phonton-cli 0.8.2 → 0.9.1

package/README.md

@@ -2,7 +2,7 @@
   <img src="assets/readme/phonton-cli-logo.png" width="112" alt="Phonton CLI logo">
 </p>
 
-<h1 align="center">Phonton CLI · v0.8.2</h1>
+<h1 align="center">Phonton CLI · v0.9.1</h1>
 
 <p align="center">
   <strong>Verified code changes with repo memory.</strong><br>
@@ -12,7 +12,7 @@
 <p align="center">
   <a href="https://github.com/phonton-dev/phonton-cli/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/phonton-dev/phonton-cli/actions/workflows/ci.yml/badge.svg"></a>
   <a href="https://github.com/phonton-dev/phonton-cli/stargazers"><img alt="GitHub stars" src="https://img.shields.io/github/stars/phonton-dev/phonton-cli?style=flat&label=stars"></a>
-  <img alt="release" src="https://img.shields.io/badge/release-v0.8.2-6c63ff">
+  <img alt="release" src="https://img.shields.io/badge/release-v0.9.1-6c63ff">
   <img alt="license" src="https://img.shields.io/badge/license-MIT%20OR%20Apache--2.0-blue">
   <img alt="status" src="https://img.shields.io/badge/status-public_alpha-f97316">
 </p>
@@ -69,7 +69,7 @@ It walks through the evidence trail a real run should expose: GoalContract, plan
 ## What Works Today
 
 - Interactive Ratatui TUI with goal, task, ask, settings, git, and flight-log surfaces.
-- Unified slash commands in the TUI: `/settings`, `/config`, `/status`, `/context`, `/compact`, `/compress`, `/goals`, `/switch`, `/focus`, `/copy`, `/rerun`, `/stats`, `/stop`, `/review`, `/memory`, `/permissions`, `/model`, `/commands`, `/run`, and `!` all route through the same command registry and prompt drawer.
+- Unified slash commands in the TUI: `/settings`, `/config`, `/status`, `/context`, `/compact`, `/compress`, `/goals`, `/switch`, `/focus`, `/copy`, `/rerun`, `/stats`, `/stop`, `/review`, `/memory`, `/permissions`, `/trust`, `/model`, `/commands`, `/run`, and `!` all route through the same command registry and prompt drawer.
 - Faster multi-goal navigation: the sidebar shows stable goal indexes, `Alt+Up` / `Alt+Down` switches goals even while drafting text, `Alt+1` through `Alt+9` jumps directly, and `/goals` opens a searchable switcher.
 - Review-ready goals now default to a Code focus view when diff hunks are available, with Receipt, Code, Commands, and Log tabs in the Active panel plus `f` / `[` / `]` keyboard navigation.
 - Command run receipts stay collapsed by default; the Commands focus view shows status, exit code, duration, and short stdout/stderr previews. `/rerun` repeats the latest command through the same sandbox path and `/copy` copies the current focus view to the Windows clipboard.
@@ -78,6 +78,9 @@ It walks through the evidence trail a real run should expose: GoalContract, plan
 - Image path paste/drop artifacts: pasted image file paths collapse into `[image: name.png]` chips and flow into the submitted prompt as image artifacts.
 - Active review/code output is scrollable with the mouse wheel, `PgUp` / `PgDn`, and `Home` / `End`, so large generated diffs do not trap the user at the top of the receipt.
 - Windows clipboard import in the TUI with `Ctrl+V`, including content selected from Windows clipboard history (`Win+V`) when the terminal does not emit bracketed paste directly.
+- Lower-noise worker prompts: first attempts omit bulky diff examples, duplicate repo context slices are deduped, and Flight Log prompt manifests show repo-code, compaction, dedupe, and budget buckets.
+- Resumed sessions keep recent prompt history, and the History view supports in-place filtering and row selection for inspecting previous task receipts.
+- Workspace trust is saved as structured per-workspace records, mirrored into the local store, visible with `/trust current` or `/trust list`, and revocable with `/trust revoke-current`.
 - Sandboxed command runs from the prompt bar with `/run <cmd>` or `!<cmd>`, plus command status, output previews, context meters, and permission mode controls in the TUI and Flight Log.
 - `phonton doctor` setup diagnostics for config, provider key, store, trust, git, cargo, and Nexus config.
 - `phonton plan` preview for task DAGs and the visible GoalContract before edits happen.
@@ -132,7 +135,7 @@ Windows PowerShell:
 Direct Cargo install:
 
 ```bash
-cargo install --git https://github.com/phonton-dev/phonton-cli --tag v0.8.2 phonton-cli --locked --force
+cargo install --git https://github.com/phonton-dev/phonton-cli --tag v0.9.1 phonton-cli --locked --force
 ```
 
