pi-bro 0.21.0 → 0.22.1

package/CHANGELOG.md

@@ -2,6 +2,91 @@
 
 All notable changes to pi-bro are documented here.
 
+## [Unreleased]
+
+### Added
+
+- Reader benchmark: five real, maintainer-approved Explain fixtures and a brief-mode candidate arm for shipped-vs-candidate comparisons. Exact-text and Markdown-marker checks removed; meaning is checked by the yes/no questions (#101).
+
+- Reader benchmark for Explain modes, BTW answers, preferences and repeated samples (#110):
+  - Fingerprinted live runs, narrow Jev binary checks, and per-check candidate comparisons.
+  - Report-only reader-visible counts and source deltas, separate from preservation and formatting checks.
+  - Committed synthetic baseline evidence with offline recomputation in CI.
+  - Optional generation through existing Claude, Codex and Muse adapters alongside Agy.
+  - Synthetic coverage and experimental judgments are decision support, not proof of full fidelity or comprehension; production prompts are unchanged.
+
+### Changed
+
+- The README is now a short overview (install, try it, requirements, what leaves your machine, limits). The full reference moved to `docs/user-guide.md`, and `/bro help` links there (#116).
+- Added `SECURITY.md`, `CONTRIBUTING.md`, issue forms and `docs/PUBLIC-PRESENTATION.md`, the presentation standard for pi-* repos (#116).
+- Refocus prompt tests on safety and structure rather than frozen wording or presentation order; identify fake-Agy Explain modes from current prompt builders instead of hardcoded phrases (#110).
+
+## [0.22.1] - 2026-10-12
+
+### Security
+
+- Public-web transport safety boundaries and offline qualification (#86):
+  - Block IPv4-compatible IPv6 (`::/96`) and Site-Local IPv6 (`fec0::/10`) in `NON_PUBLIC_ADDRESSES` to prevent SSRF bypasses via mapped loopback and cloud metadata targets on dual-stack hosts.
+  - Disable HTTP socket connection pooling (`agent: false`) on web requests so keep-alive socket reuse cannot bypass address pinning (`lookup`).
+  - Add offline test coverage in `test/sources.test.ts` for mixed DNS answers, address pinning, private redirects, HTTPS downgrade, loops, hop bounds, payload limits, encoding, and cancellation.
+
+### Fixed
+
+- Interrupt stalled DNS lookups immediately when an abort or timeout signal fires during web ingestion (#86).
+
+## [0.22.0] - 2026-10-11
+
+### Fixed
+
+- Persist settings with atomic replacement and mode 0o600 (#84):
+  - Replace direct `writeFile` with atomic sibling write (`.tmp`) and `rename` to prevent settings corruption on failure, crash, or disk full (`ENOSPC`).
+  - Flush writes before replacement (`flush: true`) and clean up temporary files on failure.
+  - Enforce `mode: 0o600` on replaced settings files so permissions are never loosened.
+  - Resolve symlinks via lstat and realpath before replacement to preserve dotfile-managed configuration symlinks, and reject if an existing symlink target cannot be resolved.
+  - Align on-disk state with modal rollback behavior in `/bro config`.
+
+### Added
+
+- Guided Review (#104): open a PR by URL/number in local Pi to automatically get an explanation and quality assessment, captured Git evidence, findings with fix/check suggestions, diffs and optional private questions. Acquisition uses authenticated `gh` outside the active working tree. Findings remain model proposals, not approval or applied changes.
+- Automatic local remembering of questions/drafts/reading position; reopening the same PR restores the captured revision without a model call. Bare `/bro guided-review` lists saved reviews; `resume` remains an alias. Close saves automatically; Stop and close cancels first. Copy finding copies to the system clipboard without submission.
+- Confirmed same-revision regeneration replaces one current guide and preserves original private context; failed/cancelled generation retains it and save errors offer recovery. There is no guide-version UI or prototype-format migration. Review has its own backend override.
+- Bounded live checks demonstrated an unchanged-caller defect and successful regeneration; manual UX accepted. This is not a general accuracy guarantee, live five-backend matrix or complete #104 scope. Notes, examination tracking, branch/update review and feedback delivery are not implemented.
