# Changelog

## Unreleased

## 0.3.0 — 2026-10-27

- **Checkpoints expire after `storeMaxAgeDays` in every session, and the default is 7 days (was 30).** Before, retention trimmed only the session that took a checkpoint. The checkpoints and journals of earlier sessions stayed as long as their store was in use, so the store of a project you use every day grew without bound. Now a checkpoint older than `storeMaxAgeDays` is deleted with its journal and the objects only it held: at session start in every store, and after each run in the current one. `keepRuns` still caps each session, and stores unused for `storeMaxAgeDays` are still deleted. The first session after the update deletes the checkpoints older than 7 days; set `storeMaxAgeDays` to keep more.
- Fixed: a project that contains π's agent directory (one that versions `~/.pi/agent` in git) snapshotted the stores. Each snapshot copied every store, its own packs included, into its store: one such store reached 1.2 GB with a single checkpoint. An `/undo` in that project could also rewrite or delete store files. Now the stores are never staged, entries an earlier version staged leave the next snapshot, a restore never writes inside the stores, and `stores/.gitignore` keeps them out of the project's git. To get the space back at once, delete that project's store under `~/.pi/agent/pi-edit-guard/stores/` (its `ROOT` file names the project).
- Fixed: a file that an ignore rule matched after a snapshot took it (a new `.gitignore` line, an `exclude` pattern) stayed in every later snapshot, and each change to it was stored again. It now leaves the next snapshot, as the documented domain says. So a new `exclude` pattern shrinks a store once the checkpoints that hold the file expire. `/undo` restores such a file from the checkpoints that hold it, and leaves it alone when it has not changed.
- Fixed: `/undo` of an earlier run did not restore an ignored file that only a later checkpoint held, after a shell deleted it.

## 0.2.0 — 2026-10-22

- **Bundled Agent Skill** `edit-guard` (`/skill:edit-guard`). The model loads it on demand to explain each `edit-guard:` message and what to do, and to point you to `/undo` when you ask it to revert its work, instead of running `git checkout`, `git stash` or `git reset`. It documents every command and configuration key. The `pi` manifest declares it, so the π catalog lists the package as an extension and a skill.
- **OpenSSF.** The README shows the OpenSSF Scorecard badge. `.github/security-insights.yml` gives the project's security facts in the OpenSSF Security Insights 2.2.0 format, validated against the official schema. `.bestpractices.json` holds the evidence for 65 of the 67 OpenSSF Best Practices "passing" criteria and 22 of the 24 Baseline level 1 controls; bestpractices.dev reads it to fill in the badge application.
- **Discoverability.** A landing site at <https://jlrrequina.github.io/pi-edit-guard/> with Open Graph and Twitter cards, `SoftwareApplication`, `SoftwareSourceCode` and `FAQPage` structured data and a sitemap, published by a pinned Pages workflow. `llms.txt` (llmstxt.org format) in the package and on the site. A cover image for the π catalog, the README and link previews. A README tagline, badges, an FAQ and links; more npm keywords; the npm homepage is the site.
- Fixed: the README linked `CONTRIBUTING.md` and `SECURITY.md` relatively. The π catalog resolves relative links against the published package, which does not contain those files, so both links returned 404. They are absolute now, and a test rejects a relative link to a file that is not published.
- Tests guard the metadata: π's loader accepts the skill, and the skill documents every command, message and configuration key; the FAQ is the same in the README, the site and its structured data; the site, the sitemap and the Pages workflow agree; `llms.txt`, the Security Insights file and the Best Practices answers link only to files that exist; the tarball smoke test requires the skill and `llms.txt`.

## 0.1.0 — 2026-10-22

First release.

- **Freshness.** `edit` and `write` (and `lsp_fix` with `write: true`, when installed) are blocked on an existing file unless the agent's last read of it is still in the model's context and the file's content hash still matches: "exists but was not read in this context" or "changed since you read it (call #N)". New files pass. Paths resolve exactly as π's tools resolve them, through symlinks. Observations are stored in the session and rebuilt from π's projection on resume, fork, `/tree`, compaction and context edits.
- **Snapshots and `/undo`.** Before the first call of a run that can change files, the project root is snapshotted into a private git store under `~/.pi/agent/pi-edit-guard/` (never the project's `.git`), with a persistent private index and packed objects. The first snapshot of a root runs in the background from the session's first prompt. Write-tool targets the snapshot does not hold (ignored files, files outside the root) are journaled. `/undo [n | pre-undo-<k>] [--yes]` previews and restores content, executable bits, symlinks and the case of names exactly (also on case-insensitive file systems), deletes files created since, and makes a pre-undo checkpoint first, so an undo can be reversed. `/checkpoints` lists the checkpoints. Retention keeps 20 runs per session; stores unused for 30 days, or whose project was deleted, are removed.
- **Loop breaker.** A third identical call with nothing changed in between is blocked for tools that depend only on the files and flagged for the rest; a command that fails again after changes gets a notice from the second failure. Blocked calls, also those blocked by another extension, do not count as changes.
- **Windows.** Works on Windows with Git for Windows (which "Git Bash only" installs leave off the `PATH`). Symlinks restore with the type of their target; without Developer Mode or administrator rights the `/undo` preview names the symlinks it cannot restore. Files held open by a virus scanner or an indexer are retried, and read-only files are replaced. Directory junctions are not followed into the snapshot.
- `/guard` reports the coverage and switches each part on or off for the session; `~/.pi/agent/pi-edit-guard/config.json` configures the tool classes, limits and retention; `PI_EDIT_GUARD_DEBUG=1` logs every decision.
- Tested on Linux, macOS and Windows with a property test (300 random trees and mutations per run, with and without git, case-only renames included, restore and redo exact), integration tests against π's session manager and tools, a run inside a real π session (SDK, faux model, codemode), a live `pi -p` run, and on nine public repositories (`npm run corpus`).