plain 0.68.0__py3-none-any.whl → 0.103.0__py3-none-any.whl

plain/CHANGELOG.md

@@ -1,5 +1,688 @@
 # plain changelog
 
+## [0.103.0](https://github.com/dropseed/plain/releases/plain@0.103.0) (2026-01-30)
+
+### What's changed
+
+- `plain docs` now shows markdown documentation by default (previously required `--source`), with a new `--symbols` flag to show only the symbolicated API surface ([b71dab9d5d](https://github.com/dropseed/plain/commit/b71dab9d5d))
+- `plain docs --list` now shows all official Plain packages (installed and uninstalled) with descriptions and install status ([9cba705d62](https://github.com/dropseed/plain/commit/9cba705d62))
+- `plain docs` for uninstalled packages now shows the install command and an online docs URL instead of a generic error ([9cba705d62](https://github.com/dropseed/plain/commit/9cba705d62))
+- Removed the `plain agent context` command and the `SessionStart` hook setup — agent rules now provide context directly without needing a startup hook ([88d9424643](https://github.com/dropseed/plain/commit/88d9424643))
+- `plain agent install` now cleans up old SessionStart hooks from `.claude/settings.json` ([88d9424643](https://github.com/dropseed/plain/commit/88d9424643))
+
+### Upgrade instructions
+
+- The `--source` flag for `plain docs` has been removed. Use `--symbols` instead to see the symbolicated API surface.
+- The `--open` flag for `plain docs` has been removed.
+- Run `plain agent install` to clean up the old SessionStart hook from your `.claude/settings.json`.
+
+## [0.102.0](https://github.com/dropseed/plain/releases/plain@0.102.0) (2026-01-28)
+
+### What's changed
+
+- Refactored agent integration from skills-based to rules-based: packages now provide `agents/.claude/rules/` files and `agents/.claude/skills/` directories instead of `skills/` directories ([512040ac51](https://github.com/dropseed/plain/commit/512040ac51))
+- The `plain agent install` command now copies both rules (`.md` files) and skills to the project's `.claude/` directory, and cleans up orphaned `plain*` items ([512040ac51](https://github.com/dropseed/plain/commit/512040ac51))
+- Removed standalone skills (`plain-docs`, `plain-shell`, `plain-request`) that are now provided as passive rules instead ([512040ac51](https://github.com/dropseed/plain/commit/512040ac51))
+
+### Upgrade instructions
+
+- Run `plain agent install` to update your `.claude/` directory with the new rules-based structure.
+
+## [0.101.2](https://github.com/dropseed/plain/releases/plain@0.101.2) (2026-01-28)
+
+### What's changed
+
+- When `load_dotenv()` is called with `override=False` (the default), command substitution is now skipped for keys that already exist in `os.environ`. This prevents redundant command execution in child processes that re-load the `.env` file after inheriting resolved values from the parent, avoiding multiple auth prompts with tools like the 1Password CLI ([2f6ff93499](https://github.com/dropseed/plain/commit/2f6ff93499))
+- The `_execute_command` helper now uses `stdout=subprocess.PIPE` instead of `capture_output=True`, allowing stderr/tty to pass through for interactive prompts ([2f6ff93499](https://github.com/dropseed/plain/commit/2f6ff93499))
+- Updated templates README examples to use `id` instead of `pk` ([837d345d23](https://github.com/dropseed/plain/commit/837d345d23))
+- Added Settings section to README ([803fee1ad5](https://github.com/dropseed/plain/commit/803fee1ad5))
+
+### Upgrade instructions
+
+- No changes required.
+
+## [0.101.1](https://github.com/dropseed/plain/releases/plain@0.101.1) (2026-01-17)
+
+### What's changed
+
+- Fixed a crash when running the development server with `--reload` when an app's `assets` directory doesn't exist ([df33f93ece](https://github.com/dropseed/plain/commit/df33f93ece))
+- The `plain agent install` command now preserves user-created skills (those without the `plain-` prefix) instead of removing them as orphans ([bbc87498ed](https://github.com/dropseed/plain/commit/bbc87498ed))
+
+### Upgrade instructions
+
+- No changes required.