+
+- Durable advisor steering across sessions in `~/.pi/agent/bro-advisor.md` (#97):
+  - Ingest standing priorities from `bro-advisor.md` alongside session steering (`/bro advisor-steer`).
+  - Labeled prompt composition in `buildAdvisorPrompt`: standing priorities appear under `### Standing priorities (durable across sessions)` and session priorities under `### Session priorities (this session only)`.
+  - Session-specific priorities take precedence over standing defaults where they conflict.
+  - Fail-closed validation rejects files > 64 KB and > 4,000 characters before spawning any backend process.
+  - Doctor reports both `Advisor steering (session)` and `Advisor steering (durable)`.
+  - Tool result context line and details track `steeringSources: { durable, session }` while preserving backwards-compatible `steeringIncluded` boolean.
+  - Retries use a frozen prompt snapshot built prior to `runAdvisorWithRetries`.
+  - Clearing session steering leaves durable steering intact.
+
+### Changed
+
+- Doctor treats an unsupported optional review backend as an informational override hint, not a broken installation; healthy Agy/Grok/Codex defaults still report ready.
+- Review is file-only on Claude/Muse: no shell, write or web tools; Agy/Grok/Codex review calls fail closed without switching backend. Other features retain their access behavior.
+- Capture uses depth-1 head/merge-base trees instead of full history; fetch gets a ten-minute bound while evidence stays offline. Interrupted-capture recovery remains.
+- Removed prototype record migrations after one-time backup/normalization of development records; split validation and formatted review modules/tests to the repository tab style.
+
+- Guided Review UX consistency pass: origin-preserving Back, focused-action Enter, topic-filtered findings, pane-aware paging, visible focus/overflow, selected-item previews and compact full-width 36×18 layout. Discussion follows conversation/composer/actions order; save errors have shared retry controls and failed questions have draft-safe explicit edit/resend. Request errors are separate from model answers, streaming follows again at the bottom, and acquisition/resume/close messages give clearer orientation. Current review behavior, controls, access/storage and recovery are documented in the user guide; developer/testing guidance records its implementation rules and verification limits. Review itself has no publication action.
+- Remove dead declarations and stale backend naming (#90):
+  - Enable native TypeScript unused checks (`noUnusedLocals`, `noUnusedParameters`) in `tsconfig.json`.
+  - Remove verified unused declarations across `bro.ts`, `backend.test.ts`, `benchmark/run.ts`, `codex.test.ts`, and `release.test.ts`.
+  - Drop pass-through re-exports from `bro.ts` (`agyFailureMessage`, `agySelection`, `advisorFlagErrorHint`, `parseBtwAgyLine`); tests and consumers import them directly from `backend.ts`.
+  - Rename multi-backend facilities with obsolete Agy prefixes: `runAgyText` -> `runBackendText` in `bro.ts` and `killAgyGroup` -> `killProcessGroup` in `backend.ts`.
+  - Modernize outdated single-backend and pre-extraction comments.
+- Separate Bro responsibilities and unify settings and backend-selection policy (#83):
+  - Extract `settings.ts` (schema, typed `EXTERNAL_BACKENDS` metadata, selection policy, pure transitions, and file persistence).
+  - Extract `sources.ts` (self-contained document text extraction and public web scraping with SSRF protection).
+  - Extract `config-ui.ts` (`/bro config` modal, setting items, and async save serialization).
+  - Extract `util.ts` (shared leaf utility helpers).
+  - Unify legacy flat and v2 settings parsing into one converged validation pipeline in `settings.ts`, eliminating duplicate validation branches.
+  - Initialize clean version 2 settings on fresh installations in `ensureSettingsFile()`.
+  - Share pure state transitions (`applyModelChange`, `applyEffortChange`) across default and capability override rows.
+  - Fix Agy variant model reselection bug where resolved effort from suffixed variants was lost.
+  - Consolidate CLI version probes in `/bro doctor` into a single `checkCliVersion` helper.
+
 ## [0.21.0] - 2026-10-04
 
 ### Added