# Changelog

## 0.6.0 (2026-10-10)

- **Deferred tool tier** (ceulen pattern): `munin_store`, `munin_list`, `munin_recent`, `munin_delete`, `munin_capabilities`, `munin_share` now register `exposure: "deferred"` — not declared to the model until `tool_search` loads them (they stay callable via `ctx.executeTool`/codemode). `munin_search`/`munin_get` (the always-injected Memory Protocol depends on them being first-callable) stay direct. The package now force-activates `tool_search` in `session_start` when it defers tools (pi only auto-activates discovery for MCP servers). Unit tests pin the exposure flags and the activation branches.

## 0.5.12 (2026-09-30)

- `remediatedError` now copies the original error's `code` and attaches `details.remediation` to the rebuilt Error, so structured consumers keep them; message text (and the stale-protocol handshake flow) is unchanged. Verified against Pi SDK 0.99.2.

All notable changes to `pi-munin` will be documented in this file.

## 0.5.11 (2026-09-30)

- `withRetry` now ends with an explicit `throw new Error("withRetry: unreachable")`
  after the retry loop — previously a refactor of the loop's `i === 3` rethrow
  could silently resolve `undefined as T` instead of failing loudly.

## 0.5.10 (2026-09-28)

- Tests: pinned the `tool_result` error-sanitization hook (anti-injection path) —
  a prior `Munin <type> error:` prefix is stripped instead of double-wrapped,
  oversized error output is bounded to the truncation cap, and non-munin /
  non-error results pass through untouched.

## 0.5.9 (2026-09-26)

### Fixed

- Cleanup: deleted the unreachable `throw new Error("Munin retry loop
  exhausted")` after `withRetry`'s loop — the loop already rethrows at
  `i === 3`, so the line after it could never execute.

## 0.5.8 (2026-09-24)

### Fixed

- `munin-status` and `before_agent_start` no longer assume the host provides
  `ctx.isProjectTrusted` — both call sites now use the optional-call form
  (`ctx.isProjectTrusted?.() === true`), matching `withMuninClient`. A host/
  SDK version without the callback crashed both paths instead of degrading to
  the untrusted default.

## 0.5.7 (2026-09-22)

### Fixed

- Ack resolved-failure path no longer double-wraps the error: the
  non-throwing ack failure is now detected via a flag instead of throwing
  inside the `try` that the immediately-following `catch` re-wraps
  (previously double `remediatedError` + misleading `cause` chain).
- `formatMemories` ponytail comment now describes the actual coercion
  behavior (unknown shapes are coerced, not thrown).

### Tests

- Direct-method dispatch path (`client[directAction](projectId, payload)`
  for search/get/store/list/recent) is now exercised with a stub client,
  asserting the direct call, argument arity, and the `invoke` fallback.

## 0.5.6 (2026-09-21)

### Fixed

- `validateMemoryKey` error message now says "at most 200 characters" —
  the check (`key.length > 200`) allows exactly 200, so "less than" was
  wrong.

## 0.5.5 (2026-09-20)

### Fixed

- **`munin_search` now validates `tag_mode`** — only `"all"` or `"any"` are
  accepted; anything else throws a clear error naming the valid values
  instead of passing an arbitrary string through to the server.

## 0.5.4 (2026-09-14)

### Fixed

- `callMunin` error handling no longer mutates the caught error's `.message`
  before rethrowing. Remediation text is now appended into a fresh `Error`
  (identical message text) with the original preserved as `cause`, keeping
  the original error's identity and stack intact.

## 0.5.3 (2026-08-30)

### Changed

- Trimmed `munin_store` promptGuidelines from 4 lines to 1 (points at the
  always-on Munin Memory Protocol) and one-lined key/content/tags/base_url/
  project param descriptions. Saves ~45 tokens/turn.

## 0.5.2 (2026-08-10)

### Fixes

- **Auto-recover from `ERR_STALE_PROTOCOL`:** when a write fails because the server requires the one-time `acknowledge_setup` handshake (freshly-provisioned Munin server v1.5.0+), pi-munin now performs the server-directed ack action (default `acknowledge_setup`, read from `remediation.acknowledge_after_reading.action`) with `{ ensureCapability: false }` and retries the original call exactly once. The retry is wrapped in `withRetry` so a transient network blip after a successful ack is tolerated. If ack is unavailable or fails, the tool result surfaces the server's remediation URL and required version instead of the bare `ERR_STALE_PROTOCOL` code. Previously the SDK's `err.details.remediation` was dropped on the floor, so every write tool failed opaquely. *(Superseded in 0.5.10: bounded single retry — see below.)*
- **Security: remediation strings sanitized.** Server-provided remediation fields (url, action, version) are validated/sanitized before reaching agent context: URLs must be `http(s)`, contain no control/bidi/format chars, and carry no embedded credentials (rejects `javascript:`/`file:`/injection/`user:pass@`); action/version tokens have ASCII + Unicode control chars stripped; the version clause is omitted when sanitized empty. Error-path tool results are now truncated like success paths, bounding a malicious server's ability to balloon agent context via oversized remediation fields. The ack result is inspected for non-throwing failures (`ok:false`/`acknowledged:false`) and treated as failure (no retry). Closes multiple prompt-injection/context-abuse vectors where a malicious or buggy server could inject directives, exfiltrate credentials, or bloat context via the remediation block.

## 0.5.1 (2026-08-05)

### Improvements

- Patch version bump for release sync and package documentation update.

## 0.5.0 (2026-08-01)

### Features

- **Portable instructions:** the condensed always-on Munin Memory Protocol (Before acting / What to store / Memory shape / Lifecycle and safety) now self-injects via the existing `before_agent_start` hook, replacing the prior 2-line header. This protocol previously lived in the global `~/.pi/agent/AGENTS.md`; moving it here makes it travel with the package and carry zero overhead when pi-munin is absent. The full deep reference remains in `skills/munin/SKILL.md`. Per-tool `promptGuidelines` are unchanged.

## 0.4.9 (2026-07-30)

### Improvements

- Patch version bump for release sync and package documentation update.

## 0.4.8 (2026-07-24)

### Fixes

- Fixed lockfile resolution and dependency handling for `dotenv`.

## 0.4.7 (2026-07-20)

### Security & Reliability

- Hardened credential security, URL parsing validation, and typed error handling.
- Enhanced transient failure retry logic with exponential backoff (3 retries).

## 0.4.0 (2026-07-10)

### Features

- Added `munin_share` tool for confirmed cross-project memory sharing.
- Updated to `@kalera/munin-sdk@1.5.0`.