clavue-v1 1.3.0 → 1.4.0

package/CHANGELOG.md

@@ -0,0 +1,59 @@
+# Changelog
+
+clavue / 克拉维 发布说明。本文件在构建时注入运行时，驱动启动画面的「新特性」栏和 `/release-notes` 命令。
+
+格式约定（`parseChangelog` 依赖）：二级标题为 `## <版本> - <日期>`，条目以 `- ` 开头，一行一条，命令与模型名保留英文。
+
+## 1.4.0 - 2026-09-02
+
+- 启动画面改为 clavue 仪表盘：`路由`（Provider · 主机 · 有效模型 · effort）、`槽位`（四个 `CLAVUE_COMBO_*`）、`公告`、`最近会话`、`新特性`
+- 发布说明改读内置 `CHANGELOG.md`：`新特性` 与 `/release-notes` 只显示当前运行版本的内容，不再拉取任何上游 changelog
+- 新增官方信息源 `www.clavue.com/tui/feed.json`：公告与轮播提示可远程更新，`CLAVUE_TUI_FEED=0` 关闭
+- 帮助改进 Clavue（数据共享）：官方云会话经脱敏、假名化后用于改进模型，30 天后自动删除；`/privacy-settings on|off|delete`，`CLAVUE_DATA_SHARING=0` 或项目级 `dataSharing: false` 可关闭
+- 状态栏与页脚中文化：`可信运维 已开启 (shift+tab 切换)`；过滤 Provider 冒烟测试会话
+- 移除 Anthropic 专属推广（guest passes、overage credit、Desktop / web / mobile / Slack / GitHub App）并新增 clavue 使用提示
+- 新增 `npm run check:branding`：用户可见文案中的上游品牌残留只降不升
+- 修复：`dist/openai-responses-adapter.js` 在不同构建间字节不一致（stub 插件不再拦截 `node_modules` 内的相对导入）
+
+## 1.3.0 - 2026-09-02
+
+- `/goal` 成为证据门控的任务控制器：无证据不可 complete，预算 20 轮 / 6 小时
+- `/goal criteria` 持久化成功标准，跨压缩与重启注入续跑提示
+- `/retro` 以 PRODUCT.md / ARCHITECTURE.md / AGENTS.md 为准绳，推荐 `npm run test:fast`
+- `/review` 统一评审规则：`P0/P1/P2/nit` 定位到 `path:line`，单行 Verdict 收尾
+- 子代理跟随组合槽位：`haiku` 级代理走 `CLAVUE_COMBO_LIGHT`，可直接声明 `model: light|main|plan|review`
+- 修复：子代理不再被重路由到 `CLAVUE_COMBO_MAIN`；plan hop 只在主线程触发
+- 非 Anthropic 网关上 MCP 工具内联发送，回归测试锁定该契约
+- `clavue OAuth` 取代 Anthropic 控制台登录，`/provider` 与 `clavue-v1 auth login` 共用设备码流程
+- 终端配色切换到 clavue 银色系；成功 / diff 语义色保持绿色
+
+## 1.2.0 - 2026-09-02
+
+- 跨家族组合评审 `CLAVUE_COMBO_REVIEW`：评审与开发模型并行，下一轮边界注入结论
+- 评审风暴防护：显著性门控 + 每条编辑链的评审预算
+- 严格 `P0:` 结论契约，可选一轮修复循环 `CLAVUE_COMBO_REVIEW_FIX_LOOP=1`
+- 新增 `clavue-official` 预设：`https://api.clavue.com` 会员 API Key，精确主机识别
+- 会员契约 v1：设备登录、更新清单、积分账本（`/provider current` 可见）
+- 学习型上下文上限：真实 "prompt is too long" 拒绝会收紧该模型的执行窗口
+- `/provider probe` 与网关 `/v1/models` 交叉校验，缺失模型直接报告
+- `CI=true` 下无凭据不再静默挂起，首个 API 调用处明确失败
+- 构建期 `feature()` 替换容忍换行调用并在残留时硬失败
+
+## 1.1.0 - 2026-09-01
+
+- TypeScript 7 原生 typecheck 门禁，错误基线只允许下降
+- Biome 变更文件 lint 门禁 `npm run lint`
+- 精选快速测试套件 `npm run test:fast`，20 秒墙钟预算
+- 发布契约与 `clavue-v1` 启动器对齐，重建过期的 dist
+
+## 1.0.1 - 2026-09-01
+
+- 要求 Node >= 22.18，文档与安装脚本对齐 `clavue-v1` bin
+- 去掉 `clavue` bin，避免全局安装 EEXIST 冲突
+- 混合槽位模型仅作建议，不再是硬门禁
+
+## 1.0.0 - 2026-09-01
+
+- v8.9.1 执行引擎之上的串行四槽位组合层：main / light / plan / review
+- 通过 `CLAVUE_COMBO_*` 环境变量按需开启，未配置时行为与 v8.9.1 一致
+- 槽位模型为任意字符串直通 API 层，不做白名单与家族过滤