+
+## [0.101.0](https://github.com/dropseed/plain/releases/plain@0.101.0) (2026-01-15)
+
+### What's changed
+
+- The `plain server` command now accepts `--workers auto` (or `WEB_CONCURRENCY=auto`) to automatically set worker count based on CPU count ([02a1769948](https://github.com/dropseed/plain/commit/02a1769948))
+- Response headers can now be set to `None` to opt out of default headers; `None` values are filtered out at the WSGI layer rather than being deleted by middleware ([cbf27e728d](https://github.com/dropseed/plain/commit/cbf27e728d))
+- Removed unused `Response` methods: `serialize_headers`, `serialize`, file-like interface stubs (`write`, `flush`, `tell`, `readable`, `seekable`, `writable`, `writelines`), `text` property, pickling support, and `getvalue` ([cbf27e728d](https://github.com/dropseed/plain/commit/cbf27e728d))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.100.1](https://github.com/dropseed/plain/releases/plain@0.100.1) (2026-01-15)
+
+### What's changed
+
+- The `plain agent install` command now only sets up session hooks for Claude Code, not Codex, since the `settings.json` hook format is Claude Code-specific ([a41e08bcd2](https://github.com/dropseed/plain/commit/a41e08bcd2))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.100.0](https://github.com/dropseed/plain/releases/plain@0.100.0) (2026-01-15)
+
+### What's changed
+
+- The `plain skills` command has been renamed to `plain agent` with new subcommands: `plain agent install` (installs skills and sets up hooks), `plain agent skills` (lists available skills), and `plain agent context` (outputs framework context) ([fac8673436](https://github.com/dropseed/plain/commit/fac8673436))
+- Added `SessionStart` hook that automatically runs `plain agent context` at the start of every Claude Code or Codex session, providing framework context without needing a separate skill ([fac8673436](https://github.com/dropseed/plain/commit/fac8673436))
+- The `plain-principles` skill has been removed - its content is now provided by the `plain agent context` command via the SessionStart hook ([fac8673436](https://github.com/dropseed/plain/commit/fac8673436))
+- Added `--no-headers` and `--no-body` flags to `plain request` for limiting output ([fac8673436](https://github.com/dropseed/plain/commit/fac8673436))
+
+### Upgrade instructions
+
+- Replace `plain skills --install` with `plain agent install`
+- Replace `plain skills` (without flags) with `plain agent skills`
+- Run `plain agent install` to set up the new SessionStart hook in your project's `.claude/` or `.codex/` directory
+
+## [0.99.0](https://github.com/dropseed/plain/releases/plain@0.99.0) (2026-01-15)
+
+### What's changed
+
+- Added `plain.utils.dotenv` module with `load_dotenv()` and `parse_dotenv()` functions for bash-compatible `.env` file parsing, supporting variable expansion, command substitution, multiline values, and escape sequences ([a9b2dc3e16](https://github.com/dropseed/plain/commit/a9b2dc3e16))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.98.1](https://github.com/dropseed/plain/releases/plain@0.98.1) (2026-01-13)
+
+### What's changed
+
+- Fixed `INSTALLED_PACKAGES` not being optional in user settings, restoring the default empty list behavior ([820773c473](https://github.com/dropseed/plain/commit/820773c473))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.98.0](https://github.com/dropseed/plain/releases/plain@0.98.0) (2026-01-13)
+
+### What's changed
+
+- The `plain skills --install` command now removes orphaned skills from destination directories when skills are renamed or removed from packages ([d51294ace1](https://github.com/dropseed/plain/commit/d51294ace1))
+- Added README documentation for `plain.skills` with available skills and installation instructions ([7c90fc8595](https://github.com/dropseed/plain/commit/7c90fc8595))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.97.0](https://github.com/dropseed/plain/releases/plain@0.97.0) (2026-01-13)
+
+### What's changed
+
+- HTTP exceptions (`NotFoundError404`, `ForbiddenError403`, `BadRequestError400`, and `SuspiciousOperationError400` variants) moved from `plain.exceptions` to `plain.http.exceptions` and are now exported from `plain.http` ([b61f909e29](https://github.com/dropseed/plain/commit/b61f909e29))
+
+### Upgrade instructions
+
+- Update imports of HTTP exceptions from `plain.exceptions` to `plain.http`:
+
+    ```python
+    # Before
+    from plain.exceptions import NotFoundError404, ForbiddenError403, BadRequestError400
+
+    # After
+    from plain.http import NotFoundError404, ForbiddenError403, BadRequestError400
+    ```
+
+## [0.96.0](https://github.com/dropseed/plain/releases/plain@0.96.0) (2026-01-13)
+
+### What's changed
+
+- Response classes renamed for consistency: `ResponseRedirect` → `RedirectResponse`, `ResponseNotModified` → `NotModifiedResponse`, `ResponseNotAllowed` → `NotAllowedResponse` ([fad5bf28b0](https://github.com/dropseed/plain/commit/fad5bf28b0))
+- Redundant response classes removed: `ResponseNotFound`, `ResponseForbidden`, `ResponseBadRequest`, `ResponseGone`, `ResponseServerError` - use `Response(status_code=X)` instead ([fad5bf28b0](https://github.com/dropseed/plain/commit/fad5bf28b0))
