spidersan 0.4.0 → 0.4.2

package/README.md

@@ -65,7 +65,7 @@ npm install -g spidersan
 
 ```bash
 # 1. Register your branch when you start working
-spidersan register --files "src/component.tsx"
+spidersan register --files "lib/auth.ts,api/login.ts"
 
 # 2. Check for conflicts before you go too deep
 spidersan conflicts
@@ -81,26 +81,26 @@ spidersan merge-order
 
 ## ✨ Features
 
-### Core Commands (MIT)
+### Core Commands
 
 | Command | Description |
 |---------|-------------|
-| `spidersan init` | Initialize a repo for local branch tracking |
-| `spidersan register` | Register a branch with files being modified |
-| `spidersan list` | List active branches and metadata |
-| `spidersan conflicts` | Show file conflicts between branches |
-| `spidersan depends` | Declare dependencies between branches (optional Supabase sync) |
-| `spidersan merge-order` | Get recommended merge order (heuristic) |
-| `spidersan ready-check` | Verify branch is ready to merge |
-| `spidersan stale` | Find stale branches older than N days |
-| `spidersan cleanup` | Remove stale branches from registry |
-| `spidersan rescue` | Scan/salvage rogue work |
-| `spidersan abandon` | Mark a branch as abandoned |
-| `spidersan merged` | Mark a branch as merged |
-| `spidersan sync` | Sync registry with git state |
+| `spidersan list` | List all registered branches and their file ownership |
+| `spidersan register --files` | Register a branch with the files being modified |
+| `spidersan conflicts` | Show file conflicts between your branch and others |
+| `spidersan merge-order` | Get topologically-sorted optimal merge order |
+| `spidersan ready-check` | Verify branch is ready to merge (no WIP, no conflicts) |
+| `spidersan watch --hub` | Daemon mode: watch files and auto-register with Hub sync |
+| `spidersan who-touched <file>` | Show git history + agent activity for specific files |
+| `spidersan rescue` | Start rescue mission for abandoned branch cleanup |
+| `spidersan scan --all` | Scan and categorize all branches in the repo |
+| `spidersan triage` | Categorize branches: MERGE / SALVAGE / ABANDON |
+| `spidersan salvage <branch>` | Extract good code from broken branches |
 | `spidersan watch` | Daemon mode - watch files and auto-register |
 | `spidersan doctor` | Diagnose local state and registry health |
 
+Keep core commands and add a "Coming Soon" or "Ecosystem Plugin" section for advanced commands like `who-touched`, `monitor`, `lock`, etc.
+
 ### Ecosystem Plugin (Optional)
 
 Install `spidersan-ecosystem` to unlock advanced coordination (internal for now):
@@ -153,8 +153,8 @@ spidersan rescue --abandon path/to/file.ts
 ## 📖 Documentation
 
 - [Core Guide](docs/CORE.md) - Public feature set and core workflows
-- [Ecosystem Overview](docs/ECOSYSTEM.md) - Advanced features (internal)
-- [Usage](USAGE.md) - CLI walkthroughs
+- Ecosystem Overview (internal; see spidersan-ecosystem repo)
+- Usage (internal; see spidersan-ecosystem repo)
 - [One Pager](docs/ONE_PAGER.md) - Product overview
 - [Data Collection](docs/DATA_COLLECTION.md) - Privacy & data practices
 
@@ -181,9 +181,23 @@ Contributions welcome! Please read our contributing guidelines first.
 
 ---
 
+## Support
+
+### Fuel the Flock
+
+Treebird is free and open source. Star our repos on GitHub or support us to keep the servers running and the agents dreaming.
