orbit-thread 1.1.0 → 1.2.1

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 1.2.1 — 12 October 2026
+
+- Fix Orbit Resume reporting "No verified milestones recorded" for valid handoffs that use `## Completed this session`. Resume now reads both headings.
+- Fix Orbit Resume reading only the first line of each handoff section; every section now runs to the next `##` heading or the end of the file (LF and CRLF), still capped at six entries.
+- `## Completed milestones` remains the canonical heading; when both exist the canonical section wins and entries are not duplicated.
+- No change to the handoff format, read-only behaviour, redaction, stale-handoff detection, 50-line limit or Git safety. Existing v1.2.0 installations and handoffs keep working; `orbit-thread update` refreshes the version.
+
+## 1.2.0 — 12 October 2026
+
+- Add **Orbit Resume**, a third canonical skill that recovers project context at the start of a fresh Codex or Claude Code session from the latest usable handoff, current Git state and only the living docs the task needs.
+- Add read-only `npx orbit-thread resume` for a concise terminal summary of handoff, Git state and next action.
+- Invoke manually with `$orbit-resume` (Codex), `/orbit-resume` (Claude Code) or `/orbit-thread:orbit-resume` (Claude marketplace plugin). Invocation can also be automatic where the host supports implicit skill invocation (`allow_implicit_invocation: true`); manual invocation is the documented fallback.
+- Treat the handoff as a lead: current Git state and tracked docs override stale details, and missing, malformed, stale or future-dated handoffs are reported rather than guessed.
+- Security safeguards: Resume is read-only and never resets, cleans, stashes, stages, commits or otherwise changes the working tree; it strips terminal-control sequences from displayed repository and handoff text, redacts secret-looking values, and does not read `.env` files, credentials or unrelated files.
+- Install, update, Doctor and uninstall now manage all three skills (`handoff`, `orbit-setup`, `orbit-resume`) for both agents.
+- Backwards compatible: existing v1.1.0 installations, `HANDOFF-STATE.md` files, `.orbit-thread/config.json` and living docs keep working unchanged; `orbit-thread update` adds Resume without touching locally edited managed files, and `orbit-handoff` remains a CLI alias.
+
 ## 1.1.0 — 7 October 2026
 
 - Rename the product from **Orbit Handoff** to **Orbit Thread**.

package/PRIVACY.md

@@ -1,9 +1,83 @@
-# Privacy
+# Privacy Policy
 
-Orbit Thread has no telemetry, remote service, external account or MCP server.
+Last updated: 7 October 2026
 
-The Handoff writer processes input locally and saves `HANDOFF-STATE.md`. Orbit Setup writes local/project documentation, managed agent instructions, a small project configuration file and local ownership state. The CLI records hashes and the exact managed instruction blocks it adds.
+## Overview
 
-Installation through npm or a plugin marketplace uses the relevant registry or Git host. Your coding agent's model calls and privacy settings remain governed by its provider. Orbit Thread's local writer and setup/configuration scripts do not send repository content anywhere.
+Orbit Thread is a local-first developer tool for project setup, coding-session continuity and verified handoffs.
 
-Keep secrets, credentials, personal data and sensitive production data out of handoffs and living docs. Pattern checks are limited and are not a data-loss-prevention system. `HANDOFF-STATE.md` and Orbit Thread's local ownership state are Git-ignored by setup; ignoring a previously tracked file does not untrack it.
+Orbit Thread does not operate a remote service, require an Orbit Thread account, run an MCP server, or collect telemetry or analytics.
+
+## Data Orbit Thread processes
+
+Orbit Thread does not collect or transmit user or repository content to an Orbit Thread-operated server.
+
+When used in a coding project, Orbit Thread may process information that the user or coding agent makes available locally in order to:
+
+- create or update project documentation and managed agent instructions;
+- create and overwrite `HANDOFF-STATE.md`;
+- store project configuration and local ownership state;
+- record hashes and exact managed instruction blocks for safe updates and uninstall operations.
+
+This information may include project names, source-code context, technical decisions and other information intentionally included in project documentation or handoffs.
+
+Orbit Thread is not designed to collect or process payment-card information, protected health information, government identifiers, passwords, API keys, authentication tokens, MFA/OTP codes, recovery codes or other authentication secrets. Users should not place this information in Orbit Thread handoffs or living project documents.
+
+Secret-pattern checks are a limited safety backstop and are not a data-loss-prevention system.
+
+## Purposes of processing
+
+Orbit Thread processes local project information only as necessary to:
+
+- prepare a project for coding-agent continuity;
+- maintain concise project and execution state;
+- safely install, update and uninstall Orbit Thread-managed files;
+- verify ownership of managed content and avoid overwriting unrelated or locally modified files.
+
+Orbit Thread does not use project information for advertising, behavioural profiling, analytics, model training or sale to third parties.
+
+## Sharing and recipients
+
+Orbit Thread itself does not transmit repository content, handoffs or local project documentation to the developer of Orbit Thread or to an Orbit Thread-operated service.
+
+Installation or distribution may involve third-party services such as npm, GitHub, OpenAI or Anthropic. Those services process information according to their own privacy policies and service settings.
+
+When Orbit Thread is used through a coding agent, information intentionally provided to that agent may be processed by the agent provider under that provider's privacy settings and terms. Orbit Thread's local scripts do not independently transmit repository content to those providers.
+
+## Data retention
+
+Orbit Thread does not retain user or project data on developer-operated servers because Orbit Thread operates no such service.
+
+Local data remains on the user's device or project until the user removes it or the relevant file is overwritten.
+
+`HANDOFF-STATE.md` is overwrite-only and is replaced when a new successful checkpoint is created.
+
+Project documentation and `.orbit-thread` configuration may remain after Orbit Thread is uninstalled so that project-owned information is not destroyed automatically. Users may delete these files at any time.
+
+Retention by npm, GitHub, OpenAI, Anthropic or other third-party services is governed by those services' own policies.
+
+## User controls
+
+Users control the project information made available to Orbit Thread.
+
+Users may inspect, edit or delete Orbit Thread-created local files at any time, including `HANDOFF-STATE.md`, project documentation and `.orbit-thread` configuration.
+
+Orbit Thread can also be uninstalled using its CLI. Uninstall intentionally preserves project-owned documentation and configuration unless the user chooses to delete them separately.
+
+Orbit Thread setup Git-ignores `HANDOFF-STATE.md` and local ownership state. Adding an already tracked file to `.gitignore` does not remove it from Git history or stop Git from tracking it.
+
+## Security and sensitive information
+
+Do not place passwords, authentication secrets, private keys, recovery codes, personal data or sensitive production information in handoffs or living project documents.
+
+Orbit Thread includes limited pattern checks intended to reduce accidental inclusion of obvious secrets, but these checks do not guarantee detection of sensitive data.
+
+## Changes to this policy
+
+This policy may be updated when Orbit Thread's functionality or data practices change. Material changes will be reflected in this document and its Git history.
+
+## Contact
+
+Privacy or security questions can be raised through the Orbit Thread GitHub repository:
+
+https://github.com/shab1h-gh/orbit-thread/issues