solo-cto-agent 0.5.1 → 1.1.0

package/CHANGELOG

@@ -1,46 +1,136 @@
-# Changelog
-
-## 0.5.1
-
-* added skill slimming docs (references/ pattern with measured results)
-* fixed BOM encoding in CONTRIBUTING
-* fixed corrupted FAQ section in README
-* cleaned up README: removed duplicate sections, consolidated post-install guide
-* updated ROADMAP with v0.5.0 completion and v0.6.0 plan
-
-## 0.5.0
-
-* added CLI init/status commands for npm distribution
-* added demo asset, architecture diagram, and updated Quick Start
-* expanded CONTRIBUTING and templates
-
-## 0.4.0
-
-* added package.json and basic test tooling
-* added failure-catalog.json and schema validation
-* added CI test workflow for PRs
-* added ROADMAP.md
-
-## 0.3.0
-
-* added .cursorrules for Cursor IDE support
-* added .windsurfrules for Windsurf (Cascade) support
-* added .github/copilot-instructions.md for GitHub Copilot support
-* all three rule files share the same CTO philosophy, adapted to each tool's format
-
-## 0.2.0
-
-* rewrote README to sound more human and less sales-heavy
-* improved `setup.sh` toward safer repeat installs and updates
-* softened over-strong automation claims in `build`
-* clarified `craft` as intentionally opinionated
-* tightened `review` wording
-* added contribution guidance
-* added example files for practical usage
-
-## 0.1.0
-
-* initial public release
-* added build, ship, craft, spark, review, and memory skills
-* added setup script
-* added templates for context and project state
+# Changelog
+
+## 1.1.0 — Tier-aware reviews, security signals, plugins & telegram
+
+**Theme**: closing the last gaps around signal quality and agent
+extensibility. The review loop now reasons about Haiku/Sonnet/Opus
+tier-appropriately, surfaces live CVE/GHSA advisories via OSV.dev,
+captures screenshots without Playwright, and gains a first-cut
+plugin system + experimental telegram setup wizard.
+
+### External signals (PR-G4)
+* **T2 Security Advisories (OSV.dev)** — CVE + GHSA scan across
+  `dependencies` + `devDependencies`. Severity normalized (DB-specific
+  > CVSS numeric > UNKNOWN) and merged into the external-knowledge
+  context block. Gate: `COWORK_EXTERNAL_KNOWLEDGE_SECURITY=0` to skip.
+
+### Review tiering (PR-G2)
+* **Per-tier Claude model resolution** — Haiku (cheap triage) / Sonnet
+  (default) / Opus (deep review) selected automatically based on watch
+  tier. Overridable via `ANTHROPIC_MODEL_HAIKU|SONNET|OPUS`.
+
+### UI/UX loop (PR-G5)
+* **Playwright-free screenshot capture** — `uiux vision-review --url`
+  and `uiux capture --url` now fall back to thum.io when Playwright is
+  unavailable. Viewports: mobile 375x812 / tablet 768x1024 / desktop
+  1280x800.
+
+### Plugins & integrations (PR-G6 / G7)
+* **`docs/plugin-api-v2.md`** — capability manifest spec
+  (env/net/fs/cli/hook/schedule prefixes), contribution points, agent
+  targeting (`claude` / `codex` / `cowork` / `headless`).
+* **`plugin` subcommand** — filesystem-only manager:
+  `solo-cto-agent plugin list|show|add --path <dir>|remove`. Records
+  metadata only; does NOT execute plugin code. Runtime loader lands
+  in a follow-up behind the capability gate.
+* **`telegram wizard`** (experimental — `SOLO_CTO_EXPERIMENTAL=1`)
+  — one-command bot token + chat_id capture + `.env` / shell profile
+  / GitHub secret writeback + live sendMessage verification.
+* **`docs/telegram-wizard-spec.md`** — full spec including failure
+  modes and i18n hooks.
+
+### Developer experience
+* **375 tests** (up from 247 in 1.0.0) across 28 files — all offline,
+  all network calls stubbed via injected `fetchImpl`.
+* **Shared `prompt-utils.js`** — `ask` / `askYesNo` / `askChoice` /
+  `isTTY` / `createRl` extracted from `wizard.js` for future wizards.
+* **npm publish automation** — tag `v*` now triggers full CI +
+  `npm publish` + GitHub Release in one workflow.
+
+### Upgrade notes
+* No breaking changes. All new features are additive and gated on
+  env vars (`COWORK_EXTERNAL_KNOWLEDGE_SECURITY`,
+  `SOLO_CTO_EXPERIMENTAL`).
