clavue-v1 1.3.0 → 1.5.0

package/CHANGELOG.md

@@ -0,0 +1,65 @@
+# Changelog
+
+clavue / 克拉维 发布说明。本文件在构建时注入运行时，驱动启动画面的「新特性」栏和 `/release-notes` 命令。
+
+格式约定（`parseChangelog` 依赖）：二级标题为 `## <版本> - <日期>`，条目以 `- ` 开头，一行一条，命令与模型名保留英文。
+
+## 1.5.0 - 2026-09-02
+
+- 新增 `/resume-codex`、`/resume-claude`、`/resume-grok`：列出其他 CLI 在当前项目的会话，`latest / 序号 / id 前缀 / 标题关键词` 一键导入并在 Clavue 中接续；`--all` 浏览所有项目
+- 导入只读取来源文件：Codex `~/.codex/sessions` rollout、Claude Code `~/.claude/projects`、Grok Build `~/.grok/sessions`（含 sqlite 索引），过滤 AGENTS.md / environment_context 等注入内容
+- `/resume` 找不到会话时提示跨工具导入命令
+
+## 1.4.0 - 2026-09-02
+
+- 启动画面改为 clavue 仪表盘：`路由`（Provider · 主机 · 有效模型 · effort）、`槽位`（四个 `CLAVUE_COMBO_*`）、`公告`、`最近会话`、`新特性`
+- 发布说明改读内置 `CHANGELOG.md`：`新特性` 与 `/release-notes` 只显示当前运行版本的内容，不再拉取任何上游 changelog
+- 新增官方信息源 `www.clavue.com/tui/feed.json`：公告与轮播提示可远程更新，`CLAVUE_TUI_FEED=0` 关闭
+- 帮助改进 Clavue（数据共享）：官方云会话经脱敏、假名化后用于改进模型，30 天后自动删除；`/privacy-settings on|off|delete`，`CLAVUE_DATA_SHARING=0` 或项目级 `dataSharing: false` 可关闭
+- 状态栏与页脚中文化：`可信运维 已开启 (shift+tab 切换)`；过滤 Provider 冒烟测试会话
+- 移除 Anthropic 专属推广（guest passes、overage credit、Desktop / web / mobile / Slack / GitHub App）并新增 clavue 使用提示
+- 新增 `npm run check:branding`：用户可见文案中的上游品牌残留只降不升
+- 修复：`dist/openai-responses-adapter.js` 在不同构建间字节不一致（stub 插件不再拦截 `node_modules` 内的相对导入）
+
+## 1.3.0 - 2026-09-02
+
+- `/goal` 成为证据门控的任务控制器：无证据不可 complete，预算 20 轮 / 6 小时
+- `/goal criteria` 持久化成功标准，跨压缩与重启注入续跑提示
+- `/retro` 以 PRODUCT.md / ARCHITECTURE.md / AGENTS.md 为准绳，推荐 `npm run test:fast`
+- `/review` 统一评审规则：`P0/P1/P2/nit` 定位到 `path:line`，单行 Verdict 收尾
+- 子代理跟随组合槽位：`haiku` 级代理走 `CLAVUE_COMBO_LIGHT`，可直接声明 `model: light|main|plan|review`
+- 修复：子代理不再被重路由到 `CLAVUE_COMBO_MAIN`；plan hop 只在主线程触发
+- 非 Anthropic 网关上 MCP 工具内联发送，回归测试锁定该契约
+- `clavue OAuth` 取代 Anthropic 控制台登录，`/provider` 与 `clavue-v1 auth login` 共用设备码流程
+- 终端配色切换到 clavue 银色系；成功 / diff 语义色保持绿色
+
+## 1.2.0 - 2026-09-02
+
+- 跨家族组合评审 `CLAVUE_COMBO_REVIEW`：评审与开发模型并行，下一轮边界注入结论
+- 评审风暴防护：显著性门控 + 每条编辑链的评审预算
+- 严格 `P0:` 结论契约，可选一轮修复循环 `CLAVUE_COMBO_REVIEW_FIX_LOOP=1`
+- 新增 `clavue-official` 预设：`https://api.clavue.com` 会员 API Key，精确主机识别
+- 会员契约 v1：设备登录、更新清单、积分账本（`/provider current` 可见）
+- 学习型上下文上限：真实 "prompt is too long" 拒绝会收紧该模型的执行窗口
+- `/provider probe` 与网关 `/v1/models` 交叉校验，缺失模型直接报告
+- `CI=true` 下无凭据不再静默挂起，首个 API 调用处明确失败
+- 构建期 `feature()` 替换容忍换行调用并在残留时硬失败
+
+## 1.1.0 - 2026-09-01
+
+- TypeScript 7 原生 typecheck 门禁，错误基线只允许下降
+- Biome 变更文件 lint 门禁 `npm run lint`
+- 精选快速测试套件 `npm run test:fast`，20 秒墙钟预算
+- 发布契约与 `clavue-v1` 启动器对齐，重建过期的 dist
+
+## 1.0.1 - 2026-09-01
+
+- 要求 Node >= 22.18，文档与安装脚本对齐 `clavue-v1` bin
+- 去掉 `clavue` bin，避免全局安装 EEXIST 冲突
+- 混合槽位模型仅作建议，不再是硬门禁
+
+## 1.0.0 - 2026-09-01
+
+- v8.9.1 执行引擎之上的串行四槽位组合层：main / light / plan / review
+- 通过 `CLAVUE_COMBO_*` 环境变量按需开启，未配置时行为与 v8.9.1 一致
+- 槽位模型为任意字符串直通 API 层，不做白名单与家族过滤

