# Changelog

All notable changes to this project are documented here. The format follows
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning follows
[SemVer](https://semver.org/).

## [0.4.0] — 2026-10-19

### Added

- The extension now publishes a footer/deck status under the `openappa` key
  (`ctx.ui.setStatus`): `starting` from session start, then `ok · gated`,
  `off · protection opted out`, `unreachable · <url>` / `· hook timeout`,
  `failing · <reason>`, or `needs attention · no policy, session unprotected`,
  refreshed from every hook outcome and `/appa status`. Status renderers
  (pi-stardeck's shield chip) treat silence as an error, so a session that
  never published showed a permanently red chip even while healthy. A policy
  denial is an answer — only transport-level failures degrade the status.
  Renderer contract and state table documented in docs/status-line.md.

### Fixed

- Parallel tool calls are no longer denied by the runtime: every PreToolUse
  and PostToolUse now carries the host-proposed `tool_use_id`. Calls without
  it are "unidentified" to the APPA runtime (only one outstanding at a
  time), so the second call of any parallel pair was denied with
  `a call without a host id is already outstanding…` — and an orphaned
  unidentified call could block every session on the runtime. Wire contract
  re-verified against appa 0.31.1 with concurrent probes; see the new
  "Call identification" section in docs/wire-notes.md.

## [0.3.3] — 2026-10-13

### Fixed

- Trusted-docs curl carve-outs are now **anchored** (`<domain>/*`): a
  substring-match trick (`docs.anthropic.com.evil.example/`, `…com:8443/`,
  userinfo `…com@evil/`) no longer lands in the trusted lane — those URLs
  fall through to the plain fetch rule and get labeled (external review
  catch, 2026-10-13).
- `mem_delete` joins the armed memory-tamper fence (consistency with
  `mem_save` / `mem_update` / `mem_capture_passive`).

### Changed

- The template header now carries a consolidated KNOWN HOLES list (selector
  text-matching/obfuscation, trusted local files & MCP descriptions, the
  docs-laundering path once narrowing returns, the write create/overwrite
  hole, destructive commands out of scope).

## [0.3.2] — 2026-10-09

### Fixed

- Repository, homepage, and bugs URLs in package metadata now point at the
  real repository (`aemonge/pi-openappa`; earlier releases linked a
  non-existent `aemonge-dev` path). Node engine floor declared (`>=22.18`,
  where TS type-stripping needs no flags).

### Changed

- **Starter policy: narrowing deltas stripped — they blocked live work.**
  The new integration tier (real runtime, real `appa hook`, no mocks)
  proved the live runtime confirmation-gates EVERY label narrowing,
  waiting for `appa/execute_remedy_plan` (an MCP tool Claude Code mounts
  and Pi does not): as shipped, web research and fetches were refused, and
  no fence could ever arm. The source deltas are removed (deny-undeclared
  remains live); the requires-trusted sink rules stay, armed and inert,
  with the full 0.4 fence map documented in the template. Traces and the
  integration suite now pin today's live truth deliberately.
- Community standards: CI (node matrix + a policy job running the gates,
  replays, coverage, and the live integration tier), CHANGELOG (shipped in
  the tarball), SECURITY.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md, issue/PR
  templates, dependabot, README badges.

### Added

- Strict lint tier: Biome with `noExplicitAny`, `noNonNullAssertion`,
  `noConsole`, unused-everything as errors — production and tests alike,
  zero suppressions; `just lint` / `just lint-fix`, wired into `just check`
  and CI. The mock's wire output moved from `console.*` to raw stdio
  writes (its bytes are the protocol under test). Dev dependency on the
  peer package exact-pinned to 1.0.4 after a transient `--no-package-lock`
  install drifted to 1.2.0 and changed event types mid-task.
- `just release`: one command — full gates including the live tier, npm
  publish, annotated `v<version>` tag, push; refuses existing tags and
  dirty trees.
- `just test-integration` / `APPA_INTEGRATION=1`: boots a real `appa
  runtime` with the starter policy and drives the extension end-to-end —
  the tier that caught the remedy-gating above (and two test-tier bugs:
  trajectories bleed across shared session ids; every allowed PreToolUse
  must be closed by its PostToolUse before the next opens).

## [0.3.1] — 2026-10-09

### Fixed

- The 0.3.0 tarball on npm was built before the default-on merge landed, so
  it shipped opt-in gating without the auto-installer. 0.3.1 is the merge
  described below.

## [0.3.0] — 2026-10-09

### Added

- Pi-native starter policy (`templates/appa.toml`): static rules only — no
  host-coupled annotators (they are unreachable under Pi), selectors spelled
  with Pi argument names (`path`, `command`), deny-undeclared, flow fences
  (web sources suspicious; edits, execution-later writes, publishing, and
  memory writes trusted-only; docs as the research landing zone;
  `redact-secrets` masking for credential reads).
- `/appa init [project] [--force]`: writes the starter policy (and
  `settings.json`) without clobbering; subcommand autocomplete for
  `on|off|init|init project|status`.
- Settings file `~/.config/pi-openappa/settings.json` (`config`,
  `runtimeUrl`, `hookBin`, `hookTimeoutMs`); env > project marker > settings.
- Background hook lane: `session_start` never awaits `--ensure-runtime` or
  the auto-install; ordering to the first `PreToolUse` is preserved.
- Policy-as-code gates: `just policy-check`, `just policy-coverage` (session
  toolset coverage, refusals fail), `just policy-test` (`appa replay` over
  `traces/*.appa` usage-day fixtures); all in `just check`.

## [0.2.0] — 2026-10-07

### Added

- Protection **on by default**, with opt-outs: `APPA_GATE=0`,
  `<project>/.pi/no-openappa`, and `/appa off` (global marker
  `~/.config/pi-openappa/off`); `/appa on` clears it (and the legacy
  always-on marker).
- Auto-install: a missing default `appa` binary is self-provisioned once via
  the official install script (`APPA_INSTALL_CMD`/`APPA_INSTALL_TIMEOUT_MS`
  to pin a mirror or timeout); custom `APPA_HOOK_BIN` is never auto-installed.
- First-run downgrade: with no policy anywhere and no runtime answering, the
  session runs unprotected with one warning instead of fail-closing an
  unconfigured machine.

## [0.1.0] — 2026-10-06

### Added

- Initial published extension: opt-in gating (`APPA_GATE=1`,
  `<project>/.pi/openappa`, `/appa on`), the Claude-Code codec adapter, the
  hook client, fail-closed enforcement with reasons to the model, and the
  verified wire notes (`docs/wire-notes.md`).