+- HTTP exceptions renamed to include status code suffix: `Http404` → `NotFoundError404`, `PermissionDenied` → `ForbiddenError403`, `BadRequest` → `BadRequestError400`, `SuspiciousOperation` → `SuspiciousOperationError400` ([5a1f020f52](https://github.com/dropseed/plain/commit/5a1f020f52))
+- Added `Secret[T]` type annotation for masking sensitive settings like `SECRET_KEY` in CLI output ([8713dc08b0](https://github.com/dropseed/plain/commit/8713dc08b0))
+- Added `ENV_SETTINGS_PREFIXES` setting to configure which environment variable prefixes are checked for settings (defaults to `["PLAIN_"]`) ([8713dc08b0](https://github.com/dropseed/plain/commit/8713dc08b0))
+- New `plain settings list` and `plain settings get` CLI commands for viewing settings with their sources ([8713dc08b0](https://github.com/dropseed/plain/commit/8713dc08b0))
+- Added preflight check for unused environment variables matching configured prefixes ([8713dc08b0](https://github.com/dropseed/plain/commit/8713dc08b0))
+- Renamed `request.meta` to `request.environ` for clarity ([786b95bef8](https://github.com/dropseed/plain/commit/786b95bef8))
+- Added `request.query_string` and `request.content_length` properties ([786b95bef8](https://github.com/dropseed/plain/commit/786b95bef8), [76dfd477d2](https://github.com/dropseed/plain/commit/76dfd477d2))
+- Renamed X-Forwarded settings: `USE_X_FORWARDED_HOST` → `HTTP_X_FORWARDED_HOST`, `USE_X_FORWARDED_PORT` → `HTTP_X_FORWARDED_PORT`, `USE_X_FORWARDED_FOR` → `HTTP_X_FORWARDED_FOR` ([22f241a55c](https://github.com/dropseed/plain/commit/22f241a55c))
+- Changed `HTTPS_PROXY_HEADER` from a tuple to a string format (e.g., `"X-Forwarded-Proto: https"`) ([7ac2a431b6](https://github.com/dropseed/plain/commit/7ac2a431b6))
+
+### Upgrade instructions
+
+- Replace Response class imports and usages:
+    - `ResponseRedirect` → `RedirectResponse`
+    - `ResponseNotModified` → `NotModifiedResponse`
+    - `ResponseNotAllowed` → `NotAllowedResponse`
+    - `ResponseNotFound` → `Response(status_code=404)`
+    - `ResponseForbidden` → `Response(status_code=403)`
+    - `ResponseBadRequest` → `Response(status_code=400)`
+    - `ResponseGone` → `Response(status_code=410)`
+    - `ResponseServerError` → `Response(status_code=500)`
+- Replace exception imports and usages:
+    - `Http404` → `NotFoundError404`
+    - `PermissionDenied` → `ForbiddenError403`
+    - `BadRequest` → `BadRequestError400`
+    - `SuspiciousOperation` → `SuspiciousOperationError400`
+    - `SuspiciousMultipartForm` → `SuspiciousMultipartFormError400`
+    - `SuspiciousFileOperation` → `SuspiciousFileOperationError400`
+    - `TooManyFieldsSent` → `TooManyFieldsSentError400`
+    - `TooManyFilesSent` → `TooManyFilesSentError400`
+    - `RequestDataTooBig` → `RequestDataTooBigError400`
+- Replace `request.meta` with `request.environ`
+- Rename X-Forwarded settings in your configuration:
+    - `USE_X_FORWARDED_HOST` → `HTTP_X_FORWARDED_HOST`
+    - `USE_X_FORWARDED_PORT` → `HTTP_X_FORWARDED_PORT`
+    - `USE_X_FORWARDED_FOR` → `HTTP_X_FORWARDED_FOR`
+- Update `HTTPS_PROXY_HEADER` from tuple format to string format:
+
+    ```python
+    # Before
+    HTTPS_PROXY_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+
+    # After
+    HTTPS_PROXY_HEADER = "X-Forwarded-Proto: https"
+    ```
+
+- Replace `plain setting <name>` command with `plain settings get <name>`
+
+## [0.95.0](https://github.com/dropseed/plain/releases/plain@0.95.0) (2025-12-22)
+
+### What's changed
+
+- Improved thread worker server shutdown behavior with `cancel_futures=True` for faster and cleaner process termination ([72d0620](https://github.com/dropseed/plain/commit/72d0620094))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.94.0](https://github.com/dropseed/plain/releases/plain@0.94.0) (2025-12-12)
+
+### What's changed
+
+- `FormFieldMissingError` exceptions are now automatically converted to HTTP 400 Bad Request responses with a warning log instead of causing a 500 error ([b38f6e5](https://github.com/dropseed/plain/commit/b38f6e50db))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.93.1](https://github.com/dropseed/plain/releases/plain@0.93.1) (2025-12-09)
+
+### What's changed
+
+- Added type annotation for `request.unique_id` attribute to improve IDE support and type checking ([23af501](https://github.com/dropseed/plain/commit/23af501d09))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.93.0](https://github.com/dropseed/plain/releases/plain@0.93.0) (2025-12-04)
+
+### What's changed
+
+- Improved type annotations across forms, HTTP handling, logging, and other core modules for better IDE support and type checking ([ac1eeb0](https://github.com/dropseed/plain/commit/ac1eeb0ea0))
+- Internal refactor of `TimestampSigner` to use composition instead of inheritance from `Signer`, maintaining the same public API ([ac1eeb0](https://github.com/dropseed/plain/commit/ac1eeb0ea0))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.92.0](https://github.com/dropseed/plain/releases/plain@0.92.0) (2025-12-01)
+
+### What's changed
+
+- Added `request.client_ip` property to get the client's IP address, with support for `X-Forwarded-For` header when behind a trusted proxy ([cb0bc5d](https://github.com/dropseed/plain/commit/cb0bc5d08f))
+- Added `USE_X_FORWARDED_FOR` setting to enable reading client IP from `X-Forwarded-For` header ([cb0bc5d](https://github.com/dropseed/plain/commit/cb0bc5d08f))