+* `solo-cto-agent plugin` and `solo-cto-agent telegram` are new
+  commands — existing commands are unchanged.
+
+## 1.0.0 — First stable release
+
+**Why 1.0**: the loop is now closable end-to-end. Previous 0.x releases were
+the skill pack alone. 1.0 adds the three-tier external-signal framework,
+self-cross-review, inbound feedback, and honest signal reporting — the pieces
+needed to trust a single-agent loop for production work.
+
+### External-loop framework (PR-E1 through E5)
+* T1 Peer Model — OpenAI Codex cross-check via `dual-review`
+* T2 External Knowledge — npm registry package-currency scan surfaces major/minor/deprecated deltas
+* T3 Ground Truth — Vercel deployment + Supabase log signals injected into the review prompt
+* Self-loop warning — boxed notice when no external signals are active (single-model blind-spot alert)
+* Inbound feedback channel — `feedback record` + Slack/GitHub dispatch
+
+### Dogfood-driven fixes (PR-F1, F2)
+* default-branch auto-detection (B1) — no more hardcoded `main`, works on `master` / `develop` repos
+* `--target <base>` override (B2) — diff against any ref
+* `--dry-run` now surfaces the self-loop warning without API spend (B3)
+* README flags match reality (B4) — dead examples removed
+* `--json | jq` pipe-safety (B5) — `setLogChannel("stderr")` keeps stdout pure JSON
+* **honest signal reporting (F2)** — `activeCount` now reflects actual fetch outcome, not just env flags. A tier set-but-silent no longer gets counted as "active", and hints surface `enabled-but-silent: T2 (env set, no data)` for debugging.
+
+### Developer experience
+* 247 tests (up from ~180 in 0.6.x) covering CLI, engine parser, watch gating, self-loop warning, and new drive-run regressions
+* Package-validate + Changelog + Test CI workflows all green
+
+## 0.6.0
+
+* added `solo-cto-agent lint` command — flags skills over 150 lines, missing frontmatter, large code blocks
+* added CLI tests (init, status, lint, --force, MISSING state) — 8 new test cases
+* added npm pack dry-run test — verifies tarball includes required files and excludes tests/CI
+* expanded failure-catalog from 8 to 15 patterns (Next.js types, edge runtime, JWT, peer deps, DB migrations, deploy timeouts)
+* added SECURITY.md
+* applied references/ pattern to build skill (377→197 lines) and ship skill (283→124 lines)
+* improved README architecture diagram (full skill system, not just error flow)
+
+## 0.5.1
+
+* added skill slimming docs (references/ pattern with measured results)
+* fixed BOM encoding in CONTRIBUTING
+* fixed corrupted FAQ section in README
+* cleaned up README: removed duplicate sections, consolidated post-install guide
+* updated ROADMAP with v0.5.0 completion and v0.6.0 plan
+
+## 0.5.0
+
+* added CLI init/status commands for npm distribution
+* added demo asset, architecture diagram, and updated Quick Start
+* expanded CONTRIBUTING and templates
+
+## 0.4.0
+
+* added package.json and basic test tooling
+* added failure-catalog.json and schema validation
+* added CI test workflow for PRs
+* added ROADMAP.md
+
+## 0.3.0
+
+* added .cursorrules for Cursor IDE support
+* added .windsurfrules for Windsurf (Cascade) support
+* added .github/copilot-instructions.md for GitHub Copilot support
+* all three rule files share the same CTO philosophy, adapted to each tool's format
+
+## 0.2.0
+
+* rewrote README to sound more human and less sales-heavy
+* improved `setup.sh` toward safer repeat installs and updates
+* softened over-strong automation claims in `build`
+* clarified `craft` as intentionally opinionated
+* tightened `review` wording
+* added contribution guidance
+* added example files for practical usage
+
+## 0.1.0
+
+* initial public release
+* added build, ship, craft, spark, review, and memory skills
+* added setup script
+* added templates for context and project state

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 seunghunbae-3svs
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 seunghunbae-3svs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.