package/README.md

@@ -65,8 +65,8 @@ npx -y clavue-v1
 Run a specific version with `npx`:
 
 ```bash
-npx -y clavue-v1@1.3.0 --version
-npx -y clavue-v1@1.3.0
+npx -y clavue-v1@1.5.0 --version
+npx -y clavue-v1@1.5.0
 ```
 
 Install globally from npm when you want the `clavue-v1` command to stay available:
@@ -88,7 +88,7 @@ curl -fsSL https://unpkg.com/clavue-v1/install.sh | bash
 Install a specific version globally:
 
 ```bash
-curl -fsSL https://unpkg.com/clavue-v1@1.3.0/install.sh | bash -s -- 1.3.0
+curl -fsSL https://unpkg.com/clavue-v1@1.5.0/install.sh | bash -s -- 1.5.0
 ```
 
 ## Quick Start: Official Clavue Cloud
@@ -162,6 +162,35 @@ Inspect the failing test around provider routing, make the smallest source fix,
 
 Clavue should inspect files directly, edit the source, run commands such as `node --test tests/<file>.test.mjs`, and report what was verified.
 
+### Welcome dashboard
+
+The startup box is a single-column dashboard rather than a marketing panel. Under the identity header it answers the questions that matter before the first prompt:
+
+```text
+路由      Clavue 官方 · api.clavue.com · clavue-2.1 · high effort
+槽位      main — · light — · plan gpt-5.4 · review —
+最近会话  6h  修复 provider 校验超时
+新特性    /goal 成为证据门控的任务控制器…
+快速开始  /init 生成 clavue.md 项目规则
+```
+
+- `路由` is where the next request goes: provider preset (or host for a custom route), effective main-slot model, and effort. When no route is configured it becomes the `/provider` call to action.
+- `槽位` shows the four `CLAVUE_COMBO_*` slots; unset slots render as `—`.
+- `新特性` and `/release-notes` read the bundled root `CHANGELOG.md` for the version you are running.
+- `公告` comes from the official feed at `https://www.clavue.com/tui/feed.json` (source: `docs/tui-feed/feed.json`, format in `docs/tui-feed/README.md`). It is cached in `~/.clavue/cache/tui-feed.json`, refreshed in the background, and can be disabled with `CLAVUE_TUI_FEED=0` or pointed at a mirror with `CLAVUE_TUI_FEED_URL`.
+- Provider smoke-test sessions (`Reply with exactly: OK`, `ping`, …) are hidden from `最近会话`.
+- The full dashboard appears after an upgrade or during project onboarding; routine startups use the condensed header. Set `CLAVUE_FORCE_FULL_LOGO=1` to always show it.
+
+### Data sharing (帮助改进 Clavue)
+
+Sessions that run on the **official Clavue cloud** (`api.clavue.com`) are used to improve Clavue models, in the same shape as Claude and Grok: participation is on by default, the CLI tells you once at startup, and you can turn it off at any time.
+
+- `/privacy-settings` shows the current state; `/privacy-settings off|on` switches the account; `/privacy-settings delete` erases everything already collected (completed within 24 hours).
+- Machine- or repository-level off switch without touching the account: `CLAVUE_DATA_SHARING=0`, or `{"dataSharing": false}` in `.clavue/settings.json`. Every request then carries `x-clavue-data-sharing: 0` and the gateway stores nothing.
+- Enterprise and education plans never participate. Third-party provider routes (OpenRouter, GLM, your own keys) are never seen by Clavue and therefore never collected.
+- What is stored: only the new message blocks of each turn plus the model reply, redacted (keys, JWTs, emails, home paths, IPs) and pseudonymized; private keys, `.env`, `id_rsa`, `.pem`, `credentials.json` contents are dropped whole. Raw data lives in R2 for **30 days** and is then deleted.
+- The CLI itself uploads nothing; capture happens on the gateway (`ops/training-capture/`, design in `docs/training-data-capture-plan-2026-09-02.md`).
+
 ## First-Run Setup Modes
 