+- Improved `print_event` CLI output styling with dimmed text for less visual noise ([b09edfd](https://github.com/dropseed/plain/commit/b09edfd2a1))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.91.0](https://github.com/dropseed/plain/releases/plain@0.91.0) (2025-11-24)
+
+### What's changed
+
+- Request body parsing refactored: the `request.data` attribute has been replaced with `request.json_data` and `request.form_data` for explicit content-type handling ([90332a9](https://github.com/dropseed/plain/commit/90332a9c21))
+- `QueryDict` now has proper type annotations for `get()`, `pop()`, `getlist()`, and `__getitem__()` methods that reflect string return types ([90332a9](https://github.com/dropseed/plain/commit/90332a9c21))
+- Forms now automatically select between `json_data` and `form_data` based on request content-type ([90332a9](https://github.com/dropseed/plain/commit/90332a9c21))
+- View mixins `ObjectTemplateViewMixin` removed in favor of class inheritance for better typing - `UpdateView` and `DeleteView` now inherit from `DetailView` ([569afd6](https://github.com/dropseed/plain/commit/569afd606d))
+- `AppLogger` context logging now uses a `context` dict parameter instead of `**kwargs` for better type checking ([581b406](https://github.com/dropseed/plain/commit/581b4060d3))
+- Removed erroneous `AuthViewMixin` export from `plain.views` ([334bbb6](https://github.com/dropseed/plain/commit/334bbb6e7a))
+
+### Upgrade instructions
+
+- Replace `request.data` with the appropriate method:
+    - For JSON requests: use `request.json_data` (returns a dict, raises `BadRequest` for invalid JSON)
+    - For form data: use `request.form_data` (returns a `QueryDict`)
+- Update `app_logger` calls that pass context as kwargs to use the `context` parameter:
+
+    ```python
+    # Before
+    app_logger.info("Message", user_id=123, action="login")
+
+    # After
+    app_logger.info("Message", context={"user_id": 123, "action": "login"})
+    ```
+
+## [0.90.0](https://github.com/dropseed/plain/releases/plain@0.90.0) (2025-11-20)
+
+### What's changed
+
+- Improved type annotations in `timezone.py`: `is_aware()` and `is_naive()` now accept both `datetime` and `time` objects for more flexible type checking ([a43145e](https://github.com/dropseed/plain/commit/a43145e697))
+- Enhanced type annotations in view classes: `convert_value_to_response()` and handler result variables now use more explicit type hints for better IDE support ([dc4454e](https://github.com/dropseed/plain/commit/dc4454e196))
+- Fixed type errors in forms and server workers: URL field now handles bytes properly, and worker wait_fds has explicit type annotation ([fc98d66](https://github.com/dropseed/plain/commit/fc98d666d4))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.89.0](https://github.com/dropseed/plain/releases/plain@0.89.0) (2025-11-14)
+
+### What's changed
+
+- Improved type annotations in view classes: `url_args`, `url_kwargs`, and various template/form context dictionaries now have more specific type hints for better IDE support and type checking ([83bcb95](https://github.com/dropseed/plain/commit/83bcb95b09))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.88.0](https://github.com/dropseed/plain/releases/plain@0.88.0) (2025-11-13)
+
+### What's changed
+
+- The `plain.forms` module now uses explicit imports instead of wildcard imports, improving IDE autocomplete and type checking support ([eff36f3](https://github.com/dropseed/plain/commit/eff36f31e8e15f84e11164a44c833aeab096ffbd))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.87.0](https://github.com/dropseed/plain/releases/plain@0.87.0) (2025-11-12)
+
+### What's changed
+
+- Internal classes now use abstract base classes with `@abstractmethod` decorators instead of raising `NotImplementedError`, improving type checking and IDE support ([91b329a](https://github.com/dropseed/plain/commit/91b329a8adb477031c4358e638b12f35f19bb85d), [81b5f88](https://github.com/dropseed/plain/commit/81b5f88a4bd39785f6b19c3c00c0ed23a36fb72f), [d2e2423](https://github.com/dropseed/plain/commit/d2e24235f497a92f45d5a21fc83d802897c2dec0), [61e7b5a](https://github.com/dropseed/plain/commit/61e7b5a0c8675aaaf65f0a626ff7959a786dca7f))
+- Updated to latest version of `ty` type checker and fixed type errors and warnings throughout the codebase ([f4dbcef](https://github.com/dropseed/plain/commit/f4dbcefa929058be517cb1d4ab35bd73a89f26b8))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.86.2](https://github.com/dropseed/plain/releases/plain@0.86.2) (2025-11-11)
+
+### What's changed
+
+- CLI color output is now enabled in CI environments by checking the `CI` environment variable, matching the behavior of modern tools like uv ([a1500f15ed](https://github.com/dropseed/plain/commit/a1500f15ed))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.86.1](https://github.com/dropseed/plain/releases/plain@0.86.1) (2025-11-10)
+
+### What's changed
+
+- The `plain preflight` command now outputs to stderr only when using `--format json`, keeping stdout clean for JSON parsing while avoiding success messages appearing in error logs for text format ([72ebee7729](https://github.com/dropseed/plain/commit/72ebee7729))