package/README.md

@@ -65,8 +65,8 @@ npx -y clavue-v1
 Run a specific version with `npx`:
 
 ```bash
-npx -y clavue-v1@1.3.0 --version
-npx -y clavue-v1@1.3.0
+npx -y clavue-v1@1.4.0 --version
+npx -y clavue-v1@1.4.0
 ```
 
 Install globally from npm when you want the `clavue-v1` command to stay available:
@@ -88,7 +88,7 @@ curl -fsSL https://unpkg.com/clavue-v1/install.sh | bash
 Install a specific version globally:
 
 ```bash
-curl -fsSL https://unpkg.com/clavue-v1@1.3.0/install.sh | bash -s -- 1.3.0
+curl -fsSL https://unpkg.com/clavue-v1@1.4.0/install.sh | bash -s -- 1.4.0
 ```
 
 ## Quick Start: Official Clavue Cloud
@@ -162,6 +162,35 @@ Inspect the failing test around provider routing, make the smallest source fix,
 
 Clavue should inspect files directly, edit the source, run commands such as `node --test tests/<file>.test.mjs`, and report what was verified.
 
+### Welcome dashboard
+
+The startup box is a single-column dashboard rather than a marketing panel. Under the identity header it answers the questions that matter before the first prompt:
+
+```text
+路由      Clavue 官方 · api.clavue.com · clavue-2.1 · high effort
+槽位      main — · light — · plan gpt-5.4 · review —
+最近会话  6h  修复 provider 校验超时
+新特性    /goal 成为证据门控的任务控制器…
+快速开始  /init 生成 clavue.md 项目规则
+```
+
+- `路由` is where the next request goes: provider preset (or host for a custom route), effective main-slot model, and effort. When no route is configured it becomes the `/provider` call to action.
+- `槽位` shows the four `CLAVUE_COMBO_*` slots; unset slots render as `—`.
+- `新特性` and `/release-notes` read the bundled root `CHANGELOG.md` for the version you are running.
+- `公告` comes from the official feed at `https://www.clavue.com/tui/feed.json` (source: `docs/tui-feed/feed.json`, format in `docs/tui-feed/README.md`). It is cached in `~/.clavue/cache/tui-feed.json`, refreshed in the background, and can be disabled with `CLAVUE_TUI_FEED=0` or pointed at a mirror with `CLAVUE_TUI_FEED_URL`.
+- Provider smoke-test sessions (`Reply with exactly: OK`, `ping`, …) are hidden from `最近会话`.
+- The full dashboard appears after an upgrade or during project onboarding; routine startups use the condensed header. Set `CLAVUE_FORCE_FULL_LOGO=1` to always show it.
+
+### Data sharing (帮助改进 Clavue)
+
+Sessions that run on the **official Clavue cloud** (`api.clavue.com`) are used to improve Clavue models, in the same shape as Claude and Grok: participation is on by default, the CLI tells you once at startup, and you can turn it off at any time.
+
+- `/privacy-settings` shows the current state; `/privacy-settings off|on` switches the account; `/privacy-settings delete` erases everything already collected (completed within 24 hours).
+- Machine- or repository-level off switch without touching the account: `CLAVUE_DATA_SHARING=0`, or `{"dataSharing": false}` in `.clavue/settings.json`. Every request then carries `x-clavue-data-sharing: 0` and the gateway stores nothing.
+- Enterprise and education plans never participate. Third-party provider routes (OpenRouter, GLM, your own keys) are never seen by Clavue and therefore never collected.
+- What is stored: only the new message blocks of each turn plus the model reply, redacted (keys, JWTs, emails, home paths, IPs) and pseudonymized; private keys, `.env`, `id_rsa`, `.pem`, `credentials.json` contents are dropped whole. Raw data lives in R2 for **30 days** and is then deleted.
+- The CLI itself uploads nothing; capture happens on the gateway (`ops/training-capture/`, design in `docs/training-data-capture-plan-2026-09-02.md`).
+
 ## First-Run Setup Modes
 
