esedre 1.0.0 → 1.1.0

package/CHANGELOG.md

@@ -5,6 +5,49 @@ All notable changes to Esedre are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.0] - 2026-10-02
+
+### Added
+- **Completed Full Set of Edit Capabilities in the UI & Interactive Planning Engine**:
+  - **Open Decisions & Questions Answering**: Completed planned UI editing and persistence for developer answers to Open Decisions and Questions directly into ticket storage (`answers.json`), with real-time hydration across `/api/planning/answers` and `/api/planning/all`.
+  - **Live Specification Detail Editing**: Completed planned real-time editing of ticket Markdown specifications in the UI via `POST /api/planning/details`, with direct sync to `detail.md` on disk, automatic timestamp tracking, and revision bumping.
+  - **Interactive Inline Text Annotations**: Completed planned text selection commentary in the UI via `POST /api/planning/save-inline-comment` and `GET /api/planning/inline-comments`, persisting highlighted annotations to `inline-comments.json`.
+  - **Discussion Media Attachments Pipeline**: Completed planned drag-and-drop and clipboard paste media attachment uploading and streaming via `POST /api/planning/upload-attachment` and `GET /api/planning/attachment`, with path traversal protections, deduplication guards, and automatic MIME detection.
+  - **Local Draft Recovery**: Added automatic browser draft caching in `localStorage` (`dev_planner_question_drafts`) for developer question replies, ensuring in-progress answers are never lost during accidental reloads or tab navigation.
+  - **CLI Answer Visibility**: Enhanced `ese get` output to automatically display recorded answers beneath their corresponding Open Decisions & Questions.
+  - **Smart Data Hub Inheritance**: Enabled workspace configuration (`.esedre/esedre.json`) to omit `dataDir` and seamlessly inherit from user-level global configuration (`~/.esedre/config.json`) when the hub contains the project.
+  - **Multi-Workspace Batch Upgrade Automation (`ese upgrade --all`)**: Extended `ese upgrade` with `--all` (`-a`) to automatically scan all registered workspace projects declared in `~/.esedre/config.json`, upgrade shell wrappers (`.esedre/esedre.cmd`, `.esedre/ese.cmd`, `.esedre/esedre.ps1`, `.esedre/ese.ps1`), synchronize agent skills, and regenerate `.esedre/snapshot.json` projections.
+  - **Wrapper Health Diagnostics**: Added `isWrapperOutdated` and `findOutdatedWrappers` in `src/upgrade.ts` to detect legacy CMD wrappers containing parenthesized compound blocks or `goto :done`. Exposed non-blocking diagnostic notices in `ese status` and `ese status --json`.
+  - **Ticket Card Pill Layout Standardization**: Reorganized ticket card header metadata into two distinct rows: fixed-width pills in Row 1 (Type, Complexity, Priority, Blocked indicator, Status) and flexible-width badges in Row 2 (Project badge in All Projects view, Feature Flag, Milestone).
+  - **Ticket Specification Detail Updates via CLI & MCP (Ticket #49)**: Added `--detail "<md>"` and `--file <path>` options to `ese update`, and `detail` / `detailMarkdown` parameters to `esedre_update_ticket` MCP tool. Specification updates reconcile metadata headers, preserve OCC validation, and automatically invalidate caches.
+  - **In-Memory Query Caching & Zero-Flash UI Fast-Path (Ticket #47)**: Added in-memory caching to `FilesystemStorageAdapter` with automatic mutation invalidation and background hydration, eliminating empty state flashing and load lag.
+  - **Standardized Git Branching & Clean Commit Format**: Codified `release/upcoming` staging trunk integration workflow and `[#<ticket>] <Action Summary>` clean commit message standards, prohibiting conventional commit prefixes across repositories.
+
+### Fixed
