constella 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,312 @@
+<!-- ✦ ⋆ ｡˚ Constella — Changelog ˚｡ ⋆ ✦ -->
+# Changelog
+
+All notable changes to **Constella** are documented here — the complete construction history of the
+control plane, from the first scaffold (December 2025) to the current consolidated release.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project aims to
+follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Constella is **pre-1.0**: minor versions
+may still introduce breaking changes while the platform stabilises.
+
+🇧🇷 Versão em português: [CHANGELOG.pt-BR.md](CHANGELOG.pt-BR.md)
+
+---
+
+## [Unreleased]
+
+### Changed
+- Rewrote this changelog into a complete, versioned construction history — every screen and feature, from
+  `0.0.1` (Genesis, December 2025) to `0.1.0`.
+
+### Fixed
+- The PO board now hides issues whose goal was cancelled or archived (status-filtered), so a cancelled goal
+  no longer leaves orphan cards behind. Cancelled goals remain reopen-able from the Goals screen.
+
+### Documentation
+- Rebuilt the entire documentation portal from the live codebase: a cosmic-themed master `README.md`
+  (+ `README.pt-BR.md`) and a full English/Portuguese doc set under `docs/en/` and `docs/pt/`.
+- Added self-contained animated SVG assets under `docs/assets/` (hero, orbit divider, black hole, control
+  plane). No third-party visual services are referenced.
+- Standardised every document onto a single structure (purpose → how it works → flow → concepts → tables →
+  diagrams → steps → examples → states → integrations → security → troubleshooting → links) with Mermaid
+  diagrams for the architecture, agent and work-lifecycle flows.
+
+---
+
+## [0.1.0] — 2026-06-22 — "First consolidated release"
+
+The first end-to-end release: every previously deferred capability wired into the live system, the full
+bilingual documentation portal, and the release/hardware paths staged for validation.
+
+### Added
+- Wired the last previously-Planned capabilities into the runtime: the full `/slash` command set, KB
+  consult, Inbox emit points (review gate, guard denial, budget cap, update-available, architecture
+  decision), automatic PO grooming, the KB ingest gate, sprint close, DM intent parsing, and Team Room
+  **synced-block indicators** on messages.
+- **Telegram new-work flow** — a free-text request to the CEO over Telegram now drafts a real plan
+  (spec + issues), not just a chat reply; the bot's `/` command menu is registered automatically on
+  connect and on first poll.
+- `npm run dev:all` — runs the Next.js dev server and the background worker together so Telegram polling
+  and the cron tick work in development.
+
+### Changed
+- Relabelled the release, **VPS** and **Portable** paths as **In testing** pending operator validation
+  (no fabricated "shipped" status).
+- Lowered the Portable-mode minimum to 32 GB and dropped the 128 GB recommendation tier.
+
+### Fixed
+- Duplicate `@` removed from the Team Room composer mention hint.
+
+### Documentation
+- Full English + Portuguese documentation portal rebuilt from the live codebase, with a language toggle on
+  every page and Mermaid architecture/agent/work-lifecycle diagrams.
+
+---
+
+## [0.0.13] — 2026-06-09 — "Remote control & Public API"
+
+### Added
+- **Telegram remote control** — inline-keyboard actions, alerts with buttons, live progress push, and goal
+  control from the operator's phone (allowlisted to a single private chat).
+- **Public REST API v1** secured by Personal Access Tokens (`/api/v1`), plus an **MCP server**
+  (`scripts/mcp-server.mjs`) that exposes new-work creation and status to MCP clients.
+- **Web research for agents** — native WebSearch/WebFetch, a server-side `researchDocs` tool with an
+  official-docs allowlist, and a RAG cache; findings are captured back into the Knowledge Base.
+- **Learning → skills** — Vannevar proposes new skills from captured learnings; the operator approves.
+- Stack- and role-aware skill loading plus a planner playbook and design-system planning pass.
