 auth login` and `clavue-v1 setup-token` are only for Anthropic account auth flows. They are not the provider-profile entrypoint.
+The legacy Anthropic OAuth and long-lived `setup-token` flow are no longer
+user-facing login paths. Protocol-compatible API providers remain available
+through `clavue-v1 provider`.
+
+Canonical configuration names:
+
+```text
+~/.clavue/.clavue.json          global application state
+~/.clavue/settings.json         user settings
+<project>/.clavue/settings.json shared project settings
+<project>/.clavue/settings.local.json private project overrides
+<project>/clavue.md             project instructions
+<project>/clavue.local.md       private project instructions
+```
 
 ## In-Session Workflows
 
@@ -297,7 +366,22 @@ The Mao supervisor ledger is still used internally by delivery gates; user-facin
 
 Typing `agent teams` at the start of a prompt opens the same native `/team` flow instead of sending that phrase to the model as plain text. Agent teams are enabled by default in Clavue; set `CLAVUE_DISABLE_AGENT_TEAMS=1` or `CLAVUE_AGENT_TEAMS=0` before launch only if you need to disable them. Use `/team check` for a concrete readiness report.
 
-`/retro` runs a multi-round repo retrospective and upgrade loop guided by `PRODUCT.md` and `ARCHITECTURE.md`, with `tisheng.md` treated as historical context only when it still agrees.
+`/goal` turns a one-line objective into a durable mission. Clavue writes a ledger under `.clavue/goals/`, defines the plan itself, and keeps working across turns until evidence proves the objective, the budget runs out, or a real blocker appears. The loop is bounded: 20 auto-continued turns or 6 hours, whichever comes first. Exhaustion pauses the goal with an explicit `budget_exhausted` event; `/goal resume` grants a fresh budget. Completion is refused until at least one piece of evidence is on record, and starting a new goal supersedes the live one with an audit event.
+
+```text
+/goal ship the 1.4.0 release and verify npm, GitHub, and the website
+/goal criteria npm run check passes on main
+/goal evidence npm run test:fast passed (24 files)
+/goal status
+/goal pause waiting for the registry token
+/goal resume
+/goal complete release verified on npm and GitHub
+/goal stop superseded by hotfix
+```
+
+Only completed model turns advance the loop; `/goal status`, `/goal evidence`, and the other local subcommands never spend a turn or queue a duplicate mission prompt.
+
+`/retro` runs a multi-round repo retrospective and upgrade loop guided by `PRODUCT.md` and `ARCHITECTURE.md`, with `AGENTS.md` as the contributor contract and older planning notes under `docs/` treated as historical context only when they still agree. When a `/goal` is active, `/retro` treats that objective as the outer mission and records kept slices as goal evidence.
 
 ```text
 /retro
@@ -305,6 +389,16 @@ Typing `agent teams` at the start of a prompt opens the same native `/team` flow
 /retro onboarding and route validation
 ```
 
+`/review` reviews a pull request or local work with one rubric: findings anchored as `path:line`, severity markers `P0:`/`P1:`/`P2:`/`nit:` shared with the cross-family combo review hop, verified-vs-suspected labelling, and a single `Verdict:` line. With no argument it reviews the working tree when dirty, otherwise the current branch against its base.
+
+```text
+/review
+/review --staged
+/review --base origin/main
+/review 128
+/review 128 concurrency and error paths
+```
+
 Companion commands are still available and can either follow the current app provider or bind to a saved `/provider` profile independently.
 
 ```text
@@ -352,6 +446,7 @@ Companion commands are still available and can either follow the current app pro
 npm run validate:repo
 npm run typecheck
 npm run lint
+npm run check:branding
 npm run test:fast
 npm run verify:dist
 node scripts/verify-provider-command-sidecar.mjs
@@ -366,7 +461,8 @@ npm run package:release
 - `npm run validate:repo`: checks package metadata, required tracked files, workflow presence, and tag/version consistency
 - `npm run typecheck`: TypeScript 7 native full check (~2s) gated by a decrease-only error baseline in `scripts/typecheck-baseline.json`
 - `npm run lint`: Biome correctness rules scoped to changed files (`npm run lint:all` for the full tree)
-- `npm run test:fast`: curated 14-file high-signal suite under a 20s wall-clock budget
+- `npm run check:branding`: decrease-only ratchet (`scripts/branding-baseline.json`) on user-facing upstream Claude Code references in `src/` — changelog links, `clau.de` short links, product names in copy; `--list` prints every hit
+- `npm run test:fast`: curated high-signal suite under a 20s wall-clock budget
 - `npm run verify:dist`: smoke-tests `dist/cli.js`, provider setup, provider command, and release-critical sidecars
 - `node scripts/verify-provider-command-sidecar.mjs`: focused guard that fails if `dist/provider-command.js` drifts from the authored provider command source
 - `npm run verify:source-build`: rebuilds from `src/` into `experimental-dist/` and requires `--version` plus `--help` to boot under Node