 Check the install:
@@ -148,7 +151,7 @@ Phonton uses GitHub branches and releases as install channels:
 
 | Channel | Install | Use when |
 |---|---|---|
-| Stable | `cargo install --git https://github.com/phonton-dev/phonton-cli --tag v0.8.2 phonton-cli --locked --force` | You want the best validated public alpha |
+| Stable | `cargo install --git https://github.com/phonton-dev/phonton-cli --tag v0.9.1 phonton-cli --locked --force` | You want the best validated public alpha |
 | Dev | `cargo install --git https://github.com/phonton-dev/phonton-cli --branch dev phonton-cli --locked --force` | You want next-release integration changes |
 | Nightly | `cargo install --git https://github.com/phonton-dev/phonton-cli --branch nightly phonton-cli --locked --force` | You want daily snapshots and can tolerate breakage |
 | Main | `cargo install --git https://github.com/phonton-dev/phonton-cli --branch main phonton-cli --locked --force` | You want the current release branch tip |
@@ -253,6 +256,7 @@ Inside the TUI prompt bar:
 /review                 Show review receipt guidance for the selected goal
 /memory                 Inspect local decision memory
 /permissions            Show sandbox, trust, and approval status
+/trust                  Show or revoke workspace trust records
 /model set <name>       Save a model preference
 /commands               Show slash-command and keyboard help
 /run <cmd>              Run a sandboxed command

package/npm/bin/phonton.js

@@ -4,14 +4,18 @@ const fs = require("fs");
 const path = require("path");
 const { spawn, spawnSync } = require("child_process");
 
+const packageJson = require("../../package.json");
 const binaryName = process.platform === "win32" ? "phonton.exe" : "phonton";
 const configuredBinary = process.env.PHONTON_BINARY || process.env.PHONTON_CLI_BINARY;
 const binaryPath = configuredBinary
   ? path.resolve(configuredBinary)
   : path.join(__dirname, "..", "vendor", binaryName);
+const vendorDir = path.join(__dirname, "..", "vendor");
+const markerPath = path.join(vendorDir, "version.json");
 
 function ensureBinary() {
-  if (fs.existsSync(binaryPath)) {
+  if (configuredBinary && fs.existsSync(binaryPath)) {
+    assertBinaryVersion(binaryPath);
     return;
   }
 
@@ -20,11 +24,53 @@ function ensureBinary() {
     process.exit(1);
   }
 
-  const installScript = path.join(__dirname, "..", "install.js");
+  if (fs.existsSync(binaryPath) && vendorMatchesPackage() && binaryVersionMatches(binaryPath).ok) {
+    return;
+  }
+
+  fs.rmSync(vendorDir, { recursive: true, force: true });
+
+  const installScript = process.env.PHONTON_INSTALL_SCRIPT || path.join(__dirname, "..", "install.js");
   const result = spawnSync(process.execPath, [installScript], { stdio: "inherit" });
   if (result.status !== 0 || !fs.existsSync(binaryPath)) {
     process.exit(result.status || 1);
   }
+  assertBinaryVersion(binaryPath);
+}
+
+function vendorMatchesPackage() {
+  try {
+    const marker = JSON.parse(fs.readFileSync(markerPath, "utf8"));
+    return (
+      marker.version === packageJson.version &&
+      marker.platform === process.platform &&
+      marker.arch === process.arch
+    );
+  } catch (_error) {
+    return false;
+  }
+}
+
+function assertBinaryVersion(candidate) {
+  const check = binaryVersionMatches(candidate);
+  if (!check.ok) {
+    console.error(`Installed Phonton binary is stale or invalid: expected ${check.expected}, got ${check.output}`);
+    if (!configuredBinary) {
+      fs.rmSync(vendorDir, { recursive: true, force: true });
+    }
+    process.exit(1);
+  }
+}
+
+function binaryVersionMatches(candidate) {
+  const result = spawnSync(candidate, ["version"], { encoding: "utf8" });
+  const output = `${result.stdout || ""}${result.stderr || ""}`.trim() || "no output";
+  const expected = `phonton ${packageJson.version}`;
+  return {
+    ok: result.status === 0 && output.includes(expected),
+    expected,
+    output,
+  };
 }
 