+- Optional real PO grooming — Donald derives story points and MoSCoW from priority.
+
+### Changed
+- Kanban columns are capped with internal scroll and auto-archive Done cards 24 h after they ship.
+- Downloaded GGUF models are machine-global (shared across workspaces) rather than per-workspace.
+- Switching organisation now hard-reloads so nothing stale carries over.
+
+### Fixed
+- The planner self-recovers a stale CEO working state, so a retry needs no restart.
+- PO sizing never emits 0 — story points and MoSCoW are always derived from priority.
+
+### Documentation
+- Full Portuguese versions of all docs with an EN/PT language toggle.
+
+---
+
+## [0.0.12] — 2026-05-26 — "Cockpit & Deploy"
+
+### Added
+- **Dashboard** reborn as an operational cockpit — health, execution, problems, KB, locks and
+  integrations with charts, donuts, sparklines and status cards (the old Modules grid is gone).
+- **Prepare-Deploy** center — environment detection, clean-tree build, checklist, security scan and a
+  preview pipeline.
+- **Welcome central chat** — a full web chat on `/` built on a shared chat module, with Team Room / Direct
+  / Telegram tabs, a context donut and a structured KB answer card.
+- Agents auto-capture learnings into the KB via `[[REMEMBER …]]` tokens, in DM and Telegram alike.
+
+### Changed
+- RAG uses the local LLM for all generation when a local model is running, with nomic-embed task prefixes
+  (`search_document` / `search_query`) on both index and query.
+- Agent and user avatars are stored in the database (resized data URLs), not the workspace.
+- Adaptive UI scale for large monitors (4K/2K/ultrawide).
+
+### Fixed
+- The GitHub Changes list is contained (internal scroll + collapse + count) — no more infinite list.
+- `/clear` now wipes the on-screen conversation and cleans up legacy workspace avatars.
+
+### Security
+- Patched the esbuild dev-server CORS advisory (GHSA-67mh-4wv8-2f99) via a dependency override.
+
+---
+
+## [0.0.11] — 2026-05-12 — "Knowledge Base & Welcome"
+
+### Added
+- **Knowledge agent (Vannevar)** owning RAG and chat indexing; the **Knowledge-Base engine** as a
+  state-aware source of truth, with curation and a visual **Knowledge** module.
+- **Synced Blocks** — a canonical knowledge-block engine with an agent-propose / operator-merge authoring
+  loop and report transclusion.
+- **Welcome home** as the operational landing page — hero, command bar, area cards, continue/decisions/PO/
+  activity sections, central knowledge and empty states.
+- Dual-language **i18n** framework with PT-BR for the core screens and a parity checker.
+- **Team Room** gains send-to-KB per message, filter-by-agent, and a traceability chip
+  (task · issue · goal · status).
+
+### Changed
+- PO and CTO (not only the CEO) can turn a request into work; opt-in **parallel agents** with per-file locks.
+- Core `/slash` commands in the composer (KB, status, new-work, reindex, curate) with autocomplete.
+- Code review uses the strongest available model and consults the security skills + KB.
+
+### Fixed
+- Capped agent execution at one per workspace per tick — closing the browser/worker race that caused OOM.
+- Stopped false "needs approval" pings and same-agent same-file re-edit chaos.
+- A Done issue no longer shows 0/4 todos or 0% — the Done column is authoritative.
+
+---
+
+## [0.0.10] — 2026-04-28 — "Local models & distribution"
+
+### Added
+- Local **GGUF catalog** grown from 192 to 438 real lmstudio-community models, with hardware fit-checking.
+- llama.cpp main (`:8082`) and RAG embed (`:8083`) servers auto-start on boot, offloaded to the GPU
+  (`-ngl`); the CUDA runtime DLLs are auto-installed so the GPU works out of the box.
+- RAG auto-indexes workspace memory on file change (debounced incremental re-embed).
+- **DM session manager** — multiple sessions per direct message.
+- **Compiled distribution** — end users receive a compiled package with no source in the public bundle.