+- CLI color handling now follows the CLICOLOR standard with proper priority: `NO_COLOR` > `CLICOLOR_FORCE`/`FORCE_COLOR` > `CLICOLOR` > `isatty` ([c7fea406c5](https://github.com/dropseed/plain/commit/c7fea406c5))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.86.0](https://github.com/dropseed/plain/releases/plain@0.86.0) (2025-11-10)
+
+### What's changed
+
+- Log output is now split by severity level: INFO and below go to stdout, WARNING and above go to stderr for proper cloud platform log classification ([52403b15ba](https://github.com/dropseed/plain/commit/52403b15ba))
+- Added `LOG_STREAM` setting to customize log output behavior with options: `"split"` (default), `"stdout"`, or `"stderr"` ([52403b15ba](https://github.com/dropseed/plain/commit/52403b15ba))
+- Log configuration documentation expanded with detailed guidance on output streams and environment variable settings ([52403b15ba](https://github.com/dropseed/plain/commit/52403b15ba))
+
+### Upgrade instructions
+
+- No changes required (default behavior splits logs to stdout/stderr automatically, but this can be customized via `PLAIN_LOG_STREAM` environment variable if needed)
+
+## [0.85.0](https://github.com/dropseed/plain/releases/plain@0.85.0) (2025-11-03)
+
+### What's changed
+
+- CLI help output now organizes commands into "Common Commands", "Core Commands", and "Package Commands" sections for better discoverability ([73d3a48](https://github.com/dropseed/plain/commit/73d3a48fca))
+- CLI help output has been customized with improved formatting and shortcut indicators showing which commands are shortcuts (e.g., `migrate → models migrate`) ([db882e6](https://github.com/dropseed/plain/commit/db882e6d47))
+- CSRF exception messages now include more detailed context about what was rejected and why (e.g., port mismatches, host mismatches) ([9a8e09c](https://github.com/dropseed/plain/commit/9a8e09c1dc))
+- The `plain agent md` command now saves a combined `AGENTS.md` file to `.plain/` by default when using `plain dev`, making it easier to provide context to coding agents ([786b7a0](https://github.com/dropseed/plain/commit/786b7a0ca1))
+- CLI help text styling has been refined with dimmed descriptions and usage prefixes for improved readability ([d7f7053](https://github.com/dropseed/plain/commit/d7f705398d))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.84.1](https://github.com/dropseed/plain/releases/plain@0.84.1) (2025-10-31)
+
+### What's changed
+
+- Added `license = "BSD-3-Clause"` to package metadata in `pyproject.toml` ([8477355](https://github.com/dropseed/plain/commit/8477355e65))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.84.0](https://github.com/dropseed/plain/releases/plain@0.84.0) (2025-10-29)
+
+### What's changed
+
+- The `DEFAULT_RESPONSE_HEADERS` setting now supports format string placeholders (e.g., `{request.csp_nonce}`) for dynamic header values instead of requiring a callable function ([5199383128](https://github.com/dropseed/plain/commit/5199383128))
+- Views can now set headers to `None` to explicitly remove default response headers ([5199383128](https://github.com/dropseed/plain/commit/5199383128))
+- Added comprehensive documentation for customizing default response headers including override, remove, and extend patterns ([5199383128](https://github.com/dropseed/plain/commit/5199383128))
+
+### Upgrade instructions
+
+- If you have `DEFAULT_RESPONSE_HEADERS` configured as a callable function, convert it to a dictionary with format string placeholders:
+
+    ```python
+    # Before:
+    def DEFAULT_RESPONSE_HEADERS(request):
+        nonce = request.csp_nonce
+        return {
+            "Content-Security-Policy": f"script-src 'self' 'nonce-{nonce}'",
+        }
+
+    # After:
+    DEFAULT_RESPONSE_HEADERS = {
+        "Content-Security-Policy": "script-src 'self' 'nonce-{request.csp_nonce}'",
+    }
+    ```
+
+- If you were overriding default headers to empty strings (`""`) to remove them, change those to `None` instead
+
+## [0.83.0](https://github.com/dropseed/plain/releases/plain@0.83.0) (2025-10-29)
+
+### What's changed
+
+- Added comprehensive Content Security Policy (CSP) documentation explaining how to use nonces with inline scripts and styles ([784f3dd972](https://github.com/dropseed/plain/commit/784f3dd972))
+- The `json_script` utility function now accepts an optional `nonce` parameter for CSP-compliant inline JSON scripts ([784f3dd972](https://github.com/dropseed/plain/commit/784f3dd972))
+
+### Upgrade instructions
+
+- Any `|json_script` usages need to make sure the second argument is a nonce, not a custom encoder (which is now third)
+
+## [0.82.0](https://github.com/dropseed/plain/releases/plain@0.82.0) (2025-10-29)
+
+### What's changed
+
+- The `DEFAULT_RESPONSE_HEADERS` setting can now be a callable that accepts a request argument, enabling dynamic header generation per request ([cb92905834](https://github.com/dropseed/plain/commit/cb92905834))
+- Added `request.csp_nonce` cached property for generating Content Security Policy nonces ([75071dcc70](https://github.com/dropseed/plain/commit/75071dcc70))
+- Simplified the preflight command by moving `plain preflight check` back to `plain preflight` ([40c2c4560e](https://github.com/dropseed/plain/commit/40c2c4560e))
+
+### Upgrade instructions
+
+- If you use `plain preflight check`, update to `plain preflight` (the `check` subcommand has been removed for simplicity)
+- If you use `plain preflight check --deploy`, update to `plain preflight --deploy`
