pi-skill-shiori 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -0,0 +1,59 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+This project follows semantic versioning.
+
+## [0.3.1] - 2026-06-19
+
+### Added
+
+- `SECURITY.md` with vulnerability reporting guidance and Pi package security notes.
+- `CHANGELOG.md` for version history.
+
+### Changed
+
+- README links to `SECURITY.md` and `CHANGELOG.md`.
+- npm package files now include `SECURITY.md` and `CHANGELOG.md`.
+
+## [0.3.0] - 2026-06-08
+
+### Changed
+
+- Shiori slash commands use UI flows for doctor, bootstrap, reload, recommend, and stats.
+
+## [0.2.1] - 2026-06-02
+
+### Changed
+
+- Patch release after the recommendation flow updates in `0.2.0`.
+
+## [0.2.0] - 2026-06-02
+
+### Added
+
+- Recommendation-first `/shiori:recommend` flow with query expansion and agent task queuing.
+- Pre-loading of multiple recommended skills in one agent turn.
+- Planning-intent handling that returns a dev-plan intake template without dumping skill bodies.
+
+### Fixed
+
+- Skill retrieval for block descriptions and Japanese queries.
+
+### Changed
+
+- README install snippets aligned with the published package version.
+
+## [0.1.1] - 2026-05-26
+
+### Added
+
+- npm publish workflow and auto-release on merge to `main`.
+- npm publish commands and unpinned install examples in README.
+
+## [0.1.0] - 2026-05-24
+
+### Added
+
+- Initial Pi Skill Shiori release.
+- Zero-Catalog mode, policy-based retrieval, SQLite FTS indexing, and on-demand `shiori_load_skill` tool.

package/README.md

@@ -15,7 +15,7 @@ It is built for vaults or projects with many Agent Skills where the default cata
 
 ## Status
 
-`0.3.0` is an early working release. It is useful for local Pi workflows, but the prompt-boundary suppression logic is intentionally conservative: if Shiori cannot safely recognize a catalog boundary, it leaves the prompt untouched and warns instead of deleting too much.
+`0.3.1` is an early working release. It is useful for local Pi workflows, but the prompt-boundary suppression logic is intentionally conservative: if Shiori cannot safely recognize a catalog boundary, it leaves the prompt untouched and warns instead of deleting too much.
 
 ## Requirements
 
@@ -37,7 +37,7 @@ Pi core packages are peer dependencies and should be supplied by the Pi runtime:
 After the package is published to npm:
 
 ```bash
-pi install npm:pi-skill-shiori@0.3.0
+pi install npm:pi-skill-shiori@0.3.1
 ```
 
 Without a version pin:
@@ -51,7 +51,7 @@ pi install npm:pi-skill-shiori
 Use `-l` to write the package to the current project’s `.pi/settings.json`:
 
 ```bash
-pi install -l npm:pi-skill-shiori@0.3.0
+pi install -l npm:pi-skill-shiori@0.3.1
 ```
 
 Without a version pin:
@@ -65,7 +65,7 @@ Equivalent pinned manual `.pi/settings.json` entry:
 ```json
 {
   "packages": [
-    "npm:pi-skill-shiori@0.3.0"
+    "npm:pi-skill-shiori@0.3.1"
   ]
 }
 ```
@@ -83,7 +83,7 @@ Equivalent unpinned manual `.pi/settings.json` entry:
 ### Global install from GitHub
 
 ```bash
-pi install git:github.com/eiei114/pi-skill-shiori@v0.3.0
+pi install git:github.com/eiei114/pi-skill-shiori@v0.3.1
 ```
 
 Without a tag pin:
@@ -95,7 +95,7 @@ pi install git:github.com/eiei114/pi-skill-shiori
 ### Project-local install from GitHub
 
 ```bash
-pi install -l git:github.com/eiei114/pi-skill-shiori@v0.3.0
+pi install -l git:github.com/eiei114/pi-skill-shiori@v0.3.1
 ```
 
 Without a tag pin:
@@ -267,6 +267,8 @@ npm whoami
 npm run release:npm
 ```
 
+For version history, see [`CHANGELOG.md`](CHANGELOG.md).
+
 For a first-time publish, login first:
 
 ```bash
@@ -276,7 +278,7 @@ npm login
 After publishing, verify the Pi install path:
 
 ```bash
-pi install npm:pi-skill-shiori@0.3.0
+pi install npm:pi-skill-shiori@0.3.1
 pi install npm:pi-skill-shiori
 pi list
 /shiori:doctor
@@ -290,12 +292,14 @@ git push --follow-tags
 npm run release:npm
 ```
 
-## Security notes
+## Security
 
 Pi packages execute local code with the same permissions as Pi. Review third-party packages before installing them.
 
 Shiori itself does not sandbox skills. It only changes how skill candidates are discovered and loaded. A loaded skill can still instruct the model to run tools, edit files, or execute commands according to your Pi/tool permissions.
 
+For vulnerability reporting, see [`SECURITY.md`](SECURITY.md).
+
 ## License
 
 MIT

package/SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+## Supported versions
+
+Only the latest published version receives security fixes.
+
+## Reporting a vulnerability
+
+Open a private security advisory on GitHub, or contact the maintainer by the preferred channel listed in the repository profile.
+
+Please include:
+
+- Affected version
+- Impact
+- Reproduction steps
+- Suggested fix, if known
+
+## Pi package security note
+
+Pi packages can execute code with local user permissions. Review installed packages and avoid running untrusted extensions.
+
+Pi Skill Shiori does not sandbox skills. It changes how skill candidates are discovered and loaded. A loaded skill can still instruct the model to run tools, edit files, or execute commands according to your Pi and tool permissions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-skill-shiori",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Pi extension that reduces Agent Skill catalog tokens with policy-based skill retrieval and on-demand skill loading.",
   "type": "module",
   "license": "MIT",
@@ -24,6 +24,8 @@
   "files": [
     "README.md",
     "LICENSE",
+    "SECURITY.md",
+    "CHANGELOG.md",
     "src"
   ],
   "scripts": {