+
+### Changed
+- Planner is non-blocking and refresh-safe, with a live CEO drafting surface (real-time stream, instant
+  lock); the launcher supervises web + worker and auto-restarts on crash.
+- Dependencies refreshed to latest stable within current majors.
+
+### Fixed
+- The chat server never loads an embedding model by mistake; download/install progress bars show
+  bytes-downloaded so they never look frozen.
+- Agents keep their chat history by using the model's real context window.
+
+### Security
+- Bumped drizzle-orm 0.36.4 → 0.45.2 (CVE-2026-39356, SQL injection, HIGH).
+- Overrode postcss to a patched ≥ 8.5.10 (Next bundled a vulnerable 8.4.31; build-tooling XSS).
+- P1 runtime hardening — shell-free spawn, worker loopback lock, non-root container, fail-closed boot.
+- Added `SECURITY.md` (private vulnerability reporting + handling policy).
+
+---
+
+## [0.0.9] — 2026-04-14 — "Models & agent CLIs"
+
+### Added
+- **Dynamic model catalog** (models.dev backbone) — no hardcoded model ids; a searchable provider/model
+  dropdown that only shows connected providers, plus a rich per-provider status panel with CLI auth
+  detection.
+- Eight new headless agent CLIs — Aider, OpenCode, Copilot, Cursor, Cline, Kilo, OpenClaw and Hermes —
+  joining the `claude` / `codex` adapters.
+- **Update** module (version check + context-aware update commands) and an execution-mode reorganisation
+  with CLI flags.
+- **VPS mode** (Docker + Tailscale) and **Portable mode** (USB) with space/size helpers and USB auto-detect.
+
+### Changed
+- CLI providers re-detect and repopulate their cache on refresh.
+
+### Security
+- Guarded public-publish script (secret-scan gated) so source and secrets never leak into the public bundle.
+
+---
+
+## [0.0.8] — 2026-03-31 — "Hardening & polish"
+
+### Added
+- **Security** screen and a destructive-command guard for agent shell/edit safety.
+- Two-factor authentication (TOTP) and WebAuthn **passkeys** on top of email/password.
+- **Update** check screen with pre-update backups.
+- Disable-animations switch (GPU savings) in the topbar, login and settings.
+
+### Changed
+- Styled confirm modals replace native browser dialogs across the app (clear conversation, delete session).
+
+### Security
+- AES-256-GCM **vault** for provider keys; secret scrubbing before KB ingest, Telegram sends and logs.
+- Filesystem **jail** for all agent file access — no path traversal; the workspace root is never deletable.
+- A worker secret and loopback SSRF guard between the worker and the web server.
+
+---
+
+## [0.0.7] — 2026-03-17 — "Integrations & config"
+
+### Added
+- **GitHub** integration — repository binding, git status and clean-source export.
+- Operational screens: **Plugins**, **Routines/Cron**, **Notifications**, **Costs**, **Pulse**, **Docs**
+  and **Code**.
+- Account and workspace management — **Profile**, **Config**, **Org** and **Organizations** screens.
+
+### Changed
+- Notification preferences (email / Telegram / in-app / weekly) persist per user.
+
+---
+
+## [0.0.6] — 2026-03-03 — "Knowledge & memory"
+
+### Added
+- First **Knowledge Base** with RAG memory and a **Knowledge** screen.
+- Full-text **Search** screen across goals, specs, issues and knowledge.
+- Synced-block seeds — mission, official stack and business rules as canonical references.
+
+### Changed
+- The KB deduplicates and types entries so repeated learnings collapse into one canonical record.
+
+---
+
+## [0.0.5] — 2026-02-17 — "Collaboration"
+
+### Added
+- **Team Room** with `@mention` coordination and **DM** channels.
+- Runner / collaboration engine with relay hand-offs and a 24/7 autonomous execution loop.