 ensureBinary();

package/npm/install.js

@@ -12,6 +12,7 @@ const repo = "phonton-dev/phonton-cli";
 const version = packageJson.version;
 const tag = process.env.PHONTON_RELEASE_TAG || (version.includes("nightly") ? "nightly" : `v${version}`);
 const vendorDir = path.join(__dirname, "vendor");
+const markerPath = path.join(vendorDir, "version.json");
 
 const targets = {
   "linux-x64": {
@@ -55,6 +56,20 @@ download(url, archivePath)
     if (process.platform !== "win32") {
       fs.chmodSync(binaryPath, 0o755);
     }
+    fs.writeFileSync(
+      markerPath,
+      `${JSON.stringify(
+        {
+          version,
+          tag,
+          asset: target.asset,
+          platform: process.platform,
+          arch: process.arch,
+        },
+        null,
+        2,
+      )}\n`,
+    );
     console.log(`Installed Phonton CLI ${tag} for ${process.platform}-${process.arch}`);
   })
   .catch((error) => {

package/npm/test-wrapper.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 const fs = require("fs");
+const os = require("os");
 const path = require("path");
 const { spawnSync } = require("child_process");
 
@@ -46,6 +47,8 @@ if (!versionOutput.includes(expected)) {
   process.exit(1);
 }
 
+testStaleVendorReinstall();
+
 const goal = "add input validation to config loading";
 const planOutput = runWrapper(["plan", "--json", "--no-memory", goal]);
 let planJson;
@@ -65,3 +68,69 @@ if (planJson.goal_contract.goal !== goal) {
   console.error("Expected plan --json goal_contract.goal to match the requested goal.");
   process.exit(1);
 }
+
+function testStaleVendorReinstall() {
+  const vendorDir = path.join(root, "npm", "vendor");
+  const vendorBinary = path.join(vendorDir, binaryName);
+  const markerPath = path.join(vendorDir, "version.json");
+  const installScript = path.join(os.tmpdir(), `phonton-test-install-${process.pid}.js`);
+
+  fs.rmSync(vendorDir, { recursive: true, force: true });
+  fs.mkdirSync(vendorDir, { recursive: true });
+  fs.copyFileSync(binary, vendorBinary);
+  if (process.platform !== "win32") {
+    fs.chmodSync(vendorBinary, 0o755);
+  }
+  fs.writeFileSync(
+    markerPath,
+    JSON.stringify({
+      version: "0.0.0-stale",
+      platform: process.platform,
+      arch: process.arch,
+    }),
+  );
+
+  fs.writeFileSync(
+    installScript,
+    `
+const fs = require("fs");
+const path = require("path");
+const vendorDir = ${JSON.stringify(vendorDir)};
+const binary = ${JSON.stringify(binary)};
+const binaryName = ${JSON.stringify(binaryName)};
+const version = ${JSON.stringify(packageJson.version)};
+fs.mkdirSync(vendorDir, { recursive: true });
+fs.copyFileSync(binary, path.join(vendorDir, binaryName));
+if (process.platform !== "win32") fs.chmodSync(path.join(vendorDir, binaryName), 0o755);
+fs.writeFileSync(path.join(vendorDir, "version.json"), JSON.stringify({
+  version,
+  platform: process.platform,
+  arch: process.arch,
+}, null, 2));
+`,
+  );
+
+  try {
+    const result = spawnSync(process.execPath, [path.join(root, "npm", "bin", "phonton.js"), "version"], {
+      cwd: root,
+      encoding: "utf8",
+      env: {
+        ...process.env,
+        PHONTON_INSTALL_SCRIPT: installScript,
+        PHONTON_BINARY: "",
+        PHONTON_CLI_BINARY: "",
+      },
+    });
+
+    process.stdout.write(result.stdout || "");
+    process.stderr.write(result.stderr || "");
+
+    if (result.status !== 0 || !result.stdout.includes(expected)) {
+      console.error("Expected npm wrapper to refresh stale vendor binary metadata.");
+      process.exit(result.status || 1);
+    }
+  } finally {
+    fs.rmSync(installScript, { force: true });
+    fs.rmSync(vendorDir, { recursive: true, force: true });
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phonton-cli",
-  "version": "0.8.2",
+  "version": "0.9.1",
   "description": "Local-first agentic development terminal with context packs, source handles, and verification gates.",
   "license": "MIT OR Apache-2.0",
   "homepage": "https://github.com/phonton-dev/phonton-cli#readme",