phonton-cli 0.15.5 → 0.16.1

package/README.md

@@ -2,7 +2,7 @@
   <img src="assets/readme/phonton-cli-logo.png" width="112" alt="Phonton CLI logo">
 </p>
 
-<h1 align="center">Phonton CLI · v0.15.5</h1>
+<h1 align="center">Phonton CLI · v0.16.1</h1>
 
 <p align="center">
   <strong>Verified code changes with repo memory.</strong><br>
@@ -12,7 +12,7 @@
 <p align="center">
   <a href="https://github.com/phonton-dev/phonton-cli/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/phonton-dev/phonton-cli/actions/workflows/ci.yml/badge.svg"></a>
   <a href="https://github.com/phonton-dev/phonton-cli/stargazers"><img alt="GitHub stars" src="https://img.shields.io/github/stars/phonton-dev/phonton-cli?style=flat&label=stars"></a>
-  <img alt="release" src="https://img.shields.io/badge/release-v0.15.5-6c63ff">
+  <img alt="release" src="https://img.shields.io/badge/release-v0.16.1-6c63ff">
   <img alt="license" src="https://img.shields.io/badge/license-MIT%20OR%20Apache--2.0-blue">
   <img alt="status" src="https://img.shields.io/badge/status-public_alpha-f97316">
 </p>
@@ -69,10 +69,15 @@ It walks through the evidence trail a real run should expose: GoalContract, plan
 ## What Works Today
 
 - Interactive Ratatui TUI with goal, task, ask, settings, git, and flight-log surfaces.
+- v0.16.1 adds `phonton extensions install <source>` for installing audited `.phonton` packs from GitHub or local paths, plus built-in open-source MCP catalog ids such as `context7`, `github`, `chrome-devtools`, `playwright`, `firecrawl`, `supabase`, `mongodb`, and `figma`.
+- v0.16.1 adds `phonton extensions catalog`, `phonton extensions new <path> [skill|steering|mcp-server|profile]`, and `phonton extensions validate` so extension discovery, scaffolding, and validation feel closer to Gemini CLI while preserving Phonton's local trust and approval model.
+- v0.16.0 adds typed `@...` context mentions for files, directories, symbols, MCP servers, and MCP tools, with resolved/missing/approval-gated rows visible in `/context` and the Context focus surface.
+- v0.16.0 separates local prompt token estimates from provider-reported billing usage in `phonton why-tokens --by-source`; local-only runs now render as `no provider call`, and prompt manifests carry resolved `@...` mention rows plus attribution-only token totals instead of double-counting attachments or MCP/tool context.
+- v0.16.0 tightens extension and MCP diagnostics so `phonton extensions doctor` warns on networked or mutating MCP trust even when a server has not listed explicit permissions.
 - Unified slash commands in the TUI: `/settings`, `/config`, `/status`, `/context`, `/compact`, `/compact-context`, `/compress`, `/problems`, `/diagnostics`, `/retry`, `/repair`, `/why-tokens`, `/ask`, `/plan`, `/approve`, `/goals`, `/switch`, `/focus`, `/diff`, `/code`, `/copy`, `/rerun`, `/stats`, `/stop`, `/review`, `/memory`, `/permissions`, `/trust`, `/model`, `/commands`, `/run`, and `!` all route through the same command registry and prompt drawer.
 - Static syntax verification now covers Rust, Python, JavaScript, TypeScript, JSON, TOML, YAML, HTML, and CSS changed files before review-ready status. Generated code that cannot parse stays failed/unverified instead of becoming a receipt.
 - Failed goals default to a Problems focus view with grouped verifier/provider/quality diagnostics, compact repair hints, and `Alt+P` / `Alt+R` keyboard shortcuts for inspection and repair.
-- `/why-tokens` and `phonton why-tokens --by-source` explain the latest prompt manifest in plain language, including first-attempt, repair-attempt, context/artifact, system, goal, memory, attachment, repo-code, MCP/tool, retry, compaction, dedupe, and cached-token buckets.
+- `/why-tokens` and `phonton why-tokens --by-source` explain the latest prompt manifest in plain language, including first-attempt, repair-attempt, context/artifact, system, goal, memory, attachment, repo-code, MCP/tool, `@...` mention attribution, retry, compaction, dedupe, and cached-token buckets.
 - v0.15.5 fixes TUI prompt typing and Ask readability: bare `f`, `d`, `p`, and `r` now type normally, focus shortcuts moved to `Alt+F/D/P/R`, the prompt bar shows a static caret rectangle, and Ask answers style inline markdown such as `**bold**`, `*italic*`, and `` `code` ``.
 - v0.15.4 fixes the existing Vite chess quality gate: the zero-token App shell now renders an accessible named-piece legend for king, queen, rook, bishop, knight, and pawn, and the seeded App test asserts that evidence.
 - v0.15.3 fixes stale existing Vite App tests during the zero-token chess UI seed: old placeholder heading assertions in `src/App.test.*` are replaced with a local Vitest server-render test for the generated chess shell.
@@ -165,7 +170,7 @@ Windows PowerShell:
 Direct Cargo install:
 
 ```bash
-cargo install --git https://github.com/phonton-dev/phonton-cli --tag v0.15.5 phonton-cli --locked --force
+cargo install --git https://github.com/phonton-dev/phonton-cli --tag v0.16.1 phonton-cli --locked --force
 ```
 
 Check the install:
@@ -181,7 +186,7 @@ Phonton uses GitHub branches and releases as install channels:
 
 | Channel | Install | Use when |
 |---|---|---|
-| Stable | `cargo install --git https://github.com/phonton-dev/phonton-cli --tag v0.15.5 phonton-cli --locked --force` | You want the best validated public alpha |
+| Stable | `cargo install --git https://github.com/phonton-dev/phonton-cli --tag v0.16.1 phonton-cli --locked --force` | You want the best validated public alpha |
 | Dev | `cargo install --git https://github.com/phonton-dev/phonton-cli --branch dev phonton-cli --locked --force` | You want next-release integration changes |
 | Nightly | `cargo install --git https://github.com/phonton-dev/phonton-cli --branch nightly phonton-cli --locked --force` | You want daily snapshots and can tolerate breakage |
 | Main | `cargo install --git https://github.com/phonton-dev/phonton-cli --branch main phonton-cli --locked --force` | You want the current release branch tip |
@@ -272,7 +277,7 @@ phonton review          Show verified diff review payloads
 phonton diff            Print verified unified diffs from review-ready tasks
 phonton run latest      Run the latest receipt-suggested command
 phonton memory list     Inspect local decision memory
-phonton extensions list Inspect skills, steering, MCP servers, and profiles
+phonton extensions      Install and inspect skills, steering, MCP servers, and profiles
 phonton mcp list        Show configured MCP servers without starting them
 phonton config path     Print the resolved config file path
 phonton config show     Dump resolved config as TOML
@@ -340,8 +345,13 @@ phonton memory delete <id>
 Extension visibility:
 
 ```bash
+phonton extensions catalog
+phonton extensions install context7
+phonton extensions install https://github.com/phonton-dev/phonton-review-gate-extension
+phonton extensions new ./my-extension skill
 phonton extensions list --json
 phonton extensions doctor --json
+phonton extensions validate --json
 phonton skills list --json
 phonton steering list --json
 phonton mcp list --json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phonton-cli",
-  "version": "0.15.5",
+  "version": "0.16.1",
   "description": "Local-first agentic development terminal with context packs, source handles, and verification gates.",
   "license": "MIT OR Apache-2.0",
   "homepage": "https://github.com/phonton-dev/phonton-cli#readme",