+- **Windows CMD Batch Label Error in Consuming Workspaces**: Hardened `WRAPPER_CMD` subroutine dispatch and eliminated legacy parenthesized `goto :done` blocks in downstream consuming repositories that caused `cmd.exe` to fail with `'The system cannot find the batch label specified - done'` (Ticket #43).
+- **Dual-Stack Loopback Binding**: Configured Vite development server (`vite.config.ts`) with `host: '0.0.0.0'`, ensuring consuming development reverse proxies can proxy planning endpoints to `http://127.0.0.1:5674` without `502 Bad Gateway` / `ECONNREFUSED` connection drops on Windows IPv4/IPv6 dual-stack setups.
+- **Deep-Linking & History Push for Multi-Part Projects**: Enhanced hash parsing and resolution (`parseTicketHash`, `resolveFeatureFromHash`, `getFeatureHash`) to robustly support hyphens and multi-word project names (e.g. `#ticket-alce-web-1`), deep link directly to tickets on page load with automatic project filter switching and scrolling, while preserving history push in standalone mode and preventing history interference in embedded mode.
+- **Root URL Hash Push Bug**: Fixed bug where navigating to the root standalone UI URL (`http://localhost:5674/`) automatically forced and pushed `#ticket-1` to the browser address bar. The UI now preserves clean root URLs without pushing ticket hashes unless a ticket is explicitly clicked or deep-linked.
+- **Header Popover Viewport Containment**: Constrained card header dropdown popovers (Type, Priority, Status, Complexity, Feature Flag, Milestone) to fit within viewport height with smooth vertical scrolling and sticky subheadings, preventing offscreen vertical clipping.
+- **Project Filter Dropdown & Hash Decoupling**: Fixed bug where ticket display names were assigned to feature project properties, causing corrupted URL search parameters and locking the project filter dropdown. Decoupled project selection from the hash listener effect and normalized filter lookups.
+- **Test Suite Data Hub Isolation Guard**: Hardened `getGlobalConfigDir()` in `src/config.ts` to automatically redirect to a temporary sandbox directory when running under Vitest (`process.env.VITEST`), preventing unit test runs from reading or mutating developer machines' active `~/.esedre/config.json` and real data hubs.
+
+### Security & Hardening
+- **REST Endpoint Parameter Validation & Cache Invalidation**:
+  - Added strict parameter checks on mutating planning endpoints (`ticketId` required on plans, comments, details, meta updates, and flags).
+  - Wired real-time API cache invalidation across all mutating endpoints to ensure `/api/planning/all` never returns stale projections.
+  - Hardened attachment endpoints against path traversal attacks (`..`, `.`, subpaths) and directory reads, verifying regular file integrity.
+  - Enforced Agent Project Allow-List authorization across all attachment lookups and new storage endpoints.
+
+## [1.0.1] - 2026-09-28
+
+### Added
+- **Public Open-Source Readiness & Repository Sanitization**:
+  - Decoupled and gitignored local development tunnel credentials and endpoint configurations (`tools/tunnel/config.yml`), providing `tools/tunnel/config.yml.example` reference template for public contributors.
+  - Dynamically resolve Vite allowed hostnames (`resolveAllowedHosts`) from local tunnel configurations and `ESEDRE_ALLOWED_HOSTS` environment variable, eliminating hardcoded domains.
+  - Dynamically resolve development build artifact bridge destinations (`scripts/bridge.js`) via local gitignored `.bridge-dest` file or `ESEDRE_BRIDGE_DEST` environment variable.
+  - Genericized documentation, agent skills, and built-in skill templates (`AGENTS.md`, `esedre_storage_engine`, `src/upgrade.ts`) to eliminate proprietary repository paths and internal domain references.
+
 ## [1.0.0] - 2026-09-27
 