+
+❤️ Sponsor on GitHub
+https://github.com/sponsors/treebird7
+
+☕ Buy me a coffee
+https://buymeacoffee.com/tree.bird
+
+---
+
 ## 📄 License
 
-- **MIT License**: [LICENSE](LICENSE)
+MIT License - see [LICENSE](LICENSE) for details
 
 ---
 

package/package.json

@@ -1,18 +1,17 @@
 {
     "name": "spidersan",
-    "version": "0.4.0",
+    "version": "0.4.2",
     "description": "Branch coordination for AI coding agents",
     "type": "module",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",
     "bin": {
-        "spidersan": "./dist/bin/spidersan.js"
+        "spidersan": "dist/bin/spidersan.js"
     },
     "files": [
         "dist",
         "README.md",
-        "LICENSE",
-        "CHANGELOG.md"
+        "LICENSE"
     ],
     "publishConfig": {
         "access": "public"
@@ -54,12 +53,12 @@
     "license": "MIT",
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/treebird7/Spidersan.git"
+        "url": "git+https://github.com/treebird7/spidersan-oss.git"
     },
     "bugs": {
-        "url": "https://github.com/treebird7/Spidersan/issues"
+        "url": "https://github.com/treebird7/spidersan-oss/issues"
     },
-    "homepage": "https://github.com/treebird7/Spidersan#readme",
+    "homepage": "https://github.com/treebird7/spidersan-oss#readme",
     "engines": {
         "node": ">=18.0.0"
     },

package/CHANGELOG.md

@@ -1,127 +0,0 @@
----
-tags: [project/treebird-hub, agent/myceliumail, agent/spidersan, topic/mcp]
----
-
-# Changelog
-
-All notable changes to Spidersan will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [Unreleased]
-
-## [0.4.0] - 2026-01-26 (Core Release)
-
-This release consolidates Spidersan into a focused, professional 15-command core with an optional ecosystem plugin for advanced features.
-
-### Added
-- **Plugin Architecture** - Optional ecosystem commands loaded at runtime via `ecosystem-loader.ts`
-- **Version Mismatch Detection** - Warns if ecosystem plugin is incompatible with core version
-- **Type Stubs** - Support for optional ecosystem module without installation
-- **Ecosystem Package** - Separate `spidersan-ecosystem` package for advanced features (locking, intent scanning, real-time monitoring, torrenting, messaging, security audit)
-
-### Changed
-- **Core Streamlined** - Reduced from 47 commands to 15 essential commands
-- **Documentation Split** - Public CORE.md (15 commands) vs. advanced ECOSYSTEM.md (16 commands)
-- **CLI Messaging** - Removed Pro/BSL licensing references; MIT-only across all packages
-- **README Refocused** - Emphasizes core use cases (coordination, conflict resolution)
-- **USAGE Examples** - Updated to match 15-command core; ecosystem features documented separately
-
-### Removed
-- **16 Ecosystem Commands** - Moved to optional `spidersan-ecosystem` plugin: lock, semantic, torrent, monitor, intent-scan, active-windows, radar, collab, collab-sync, sync-all, tension, audit-mark, send, inbox, msg-read, keygen
-- **Pro Licensing** - Consolidated to MIT-only model
-
-### Fixed
-- **Abandon Command Name** - Consistency across CORE.md and CLI help
-- **Register Examples** - Now reflect actual core command behavior
-
-## [0.3.0] - 2026-01-25 (Feature Release)
-
-This release focuses on advanced coordination infrastructure, forensic analysis, and offline-first reliability.
-
-### Added
-- **🚑 Rescue Mode** (`spidersan rescue`) - Automated scanning, triage (Merge/Salvage/Abandon), and code salvage for chaotic or abandoned repositories.
-- **📺 Monitor Dashboard** (`spidersan monitor`) - Real-time terminal TUI for tracking the swarm's activity and conflict status across the team.
-- **🧬 DNA-Level Security** - AST hashing in `spidersan lock` ensures agents never work on stale code by verifying the underlying logic structure hasn't changed.
-- **🔄 CRDT Sync** - Ground-up rewrite of local coordination to use state-based CRDTs, allowing agents to resolve conflicts locally even without Hub connectivity.
-- **🔍 Ownership Forensics** (`spidersan who-owns`) - Identifies file "owners" based on git contribution density and recent activity.
-- **🧠 Semantic RLS** (`spidersan semantic`) - Deep conflict detection using the RLS Knowledge Graph (requires `@treebird/mappersan`).