+
+## [0.81.0](https://github.com/dropseed/plain/releases/plain@0.81.0) (2025-10-22)
+
+### What's changed
+
+- Removed support for category-specific error template fallbacks like `4xx.html` and `5xx.html` ([9513f7c4fa](https://github.com/dropseed/plain/commit/9513f7c4fa))
+
+### Upgrade instructions
+
+- If you have `4xx.html` or `5xx.html` error templates, rename them to specific status code templates (e.g., `404.html`, `500.html`) or remove them if you prefer the plain HTTP response fallback
+
+## [0.80.0](https://github.com/dropseed/plain/releases/plain@0.80.0) (2025-10-22)
+
+### What's changed
+
+- CSRF failures now raise `SuspiciousOperation` (HTTP 400) instead of `PermissionDenied` (HTTP 403) ([ad146bde3e](https://github.com/dropseed/plain/commit/ad146bde3e))
+- Error templates can now use category-specific fallbacks like `4xx.html` or `5xx.html` instead of the generic `error.html` ([716cfa3cfc](https://github.com/dropseed/plain/commit/716cfa3cfc))
+- Updated error template documentation with best practices for self-contained `500.html` templates ([55cea3b522](https://github.com/dropseed/plain/commit/55cea3b522))
+
+### Upgrade instructions
+
+- If you have a `templates/error.html` template, instead create specific error templates for each status code you want to customize (e.g., `400.html`, `403.html`, `404.html`, `500.html`). You can also create category-specific templates like `4xx.html` or `5xx.html` for broader coverage.
+
+## [0.79.0](https://github.com/dropseed/plain/releases/plain@0.79.0) (2025-10-22)
+
+### What's changed
+
+- Response objects now have an `exception` attribute that stores the exception that caused 5xx errors ([0a243ba89c](https://github.com/dropseed/plain/commit/0a243ba89c))
+- Middleware classes now use an abstract base class `HttpMiddleware` with a `process_request()` method ([b960eed6c6](https://github.com/dropseed/plain/commit/b960eed6c6))
+- CSRF middleware now raises `PermissionDenied` instead of rendering a custom `CsrfFailureView` ([d4b93e59b3](https://github.com/dropseed/plain/commit/d4b93e59b3))
+- The `HTTP_ERROR_VIEWS` setting has been removed ([7a4e3a31f4](https://github.com/dropseed/plain/commit/7a4e3a31f4))
+- Standalone `plain-changelog` and `plain-upgrade` executables have been removed in favor of the built-in commands ([07c3a4c540](https://github.com/dropseed/plain/commit/07c3a4c540))
+- Standalone `plain-build` executable has been removed ([99301ea797](https://github.com/dropseed/plain/commit/99301ea797))
+- Removed automatic logging of all HTTP 400+ status codes for cleaner logs ([c2769d7281](https://github.com/dropseed/plain/commit/c2769d7281))
+
+### Upgrade instructions
+
+- If you have custom middleware, inherit from `HttpMiddleware` and rename your `__call__()` method to `process_request()`:
+
+    ```python
+    # Before:
+    class MyMiddleware:
+        def __init__(self, get_response):
+            self.get_response = get_response
+
+        def __call__(self, request):
+            response = self.get_response(request)
+            return response
+
+    # After:
+    from plain.http import HttpMiddleware
+
+    class MyMiddleware(HttpMiddleware):
+        def process_request(self, request):
+            response = self.get_response(request)
+            return response
+    ```
+
+- Remove any custom `HTTP_ERROR_VIEWS` setting from your configuration - error views are now controlled entirely by exception handlers
+- If you were calling `plain-changelog` or `plain-upgrade` as standalone commands, use `plain changelog` or `plain upgrade` instead
+- If you were calling `plain-build` as a standalone command, use `plain build` instead
+
+## [0.78.2](https://github.com/dropseed/plain/releases/plain@0.78.2) (2025-10-20)
+
+### What's changed
+
+- Updated package metadata to use `[dependency-groups]` instead of `[tool.uv]` for development dependencies, following PEP 735 standard ([1b43a3a272](https://github.com/dropseed/plain/commit/1b43a3a272))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.78.1](https://github.com/dropseed/plain/releases/plain@0.78.1) (2025-10-17)
+
+### What's changed
+
+- Fixed job worker logging by using `getLogger` instead of directly instantiating `Logger` for the plain logger ([dd675666b9](https://github.com/dropseed/plain/commit/dd675666b9))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.78.0](https://github.com/dropseed/plain/releases/plain@0.78.0) (2025-10-17)
+
+### What's changed
+
+- Chores have been refactored to use abstract base classes instead of decorated functions ([c4466d3c60](https://github.com/dropseed/plain/commit/c4466d3c60))
+- Added `SHELL_IMPORT` setting to customize what gets automatically imported in `plain shell` ([9055f59c08](https://github.com/dropseed/plain/commit/9055f59c08))
+- Views that return `None` now raise `Http404` instead of returning `ResponseNotFound` ([5bb60016eb](https://github.com/dropseed/plain/commit/5bb60016eb))
+- The `plain chores list` command output formatting now matches the `plain jobs list` format ([4b6881a49e](https://github.com/dropseed/plain/commit/4b6881a49e))
+
+### Upgrade instructions
+
+- Update any chores from decorated functions to class-based chores:
+
+    ```python
+    # Before:
+    @register_chore("group")
+    def chore_name():
+        """Description"""
+        return "Done!"
