# Changelog

## 0.5.4 (2026-09-12)

### Fixed — safety classification

- **Recursive delete without a force flag now requires confirmation.**
  `Remove-Item -Recurse` (no `-Force`), `rm -r` / `rm --recursive` (no force),
  and `del /s` / `rmdir /s` / `rd /s` (no `/q`) previously classified as
  **safe** because the two delete rules required recursion AND force. Both
  rules now trigger on recursion alone — force only makes a recursive delete
  worse, it was never what made it dangerous.
  The explicit match covers `-Recurse` and its unambiguous PowerShell
  abbreviations (`-rec`, `-recu`, `-recurs`); the short-flag match is limited
  to POSIX-shaped clusters (`-r`, `-R`, `-rf`, `-fr`) so force-only
  non-recursive deletes (`Remove-Item -Force file.dll`, `-Filter`) stay safe,
  and PowerShell aliases of `Remove-Item` (`ri`, `del`, `erase`, `rd`) with
  `-Recurse` are covered too. Flags don't leak across newlines when classifying
  multi-line commands.

### Fixed — shell execution

- Spawn failures now surface the OS error: `Failed to spawn <exe>: <message>`
  (e.g. the ENOENT) instead of the bare "Failed to spawn process".

## 0.5.3 (2026-08-17)

### Improvements

- Dangerous-command confirmation is now a single select — **Allow once / Allow for this session / Deny** — instead of a yes/no confirm repeated per command. Long commands are clipped to 120 chars.
- Session-allow keys are hardened: interpreter/wrapper executables (powershell, pwsh, cmd, wsl, node, …, or any `*.exe`) are keyed by the **full command** — one approval cannot silence the danger-classification gate for a different payload behind the same interpreter. Ordinary executables stay keyed by first token.

## 0.5.2 (2026-08-05)

### Improvements

- Patch version bump for release sync and package documentation update.

## 0.5.1 (2026-08-04)

### Improvements

- **`windows_shell_exec` guidance softened.** The tool is no longer pitched as "use instead of generic bash" — its prompt guidelines now direct the model to use it for PowerShell/cmd/WSL-native commands, and to prefer plain `bash` for read-only inspection (which runs automatically in plan mode without a confirmation prompt). Reduces unnecessary confirm prompts in plan mode.

All notable changes to `pi-windows-tools` will be documented in this file.

## 0.5.0 (2026-08-02)

### Features & Fixes

- Stream command output via `onUpdate` (throttled live output, like Claude Code/Codex) — `windows_shell_exec` no longer buffers silently until exit.
- PowerShell `-EncodedCommand` fallback for multi-line / long commands (robust parsing where `-Command` mis-tokenizes).
- WSL UNC path support (`\\wsl.localhost\<distro>\<path>`, `\\wsl$\<distro>\<path>`) via `parseWslUncPath` — closes the Codex #27553 class of bug.
- Richer shell guidance: `&&`/`||` portability note, `nul` vs `/dev/null`, path quoting, pipe-after-cd caveat.
- Doctor now detects Windows Terminal (`wt`).
- Fixed phantom CHANGELOG entry: `windows_file_edit` (added 0.4.0, removed before 0.4.3) is no longer claimed as a current feature.

## 0.4.3 (2026-07-30)

### Improvements

- Bump shell-detect test timeout for GitHub CI.

## 0.4.2 (2026-07-30)

### Improvements

- Patch version bump for release sync and package documentation update.

## 0.4.1 (2026-07-24)

### Fixes

- Fixed YAML frontmatter parsing in skill definition.

## 0.4.0 (2026-07-16)

### Features & Security

- Hardened Windows path resolution, environment overrides, safety checks, and shell priority selection.
- Added `windows_file_edit` tool as a reliable Windows-native replacement for built-in edit. *(Note: removed before 0.4.3; no longer shipped.)*

## 0.2.0 (2026-07-10)

### Features

- Initial release of `pi-windows-tools` extension for Windows-native developer tooling, WSL support, and shell configuration.