 On first launch, Clavue should make the setup choice obvious:
@@ -270,7 +299,7 @@ Version check:
 
 ```bash
 npx -y clavue-v1 --version
-npx -y clavue-v1@1.3.0 --version
+npx -y clavue-v1@1.4.0 --version
 # available after a global install
 clavue-v1 --version
 ```
@@ -340,7 +369,7 @@ Typing `agent teams` at the start of a prompt opens the same native `/team` flow
 `/goal` turns a one-line objective into a durable mission. Clavue writes a ledger under `.clavue/goals/`, defines the plan itself, and keeps working across turns until evidence proves the objective, the budget runs out, or a real blocker appears. The loop is bounded: 20 auto-continued turns or 6 hours, whichever comes first. Exhaustion pauses the goal with an explicit `budget_exhausted` event; `/goal resume` grants a fresh budget. Completion is refused until at least one piece of evidence is on record, and starting a new goal supersedes the live one with an audit event.
 
 ```text
-/goal ship the 1.3.0 release and verify npm, GitHub, and the website
+/goal ship the 1.4.0 release and verify npm, GitHub, and the website
 /goal criteria npm run check passes on main
 /goal evidence npm run test:fast passed (24 files)
 /goal status
@@ -417,6 +446,7 @@ Companion commands are still available and can either follow the current app pro
 npm run validate:repo
 npm run typecheck
 npm run lint
+npm run check:branding
 npm run test:fast
 npm run verify:dist
 node scripts/verify-provider-command-sidecar.mjs
@@ -431,7 +461,8 @@ npm run package:release
 - `npm run validate:repo`: checks package metadata, required tracked files, workflow presence, and tag/version consistency
 - `npm run typecheck`: TypeScript 7 native full check (~2s) gated by a decrease-only error baseline in `scripts/typecheck-baseline.json`
 - `npm run lint`: Biome correctness rules scoped to changed files (`npm run lint:all` for the full tree)
-- `npm run test:fast`: curated 14-file high-signal suite under a 20s wall-clock budget
+- `npm run check:branding`: decrease-only ratchet (`scripts/branding-baseline.json`) on user-facing upstream Claude Code references in `src/` — changelog links, `clau.de` short links, product names in copy; `--list` prints every hit
+- `npm run test:fast`: curated high-signal suite under a 20s wall-clock budget
 - `npm run verify:dist`: smoke-tests `dist/cli.js`, provider setup, provider command, and release-critical sidecars
 - `node scripts/verify-provider-command-sidecar.mjs`: focused guard that fails if `dist/provider-command.js` drifts from the authored provider command source
 - `npm run verify:source-build`: rebuilds from `src/` into `experimental-dist/` and requires `--version` plus `--help` to boot under Node