# Changelog

## 0.2.19 (2026-10-10)

- Widened `@earendil-works/pi-coding-agent` peerDependency cap from `<1.0.0` to `<1.2.0` (floor unchanged); bumped devDependencies to `^1.1.0`. Verified against Pi SDK 1.1.0 (types additive-only; full test suite green).

## 0.2.18 (2026-09-30)

- Fix: REVIEW.md guidance injected by `before_agent_start` is now capped at 16 KB, matching the cap `runReview` already applies to the same content.

## 0.2.17 (2026-09-30)

- Widened `@earendil-works/pi-coding-agent` peerDependency cap from `<0.88.0` to `<1.0.0` (floor unchanged); bumped devDependencies to `^0.99.1`. Verified against Pi SDK 0.99.1.
- Fixed: a `session_shutdown` handler now resets local-review state (restricted `SAFE_REVIEW_TOOLS` toolset + review thinking level), so sessions replaced without `agent_settled`/`session_start` (RPC/print lifecycle) no longer leak the restricted toolset or thinking level. Mirrors the `session_start` reset; the host resets actual tool/thinking session state.
- Fixed: the `/review` event listener guards its `accept()`/`respond()` invocations — a synchronous throw inside a consumer's `accept()` is treated as declined and resolved as `ok:false` (`"Reviewer accept handler failed"`) instead of escaping the emit chain and stranding local review mode.
- Docs: corrected the README timeout claim — transport heartbeats DO reset the 3-minute inactivity window (all `pi-subagent` progress events do); only the 20-minute hard cap bounds a hung-but-heartbeating child.

## 0.2.16 (2026-09-28)

- **Review answers with a leading non-JSON fence parsed as malformed**:
  `parseReviewResult` took the first fenced block, so a reviewer answer that
  opened with a ```diff/example fence before the result fence produced a
  synthetic blocking "malformed" finding. It now iterates all fenced blocks
  and JSON-parses each until one validates; `malformedReviewResult` is only
  used when none parse (or there are no fences and the raw output isn't JSON).

## 0.2.15 (2026-09-26)

- Security: the review-mode read-only bash gate now rejects `git diff --ext-diff`
  and `git log -p --textconv` (they execute user-configured external diff
  drivers / textconv filters). `--no-ext-diff` / `--no-textconv` (disabling)
  remain allowed. Regression tests added.
- Security (review round): unique-prefix flag abbreviations (`--text` =
  `--textconv`, verified live) are also rejected; and when the repo configures
  a diff driver (probed at review start), patch-rendering commands (`git diff`,
  `git show`, `git log -p`, `git blame`) are allowed only with an explicit
  `--no-ext-diff`/`--no-textconv` — textconv runs by default on patch output.

## 0.2.14 (2026-09-26)

### Fixed

- **SAFE_REVIEW_TOOLS synced with pi-plan** (drift since pi-plan 0.12.0):
  added `evolve_reflect`, `ux_audit`, `a2a_peers`, `a2a_list`, `a2a_discover`,
  `a2a_status`, `a2a_history`, `unfold`, `recall` — read-only review agents
  can now use the full toolset plan mode tells them to prefer.

## 0.2.13 (2026-09-24)

### Fixed

- **Security: the read-only bash gate missed `fd`'s exec family and `rg`'s
  preprocessor.** `fd -x/-X/--exec[--batch]` runs an arbitrary command per
  match, and `rg --pre[=cmd]` pipes match content through an arbitrary
  preprocessor — both previously passed `isReadOnlyBash` in read-only review
  mode (`find -exec` was already blocked). Both families are now rejected.
  Both are clap CLIs, but they differ: rg accepts unambiguous long-prefix
  abbreviations (`rg --pr` ≡ `--pre`) while fd does not infer long prefixes —
  but fd combines and attaches short flags (`fd -Hx cmd`, `fd -xrm tmp` both
  execute per match, verified live). The fd pattern now blocks any short-flag
  cluster containing x/X, and the rg pattern matches any `--pr` prefix
  (reviewer round 2).
- SDK drift no longer leaves the session stuck at the review thinking level.
  `enterLocalReview` captured the pre-review level only when it was inside the
  local `THINKING_LEVELS` whitelist; a new/renamed SDK level became `undefined`
  and `leaveLocalReview` silently skipped the restore. Capture is now
  unconditional, and restore guards with `typeof === "string"` so a drifted
  `undefined` capture is never pushed back into the host (session stays at the
  review level instead — least surprise).

### Tests

- Cover the new `fd`/`rg` exec-gate patterns (positive and read-only cases).
- Cover thinking restore with an out-of-list SDK level (`"ultra"`).
- Cover the Git-evidence byte-cap fail-closed branch (11KB status →
  `ok:false, error:"Reviewer Git evidence exceeds the configured limit"`).

## 0.2.12 (2026-09-21)

- Widened Pi SDK peer range to `<0.88.0` (devDeps to `^0.87.0`); tested against Pi 0.87.0. No behavioral changes — the 0.87.0 audit found no affected code paths.
- Tests: cover `buildReviewPrompt` preset-specific prompts and the fail-closed Git
  evidence/range gates (primary git failure, unresolvable custom range). No
  behavioral changes.

## 0.2.11 (2026-09-20)

- Widened Pi SDK peer range to `<0.87.0` (devDeps to ^0.86.0); tested against Pi 0.86.0. No behavioral changes — the 0.86.0 audit found no affected code paths.

## 0.2.10 (2026-09-12)

### Fixed

- Dropped `typebox` from `peerDependencies` and `devDependencies` — it was
  never imported (pi-coding-agent provides its own).
- Capped the `@earendil-works/pi-coding-agent` peer range at
  `>=0.84.3 <0.86.0` instead of `*`.

## 0.2.9 (2026-08-29)

### Added

- `/review` argument completion offers the thinking-level keywords
  (`off...max`) before the free-form target.

## 0.2.8 (2026-08-05)

### Improvements

- Patch version bump for release sync and package documentation update.

## 0.2.7 (2026-08-04)

### Fixes

- **`sort -o` detection covers combined short flags.** `DESTRUCTIVE_BASH_PATTERNS` now matches `sort -no out.txt` / `sort -on out.txt` (not just standalone `-o`), closing a review-mode gate escape where `sort` with an embedded output flag was treated as read-only.
- **`serena_check_onboarding_performed` added to `SAFE_REVIEW_TOOLS`** (mirrors `READ_ONLY_TOOLS`), so the read-only onboarding check is available during review.

All notable changes to `pi-review` will be documented in this file.

## 0.2.6 (2026-07-30)

### Improvements

- Patch version bump for release sync and package documentation update.

## 0.2.5 (2026-07-24)

### Features

- Support Pi 0.81.0+ and 0.82.0 plugin API.

## 0.2.0 (2026-07-16)

### Features

- Added actionable issue handoffs with reproduction evidence, expected behavior, suggested fix, and acceptance criteria.
- Added activity-aware review inactivity timeouts (3-minute inactivity window, 20-minute cap).
- Blocked `awk` and dangerous commands in read-only fallback mode.

## 0.1.0 (2026-07-10)

### Features

- Initial release of `pi-review` isolated read-only code review extension.