 On first launch, Clavue should make the setup choice obvious:
@@ -270,7 +299,7 @@ Version check:
 
 ```bash
 npx -y clavue-v1 --version
-npx -y clavue-v1@1.3.0 --version
+npx -y clavue-v1@1.5.0 --version
 # available after a global install
 clavue-v1 --version
 ```
@@ -306,6 +335,23 @@ Canonical configuration names:
 
 ## In-Session Workflows
 
+### Resume sessions from other CLIs
+
+Work that started in Codex, Claude Code, or Grok Build can be continued in Clavue without copying anything by hand. Each product gets its own command; with no argument it lists that product's sessions for the current project, with a reference it imports the transcript and hands the model a condensed continuation seed.
+
+```text
+/resume-codex                 list Codex sessions for this project (newest first)
+/resume-codex --all           browse every project
+/resume-codex latest          import the newest one and continue here
+/resume-codex 3               by list position
+/resume-codex 019f58          by id prefix
+/resume-codex 限流 上线        by words in the title
+/resume-claude …              same for Claude Code's own session store
+/resume-grok …                same for Grok Build (directory store or sqlite index)
+```
+
+The other product's files are read-only; Clavue never writes to their directories. The seed carries the recent turns (tool payloads clipped), the tools and files that were touched, and an instruction to summarize first and never re-run recorded commands blindly. Harness-injected pseudo-user turns (`# AGENTS.md instructions`, `<environment_context>`, IDE context blocks) are dropped. Plain `/resume` still restores Clavue's own sessions and points to these commands when nothing matches.
+
 `/provider` manages saved profiles, current environment state, API URL, credential type, and model-slot routing from one place. Use it when you want to switch, validate, repair, or save the active route.
 
 ```text
@@ -340,7 +386,7 @@ Typing `agent teams` at the start of a prompt opens the same native `/team` flow
 `/goal` turns a one-line objective into a durable mission. Clavue writes a ledger under `.clavue/goals/`, defines the plan itself, and keeps working across turns until evidence proves the objective, the budget runs out, or a real blocker appears. The loop is bounded: 20 auto-continued turns or 6 hours, whichever comes first. Exhaustion pauses the goal with an explicit `budget_exhausted` event; `/goal resume` grants a fresh budget. Completion is refused until at least one piece of evidence is on record, and starting a new goal supersedes the live one with an audit event.
 
 ```text
-/goal ship the 1.3.0 release and verify npm, GitHub, and the website
+/goal ship the 1.5.0 release and verify npm, GitHub, and the website
 /goal criteria npm run check passes on main
 /goal evidence npm run test:fast passed (24 files)
 /goal status
@@ -417,6 +463,7 @@ Companion commands are still available and can either follow the current app pro
 npm run validate:repo
 npm run typecheck
 npm run lint
+npm run check:branding
 npm run test:fast
 npm run verify:dist
 node scripts/verify-provider-command-sidecar.mjs
@@ -431,7 +478,8 @@ npm run package:release
 - `npm run validate:repo`: checks package metadata, required tracked files, workflow presence, and tag/version consistency
 - `npm run typecheck`: TypeScript 7 native full check (~2s) gated by a decrease-only error baseline in `scripts/typecheck-baseline.json`
 - `npm run lint`: Biome correctness rules scoped to changed files (`npm run lint:all` for the full tree)
-- `npm run test:fast`: curated 14-file high-signal suite under a 20s wall-clock budget
+- `npm run check:branding`: decrease-only ratchet (`scripts/branding-baseline.json`) on user-facing upstream Claude Code references in `src/` — changelog links, `clau.de` short links, product names in copy; `--list` prints every hit
+- `npm run test:fast`: curated high-signal suite under a 20s wall-clock budget
 - `npm run verify:dist`: smoke-tests `dist/cli.js`, provider setup, provider command, and release-critical sidecars
 - `node scripts/verify-provider-command-sidecar.mjs`: focused guard that fails if `dist/provider-command.js` drifts from the authored provider command source
 - `npm run verify:source-build`: rebuilds from `src/` into `experimental-dist/` and requires `--version` plus `--help` to boot under Node
@@ -440,6 +488,7 @@ npm run package:release
 - `npm run check`: full local verification gate used by CI
 - `npm run build`: runs `check` and previews the publishable npm tarball with `npm pack --dry-run`
 - `npm run package:release`: runs `check` and produces archives in `release-artifacts/`
+- Publishing: the `Release Clavue` workflow verifies and packages on tag push, but npm publishing currently runs from the maintainer machine: `cd "/Volumes/myhd 1/clavue-v1/clavue-v1" && npm publish --access public --registry https://registry.npmjs.org` (the explicit registry matters because the local default is an npm mirror). Configure a trusted publisher for `clavue-v1` on npmjs.com to let CI publish instead.
 - `npm run rebuild:experimental`: manual alias for `npm run verify:source-build`
 - `npm run rebuild:experimental:legacy`: older reconstruction path kept for manual investigation