-- **🩺 Advanced Diagnostics** - Enhanced `spidersan doctor` with ulimit (EMFILE prevention), daemon health, and Node.js environment checks.
-
-### Changed
-- **OSS Portability**: Refactored `mappersan` from a hard file dependency to a dynamic optional import, making the CLI fully publishable and portable.
-- **Persistence**: Improved Invoak/Spidersan coordination logic for better result persistence across machine boundaries.
-
-### Security
-- Added SHA-256 structural hashing for all semantic locks.
-- Refactored hardcoded user paths to use cross-platform environment variables.
-
-## [0.2.2] - 2026-01-19 (Security Release)
-
-This release addresses several critical security vulnerabilities. Users are strongly encouraged to upgrade immediately.
-
-### Security
-- **Fixed:** Resolved a shell injection vulnerability in `conflicts.ts`. Improper sanitization of user-provided input could allow arbitrary command execution via `--wake` flag.
-- **Fixed:** Implemented stricter input validation across 8 mycmail wrapper commands (send.ts, inbox.ts, msg-read.ts, keys.ts, keygen.ts, key-import.ts, collab.ts) to prevent injection attacks.
-- **Fixed:** Sanitized Supabase queries to prevent potential SQL injection vulnerabilities.
-- **Added:** Implemented MCP server Access Control Lists (ACLs) to restrict process control and validate watch directories.
-- **Added:** Centralized security validation utilities in `src/lib/security.ts`.
-
-### Changed
-- Replaced `execSync` with `execFileSync` and `spawnSync` for safer command execution using argument arrays instead of string interpolation.
-- Added input validation patterns: `VALID_AGENT_ID` (`[a-z0-9_-]{1,32}`), `VALID_BRANCH_NAME` (`[a-zA-Z0-9/_.-]{1,128}`), `VALID_MESSAGE_ID`.
-- Hardened file path handling in all commands.
-
-### Added
-- **AST semantic detection** - `spidersan conflicts --semantic` for symbol-level conflict analysis using Tree-sitter
-- **CRDT symbol locking** - `spidersan lock` for distributed coordination
-- **GitHub Action template** for auto-registration on push
-
-## [0.2.1] - 2025-12-30
-
-### Added
-- **Watch mode (daemon)** - Real-time file monitoring and auto-registration
-  - `spidersan watch` - Start watching files in current repo
-  - `--agent <id>` - Tag registrations with agent identifier
-  - `--hub` - Connect to Treebird Hub for real-time conflict warnings
-  - `--hub-sync` - Post conflicts to Hub chat via REST API
-  - `--quiet` - Only show conflicts, not file changes
-  - `--dir <path>` - Watch specific directory
-  - Debounced file detection (1s) to prevent spam
-  - Auto-register files to current branch on change
-  - Real-time conflict detection across active branches
-  - Hub integration via `conflicts:warning` socket event
-
-### Dependencies
-- Added `chokidar` for file system watching
-- Added `socket.io-client` for Hub real-time connection
-
-## [0.2.0] - 2025-12-29
-
-### Added
-- **Session lifecycle commands** - Myceliumail ecosystem integration
-  - `spidersan wake` - Start session: sync registry, check conflicts, call `mycmail wake`
-  - `spidersan close` - End session: show status, optionally mark stale, call `mycmail close`
-
-## [0.2.0] - 2025-12-23
-
-### Added
-- **MCP Server** - Model Context Protocol integration for Claude Desktop
-  - 7 tools: list_branches, check_conflicts, get_merge_order, register_branch, mark_merged, mark_abandoned, get_branch_info
-  - Global storage at `~/.spidersan/registry.json`
-- **Update check notifications** - CLI checks npm for newer versions
-  - Shows banner when update available
-  - 24-hour cache, non-blocking
-
-### Changed
-- MCP server uses global storage (works without git context)
-- `register_branch` accepts explicit branch name (no git auto-detect required)
-
-## [0.1.0] - 2025-12-15
-
-### Added
-- Initial project structure
-- Branch registration and conflict detection
-- Merge order recommendations
-- Local JSON storage