 ### Added
@@ -69,7 +112,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 - **Smart npm Publish Lifecycle Wrapper (`npm run pub`)**: Upfront authentication pre-check (`npm whoami`) with automatic interactive login before compilation, executing full prepublish test/lint/build lifecycle.
-- **Multi-Layer Zero-Crawl Protection**: Edge and Vite middleware security preventing search spiders and AI crawler cataloging on development tunnels (`esedre.aroomwithamoose.com`).
+- **Multi-Layer Zero-Crawl Protection**: Edge and Vite middleware security preventing search spiders and AI crawler cataloging on development Cloudflare tunnels.
 - **Canonical Apex Ecosystem Links**: Standardized all portfolio ecosystem references to canonical apex `https://arwam.com`.
 
 ## [0.1.8] - 2026-09-11

package/README.md

@@ -118,7 +118,7 @@ Core day-to-day workflow commands for scoping, viewing, planning, and verifying
 | `get` | `ese get <id> [--json]` | View ticket specifications, feature breakdown, comments, links, and SHA-1 hash. |
 | `plan` | `ese plan <id> [--set "<markdown>"] [--file <path>] [--last-hash <h>]` | Read or update the active implementation plan markdown. |
 | `create` | `ese create --title "..." [-p\|--project <code>] [-t\|--type <type>] [-P\|--priority <priority>] [-m\|--milestone <name>] [--detail "<md>"] [--file <path>]` | Create a new ticket with auto-sequential ID, optional priority, optional milestone, and specification markdown. Title strictly capped at 48 chars. |
-| `update` | `ese update <id> [-s\|--status <status>] [-t\|--type <type>] [-P\|--priority <priority\|none>] [-m\|--milestone <name\|none>] [--title "..."] [--last-hash <h>]` | Update ticket status, type, priority, milestone, or title with optimistic concurrency protection. |
+| `update` | `ese update <id> [-s\|--status <status>] [-t\|--type <type>] [-P\|--priority <priority\|none>] [-m\|--milestone <name\|none>] [--title "..."] [--detail "<md>"] [--file <path>] [--last-hash <h>]` | Update ticket status, type, priority, milestone, title, or specification markdown with optimistic concurrency protection. |
 | `link` | `ese link <sourceId> <relation> <targetId> [--author "..."]` | Establish a bi-directional link between two tickets. Relations: `relates-to`, `blocks`, `parent-of`, `duplicates`. |
 | `unlink` | `ese unlink <sourceId> <targetId> [--relation <relation>]` | Remove a bi-directional link between two tickets. |
 | `milestone` | `ese milestone [list\|get\|create\|update\|delete] [args...]` | Manage project milestones and umbrella feature flags with deliverables tracking. |
@@ -148,7 +148,7 @@ Commands for repository onboarding, central machine linking, and maintenance:
 | `configure` | `ese configure [add <path> \| remove <code\|path> \| set <k> <v>]` | Inspect or mutate central configuration (`~/.esedre/config.json`). Link external project repositories or data hubs. |
 | `rename-project` | `ese rename-project <oldCode> <newCode> [--name "<name>"]` | Rename a project code across directory storage paths, manifests, and tickets. |
 | `project set` | `ese project set <code> [--name "<name>"]` | Update metadata for an existing project (e.g. display name). |
-| `upgrade` | `ese upgrade [<path>] [--force \| -f]` | Upgrade workspace configuration schema, in-repo wrappers, and agent skills. |
+| `upgrade` | `ese upgrade [<path>] [--all \| -a] [--force \| -f]` | Upgrade workspace configuration schema, in-repo wrappers, and agent skills across current or all registered workspaces. |
 
 > **Human vs LLM Agent Workflows**: Developer Administration commands (`init`, `configure`, `upgrade`) manage system-level repository linking and central machine configuration. They are intended for human developers during initial setup. Autonomous LLM coding partners operate within the authorized workspace scope using Roadmap and Service Daemon commands (`list`, `get`, `plan`, `create`, `update`, `comment`, `snapshot`, `start`, `status`).
 
@@ -158,6 +158,15 @@ Esedre cleanly separates external repository linking from centralized data hub p
 * **Link Existing Repositories (`ese configure add <repoPath>`)**: Registers an external code repository in your central `projects` map (`~/.esedre/config.json`) for federated multi-repo workflows.
 * **Create Data Hub Projects (`ese init --project <code> [--name "<name>"] [--hub <hub>]`)**: Registers a non-development or standalone project directly inside your configured ticket data hub (`dataDir`). When multiple data hubs exist, pass `--hub <name|path>` to disambiguate.
 
+#### Central Configuration & Hoisted Data Directories
+
+Esedre employs a two-tier configuration model that cleanly isolates machine-specific paths from project repositories:
+* **Central Machine Configuration (`~/.esedre/config.json`)**: Configured via `ese configure`, this file holds user-level settings for your machine: registered ticket data hubs (`dataDir`, such as `../esedre-data`), linked external repository paths (`projects`), and the default server port.
+* **Workspace Repository Configuration (`.esedre/esedre.json`)**: Project code repositories only need a lightweight descriptor declaring their `projectCode` and authorized `allowedProjects` scope.
+* **Smart Data Hub Inheritance**: When `dataDir` is omitted from `.esedre/esedre.json`, Esedre automatically checks if your central data hub in `~/.esedre/config.json` contains the project. If found, it inherits the hub path seamlessly. Different developers collaborating on the same codebase can maintain their ticket hubs in different filesystem locations without committing machine-specific relative paths to version control.
+* **Subdirectory Guard in `ese init`**: Initializing a repository via `ese init` does not write `dataDir` to `.esedre/esedre.json` when the configured data hub is located outside the repository. A `dataDir` property is only written to `.esedre/esedre.json` if `dataDir` is a subdirectory within the project's repository (such as a monorepo subfolder or in-repo ticket directory), or if explicitly specified via `--data-dir`.
+* **Local In-Repo Overrides**: If a repository explicitly specifies `dataDir` in its `.esedre/esedre.json`, the local configuration takes full precedence, ensuring standalone in-repo ticket stores remain completely independent.
+
 #### Unique Project Codes Across Data Hubs
 
 Project codes must be unique across all configured data hubs. Esedre does not support duplicate project codes across data hubs. If duplicate project codes are detected across multiple hubs: