# Changelog

All notable changes to the `codexpethub` CLI are documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and the package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [0.1.0] — 2026-05-03

### Added

- Initial public release of the `codexpethub` CLI.
- `codexpethub install <slug>` — fetches the public install manifest from
  `codexpethub.com`, downloads `pet.json` and `spritesheet.webp` to a temp
  directory, verifies sha256 against the manifest, validates WebP magic bytes,
  enforces per-role size caps, and atomically moves the verified files into
  `~/.codex/pets/<slug>/`.
- Host allow-list locked to `codexpethub.com` and `assets.codexpethub.com` for
  production downloads, with HTTP/HTTPS loopback (`localhost`, `127.0.0.1`,
  `::1`) permitted for local development and CI fixtures.
- `--codex-home <path>` flag overrides the install root (default:
  `$CODEX_HOME` or `~/.codex`).
- `--overwrite` flag replaces an existing install instead of refusing.
- `--registry-url <url>` flag points the CLI at a staging or test registry,
  subject to the same allow-list.
- Documented exit codes: `0` success, `1` sha mismatch / invalid WebP /
  manifest invalid, `2` size cap exceeded, `3` host allow-list violation,
  `4` existing install dir without `--overwrite`, `5` network error,
  `64` usage error.
- Zero runtime dependencies — Node.js 18+ builtins only.

[0.1.0]: https://github.com/CodexPetHub/CodexPetHub/releases/tag/cli-v0.1.0