+
+    # After:
+    from plain.chores import Chore, register_chore
+
+    @register_chore
+    class ChoreName(Chore):
+        """Description"""
+
+        def run(self):
+            return "Done!"
+    ```
+
+- Import `Chore` base class from `plain.chores` when creating new chores
+
+## [0.77.0](https://github.com/dropseed/plain/releases/plain@0.77.0) (2025-10-13)
+
+### What's changed
+
+- The `plain server --reload` now uses `watchfiles` for improved cross-platform file watching ([92e95c5032](https://github.com/dropseed/plain/commit/92e95c5032))
+- Server reloader now watches `.env*` files for changes and triggers automatic reload ([92e95c5032](https://github.com/dropseed/plain/commit/92e95c5032))
+- HTML template additions and deletions now trigger automatic server reload when using `--reload` ([f2f31c288b](https://github.com/dropseed/plain/commit/f2f31c288b))
+- Internal server worker type renamed from "gthread" to "thread" for clarity ([6470748e91](https://github.com/dropseed/plain/commit/6470748e91))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.76.0](https://github.com/dropseed/plain/releases/plain@0.76.0) (2025-10-12)
+
+### What's changed
+
+- Added new `plain server` command with built-in WSGI server (vendored gunicorn) ([f9dc2867c7](https://github.com/dropseed/plain/commit/f9dc2867c7))
+- The `plain server` command supports `WEB_CONCURRENCY` environment variable for worker processes ([0c3e8c6f32](https://github.com/dropseed/plain/commit/0c3e8c6f32))
+- Simplified server startup logging to use a single consolidated log line ([b1405b71f0](https://github.com/dropseed/plain/commit/b1405b71f0))
+- Removed `gunicorn` as an external dependency - server functionality is now built into plain core ([cb6c2f484d](https://github.com/dropseed/plain/commit/cb6c2f484d))
+- Internal server environment variables renamed from `GUNICORN_*` to `PLAIN_SERVER_*` ([745c073123](https://github.com/dropseed/plain/commit/745c073123))
+- Removed unused server features including hooks, syslog, proxy protocol, user/group dropping, and config file loading ([be0f82d92b](https://github.com/dropseed/plain/commit/be0f82d92b), [10c206875b](https://github.com/dropseed/plain/commit/10c206875b), [ecf327014c](https://github.com/dropseed/plain/commit/ecf327014c), [fb5a10f50b](https://github.com/dropseed/plain/commit/fb5a10f50b))
+
+### Upgrade instructions
+
+- Replace any direct usage of `gunicorn` with the new `plain server` command (ex. `gunicorn plain.wsgi:app --workers 4` becomes `plain server --workers 4`)
+- Update any deployment scripts or Procfiles that use `gunicorn` to use `plain server` instead
+- Remove `gunicorn` from your project dependencies if you added it separately (it's now built into plain)
+- For Heroku deployments, the `$PORT` is not automatically detected - update your Procfile to `web: plain server --bind 0.0.0.0:$PORT`
+- If you were using gunicorn configuration files, migrate the settings to `plain server` command-line options (run `plain server --help` to see available options)
+
+## [0.75.0](https://github.com/dropseed/plain/releases/plain@0.75.0) (2025-10-10)
+
+### What's changed
+
+- Documentation references updated from `plain-worker` to `plain-jobs` following the package rename ([24219856e0](https://github.com/dropseed/plain/commit/24219856e0))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.74.0](https://github.com/dropseed/plain/releases/plain@0.74.0) (2025-10-08)
+
+### What's changed
+
+- The `plain agent request` command now displays request ID in the response output ([4a20cfa3fc](https://github.com/dropseed/plain/commit/4a20cfa3fc))
+- Request headers are now included in OpenTelemetry tracing baggage for improved observability ([08a3376d06](https://github.com/dropseed/plain/commit/08a3376d06))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.73.0](https://github.com/dropseed/plain/releases/plain@0.73.0) (2025-10-07)
+
+### What's changed
+
+- Internal preflight result handling updated to use `model_options` instead of `_meta` for model label retrieval ([73ba469](https://github.com/dropseed/plain/commit/73ba469ba0))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.72.2](https://github.com/dropseed/plain/releases/plain@0.72.2) (2025-10-06)
+
+### What's changed
+
+- Improved type annotations for test client responses with new `ClientResponse` wrapper class ([369353f9d6](https://github.com/dropseed/plain/commit/369353f9d6))
+- Enhanced internal type checking for WSGI handler and request/response types ([50463b00c3](https://github.com/dropseed/plain/commit/50463b00c3))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.72.1](https://github.com/dropseed/plain/releases/plain@0.72.1) (2025-10-02)
+
+### What's changed
+
+- Fixed documentation examples to use the correct view attribute names (`self.user` instead of `self.request.user`) ([f6278d9](https://github.com/dropseed/plain/commit/f6278d9bb4))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.72.0](https://github.com/dropseed/plain/releases/plain@0.72.0) (2025-10-02)
+
+### What's changed
+
+- Request attributes `user` and `session` are no longer set directly on the request object ([154ee10](https://github.com/dropseed/plain/commit/154ee10375))
+- Test client now uses `plain.auth.requests.get_request_user()` to retrieve user for response object when available ([154ee10](https://github.com/dropseed/plain/commit/154ee10375))
+- Removed `plain.auth.middleware.AuthenticationMiddleware` from default middleware configuration ([154ee10](https://github.com/dropseed/plain/commit/154ee10375))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.71.0](https://github.com/dropseed/plain/releases/plain@0.71.0) (2025-09-30)
+
+### What's changed
+
+- Renamed `HttpRequest` to `Request` throughout the codebase for consistency and simplicity ([cd46ff20](https://github.com/dropseed/plain/commit/cd46ff2003))
+- Renamed `HttpHeaders` to `RequestHeaders` for naming consistency ([cd46ff20](https://github.com/dropseed/plain/commit/cd46ff2003))
+- Renamed settings: `APP_NAME` → `NAME`, `APP_VERSION` → `VERSION`, `APP_LOG_LEVEL` → `LOG_LEVEL`, `APP_LOG_FORMAT` → `LOG_FORMAT`, `PLAIN_LOG_LEVEL` → `FRAMEWORK_LOG_LEVEL` ([4c5f2166](https://github.com/dropseed/plain/commit/4c5f2166c1))
+- Added `request.get_preferred_type()` method to select the most preferred media type from Accept header ([b105ba4d](https://github.com/dropseed/plain/commit/b105ba4dd0))
+- Moved helper functions in `http/request.py` to be static methods of `QueryDict` ([0e1b0133](https://github.com/dropseed/plain/commit/0e1b0133c5))
+
+### Upgrade instructions
+
+- Replace all imports and usage of `HttpRequest` with `Request`
+- Replace all imports and usage of `HttpHeaders` with `RequestHeaders`
+- Update any custom settings that reference `APP_NAME` to `NAME`, `APP_VERSION` to `VERSION`, `APP_LOG_LEVEL` to `LOG_LEVEL`, `APP_LOG_FORMAT` to `LOG_FORMAT`, and `PLAIN_LOG_LEVEL` to `FRAMEWORK_LOG_LEVEL`
+- Configuring these settings via the `PLAIN_` prefixed environment variable will need to be updated accordingly
+
+## [0.70.0](https://github.com/dropseed/plain/releases/plain@0.70.0) (2025-09-30)
+
+### What's changed
+
+- Added comprehensive type annotations throughout the codebase for improved IDE support and type checking ([365414c](https://github.com/dropseed/plain/commit/365414cc6f))
+- The `Asset` class in `plain.assets.finders` is now a module-level public class instead of being defined inside `iter_assets()` ([6321765](https://github.com/dropseed/plain/commit/6321765d30))
+
+### Upgrade instructions
+
+- No changes required
+
+## [0.69.0](https://github.com/dropseed/plain/releases/plain@0.69.0) (2025-09-29)
+
+### What's changed
+
+- Model-related exceptions (`FieldDoesNotExist`, `FieldError`, `ObjectDoesNotExist`, `MultipleObjectsReturned`, `EmptyResultSet`, `FullResultSet`) moved from `plain.exceptions` to `plain.models.exceptions` ([1c02564](https://github.com/dropseed/plain/commit/1c02564561))
+- Added `plain dev` alias prompt that suggests adding `p` as a shell alias for convenience ([d913b44](https://github.com/dropseed/plain/commit/d913b44fab))
+
+### Upgrade instructions
+
+- Replace imports of `FieldDoesNotExist`, `FieldError`, `ObjectDoesNotExist`, `MultipleObjectsReturned`, `EmptyResultSet`, or `FullResultSet` from `plain.exceptions` to `plain.models.exceptions`
+- If you're using `ObjectDoesNotExist` in views, update your import from `plain.exceptions.ObjectDoesNotExist` to `plain.models.exceptions.ObjectDoesNotExist`
+
+## [0.68.1](https://github.com/dropseed/plain/releases/plain@0.68.1) (2025-09-25)
+
+### What's changed
+
+- Preflight checks are now sorted by name for consistent ordering ([cb8e160](https://github.com/dropseed/plain/commit/cb8e160934))
+
+### Upgrade instructions
+
+- No changes required
+
 ## [0.68.0](https://github.com/dropseed/plain/releases/plain@0.68.0) (2025-09-25)
 
 ### What's changed
@@ -11,7 +694,7 @@
 
 ### Upgrade instructions
 
-- Use `plain preflight check` instead of `plain preflight` to run all checks
+- Update any uses of the `plain preflight` command to `plain preflight check`, and remove the `--database` and `--fail-level` options which no longer exist
 - Custom preflight checks should be class based, extending `PreflightCheck` and implementing the `run()` method
 - Preflight checks need to be registered with a custom name (ex. `@register_check("app.my_custom_check")`) and optionally with `deploy=True` if it should run in only in deploy mode
 - Preflight results should use `PreflightResult` (optionally with `warning=True`) instead of `preflight.Warning` or `preflight.Error`