+- **Test Dev** — boots the project and drives it with headless Playwright, returning a
+  `PASS` / `FAIL` / `INCONCLUSIVE` verdict.
+- **Tasks**, **Activity** and **Reports** screens.
+
+### Changed
+- Agents inherit explicit, hand-off context so a relay continues work instead of restarting it.
+
+---
+
+## [0.0.4] — 2026-02-03 — "Work lifecycle"
+
+### Added
+- The full work lifecycle — Goal → Spec → Issue → Plan → Execution → Review → Test → Done.
+- **Planner** (CEO drafting surface), the **PM** kanban board, the **Goals** screen and the **Inbox**.
+
+### Changed
+- Issue progress is derived from its todos, and the Done column is treated as authoritative.
+
+---
+
+## [0.0.3] — 2026-01-20 — "The company"
+
+### Added
+- The 10-agent company — Ada, Linus, Donald, Margaret, Grace, Edsger, Werner, Barbara, Whitfield and
+  Vannevar — with a reporting hierarchy, per-agent models and daily cost caps.
+- **Real agent execution** via `claude` / `codex` CLI adapters, jailed to the workspace, with
+  run-mode-aware permission levels.
+
+### Changed
+- Each agent runs under its own model and budget cap, so cost is bounded per role.
+
+---
+
+## [0.0.2] — 2026-01-06 — "Onboarding"
+
+### Added
+- **Onboarding wizard** — creates the organisation, imports an existing project (GitHub clone / local
+  directory / mock) or scaffolds a runnable starter, writes the `.claude/` control layer, seeds the
+  agents, skills library and native plugins, and runs the first plan into `specs/SUPER-SPEC.md`.
+- **Project Stacks** inference from the imported project.
+
+### Changed
+- A fresh project scaffolds a bootable starter so the workspace runs from the very first tick.
+
+---
+
+## [0.0.1] — 2025-12-10 — "Genesis"
+
+### Added
+- Next.js control-plane scaffold with a per-organisation runtime root under `~/.constella` and workspace
+  isolation (`~/.constella/organizations/<orgId>/workspace`).
+- SQLite persistence (drizzle-orm + better-sqlite3) and secrets in `<HOME>/.env`.
+- `better-auth` email/password sign-in and the **Login** screen.
+- Supervised web + worker processes — a Next.js control plane plus a background worker (`bin/worker.mjs`)
+  running the cron tick and a file watcher; the supervisor restarts dead children.
+
+---
+
+[Unreleased]: https://github.com/gabriel7silva/constella/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/gabriel7silva/constella/releases/tag/v0.1.0
+[0.0.13]: https://github.com/gabriel7silva/constella/compare/v0.0.12...v0.0.13
+[0.0.12]: https://github.com/gabriel7silva/constella/compare/v0.0.11...v0.0.12
+[0.0.11]: https://github.com/gabriel7silva/constella/compare/v0.0.10...v0.0.11
+[0.0.10]: https://github.com/gabriel7silva/constella/compare/v0.0.9...v0.0.10
+[0.0.9]: https://github.com/gabriel7silva/constella/compare/v0.0.8...v0.0.9
+[0.0.8]: https://github.com/gabriel7silva/constella/compare/v0.0.7...v0.0.8
+[0.0.7]: https://github.com/gabriel7silva/constella/compare/v0.0.6...v0.0.7
+[0.0.6]: https://github.com/gabriel7silva/constella/compare/v0.0.5...v0.0.6
+[0.0.5]: https://github.com/gabriel7silva/constella/compare/v0.0.4...v0.0.5
+[0.0.4]: https://github.com/gabriel7silva/constella/compare/v0.0.3...v0.0.4
+[0.0.3]: https://github.com/gabriel7silva/constella/compare/v0.0.2...v0.0.3
+[0.0.2]: https://github.com/gabriel7silva/constella/compare/v0.0.1...v0.0.2
+[0.0.1]: https://github.com/gabriel7silva/constella/releases/tag/v0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gabriel Silva
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.