# Changelog

## 0.5.7 (2026-09-21)

### Fixed

- **First npm release since 0.5.4.** pi-windows-tools was missing from the CI
  paths-filter and matrix, so 0.5.5 (session-allow keying security fix) and
  0.5.6 (`windowsHide`, `--force-with-lease` safety rule, dead-code sweep,
  SKILL.md audit-log row) shipped to git but never published. The CI matrix
  now includes the package; this release carries all three versions.

## 0.5.6 (2026-09-20)

### Fixed

- `executeCommand` now spawns with `windowsHide: true` — a console window no
  longer flashes on every command (the `stop()` taskkill path already had it).
- The force-push safety rule no longer flags `git push --force-with-lease`
  (with or without `=value`) — the safe lease-checked variant now classifies
  as safe; bare `--force` / `-f` still require confirmation.
- SKILL.md tool table now lists `windows_audit_log`.

### Removed

- Dead export `getAvailableShells` (shell-detect.ts) — only its own test
  referenced it; the test was removed with it.

## 0.5.5 (2026-09-18)

### Fixed — session-allow keying for destructive commands

- **"Allow for this session" for destructive-classified commands is now keyed
  by the full normalized command (was: bare first token).** Approving
  `rm -r build` added allowKey `rm`, which silently bypassed the danger gate
  for EVERY later `rm` payload (`rm -rf C:\` included). Direct destructive
  commands now remember only the exact approved command; re-running the exact
  same command stays suppressed.
- Interpreter wrapper set extended with `sudo`, `start`, `mshta`, `rundll32`,
  and `cscript` — payloads behind these wrappers already keyed by full
  command and now cover the wrapper too.
- Package managers (`npm`/`pnpm`/`yarn`) keep first-token keying: approving
  `npm publish` still covers `npm publish --tag next` (existing tested
  behavior, unchanged).

## 0.5.4 (2026-09-12)

### Fixed — safety classification

- **Recursive delete without a force flag now requires confirmation.**
  `Remove-Item -Recurse` (no `-Force`), `rm -r` / `rm --recursive` (no force),
  and `del /s` / `rmdir /s` / `rd /s` (no `/q`) previously classified as
  **safe** because the two delete rules required recursion AND force. Both
  rules now trigger on recursion alone — force only makes a recursive delete
  worse, it was never what made it dangerous.
  The explicit match covers `-Recurse` and its unambiguous PowerShell
  abbreviations (`-rec`, `-recu`, `-recurs`); the short-flag match is limited
  to POSIX-shaped clusters (`-r`, `-R`, `-rf`, `-fr`) so force-only
  non-recursive deletes (`Remove-Item -Force file.dll`, `-Filter`) stay safe,
  and PowerShell aliases of `Remove-Item` (`ri`, `del`, `erase`, `rd`) with
  `-Recurse` are covered too. Flags don't leak across newlines when classifying
  multi-line commands.

### Fixed — shell execution

- Spawn failures now surface the OS error: `Failed to spawn <exe>: <message>`
  (e.g. the ENOENT) instead of the bare "Failed to spawn process".

## 0.5.3 (2026-08-17)

### Improvements

- Dangerous-command confirmation is now a single select — **Allow once / Allow for this session / Deny** — instead of a yes/no confirm repeated per command. Long commands are clipped to 120 chars.
- Session-allow keys are hardened: interpreter/wrapper executables (powershell, pwsh, cmd, wsl, node, …, or any `*.exe`) are keyed by the **full command** — one approval cannot silence the danger-classification gate for a different payload behind the same interpreter. Ordinary executables stay keyed by first token.

## 0.5.2 (2026-08-05)

### Improvements

- Patch version bump for release sync and package documentation update.

## 0.5.1 (2026-08-04)

### Improvements

- **`windows_shell_exec` guidance softened.** The tool is no longer pitched as "use instead of generic bash" — its prompt guidelines now direct the model to use it for PowerShell/cmd/WSL-native commands, and to prefer plain `bash` for read-only inspection (which runs automatically in plan mode without a confirmation prompt). Reduces unnecessary confirm prompts in plan mode.

All notable changes to `pi-windows-tools` will be documented in this file.

## 0.5.0 (2026-08-02)

### Features & Fixes

- Stream command output via `onUpdate` (throttled live output, like Claude Code/Codex) — `windows_shell_exec` no longer buffers silently until exit.
- PowerShell `-EncodedCommand` fallback for multi-line / long commands (robust parsing where `-Command` mis-tokenizes).
- WSL UNC path support (`\\wsl.localhost\<distro>\<path>`, `\\wsl$\<distro>\<path>`) via `parseWslUncPath` — closes the Codex #27553 class of bug.
- Richer shell guidance: `&&`/`||` portability note, `nul` vs `/dev/null`, path quoting, pipe-after-cd caveat.
- Doctor now detects Windows Terminal (`wt`).
- Fixed phantom CHANGELOG entry: `windows_file_edit` (added 0.4.0, removed before 0.4.3) is no longer claimed as a current feature.

## 0.4.3 (2026-07-30)

### Improvements

- Bump shell-detect test timeout for GitHub CI.

## 0.4.2 (2026-07-30)

### Improvements

- Patch version bump for release sync and package documentation update.

## 0.4.1 (2026-07-24)

### Fixes

- Fixed YAML frontmatter parsing in skill definition.

## 0.4.0 (2026-07-16)

### Features & Security

- Hardened Windows path resolution, environment overrides, safety checks, and shell priority selection.
- Added `windows_file_edit` tool as a reliable Windows-native replacement for built-in edit. *(Note: removed before 0.4.3; no longer shipped.)*

## 0.2.0 (2026-07-10)

### Features

- Initial release of `pi-windows-tools` extension for Windows-native developer tooling, WSL support, and shell configuration.