# Changelog

All notable changes to pi-date-tail are recorded here. The format follows
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
[Semantic Versioning](https://semver.org/spec/v2.0.0.html) over the contract the README defines
(*Versioning*): the `PI_DATE_TAIL_TZ` variable, the persisted `date-tail` message type, and the
once-per-day behaviour. The message's exact wording is not part of it.

## [Unreleased]

## [v1.1.1] - 2026-11-09

### Security

- `load-smoke.mjs` replaced only the **first** `*` in an export target, and handed a
  specifier-derived string to `String.replace` as a replacement *pattern*, so a subpath containing
  `$&` or `` $` `` would be interpreted as a substitution. It now uses `replaceAll` with a function
  replacer, which fixes both halves (CodeQL `js/incomplete-sanitization`, high).

### Changed

- TypeScript 7.0.2, `@types/node` 24.19.2, and `actions/setup-node` 7.1.0 via Dependabot.

## [v1.1.0] - 2026-11-09

### Added

- A pi this package was not verified against now warns once per session instead of failing quietly later: the notice
  names the pi and the verified release lines. Verified lines are 1.2 through 1.5, and pi 1.5.0 was verified by the
  full suite, the load smoke and a real compaction run.
- Every pi internal this package reads is feature-detected (`src/pi-guard.ts`): an internal pi moves or drops warns
  once, naming it, and the one feature it backs degrades — the date still arrives, the duplicate check simply goes
  quiet. Before this, such a change produced an exception at the call site or, worse, a silently skipped check.

### Changed

- The vendored `@earendil-works/pi-coding-agent` moves from 1.2.0 to 1.5.0, so `npm test` runs against the pi in use.

## [v1.0.2] - 2026-10-13

### Changed

- Tested with pi 1.2.0, which the repository now vendors for its tests. No code changes: from pi 1.2.0 a run an
  extension's custom message starts gets the date message too, after that message, where earlier pi versions
  added it only to runs you started.

## [v1.0.1] - 2026-10-10

### Changed

- Tested with pi 0.87.1, 0.99.0, 0.99.1, 0.99.2, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4 and 1.1.0: the full suite and
  the real-pi smoke on each. The suite's vendored pi moves from 1.0.4 to 1.1.0. No code changes.
- Published from the release workflow through npm trusted publishing, so this version carries a provenance
  attestation linking it to its source commit. v1.0.0 was published by hand and has none.

## [v1.0.0] - 2026-10-10

### Added

- The calendar day as a hidden `date-tail` custom message appended after your prompt, once per calendar
  day per branch and again after a compaction that summarized it, never in the system prompt.
- `PI_DATE_TAIL_TZ`: the IANA zone whose day is given. Unset means the zone pi runs in (`TZ`, then the
  system's); a value that is not a zone name stops pi at launch, naming the variable and the value.
- The message names the zone and gives the command for the current time (`TZ=<zone> date`).
- A `date` section that an extension running earlier put in the system prompt wins: no message is added.
- A date message that the latest compaction kept (at or after its first kept entry) counts as present, so
  the next prompt adds no second copy. A kept message from an earlier day still gets today's added.
- CI on Linux, macOS and Windows: the tests; the entry loaded through pi's own extension loader (jiti); a real pi with
  a fake model, run both on the package as `npm pack` builds it, installed with `pi install` so pi finds it
  through the `pi.extensions` manifest and the `files` allowlist, and on the source; a secret scan, a workflow security audit (zizmor), Dependabot updates and a
  package-contents check. A nightly run against the newest pi; npm publishing by trusted publishing, then a GitHub Release carrying the tag's changelog notes.