diff --git a/.changeset/ajv-lazy-seam.md b/.changeset/ajv-lazy-seam.md deleted file mode 100644 index c0bc829a5..000000000 --- a/.changeset/ajv-lazy-seam.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@skill-map/cli': patch ---- - -AJV now loads lazily through a synchronous `createRequire` seam in the kernel's ajv-interop helper (every construction site was already function-local, so no signatures changed), stays external to the dist bundle, and the user-settings store validates `~/.skill-map/settings.json` against its own single compiled schema instead of the full spec validator catalog. The five bundled boot deps (clipanion, smol-toml, js-yaml, semver, ignore) moved to devDependencies; installs no longer download them. diff --git a/.changeset/capture-level-ladder.md b/.changeset/capture-level-ladder.md deleted file mode 100644 index f9a1db2eb..000000000 --- a/.changeset/capture-level-ladder.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@skill-map/spec': minor -'@skill-map/cli': minor ---- - -New capture-level ladder: one cumulative runtime knob (`executions` < `reads` < `writes` < `mcp` < `shell`, default `mcp`) filtering resolved activity at ingest before stats, journal and broadcast, moved live via `POST /api/activity/capture-level` and persisted project-local (`activity.captureLevel`). Adapters now stamp `access: "write"` on write-shaped tools, recordings carry their minimum `captureLevel`, and the UI gains a selector beside Record plus a Settings mirror. - -## User-facing - -A capture-level selector next to Record (and in Settings) decides how much detail the live map and recordings keep, from executions only up to reads, writes and MCP calls, chosen before each recording (it locks while one runs). Writes now show as their own access type. diff --git a/.changeset/cli-version-gate-and-locked-shell-tooltip.md b/.changeset/cli-version-gate-and-locked-shell-tooltip.md deleted file mode 100644 index 5d835f31e..000000000 --- a/.changeset/cli-version-gate-and-locked-shell-tooltip.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@skill-map/spec': patch -'@skill-map/cli': patch ---- - -The browser-storage reset gate now keys on the serving CLI version: `sm serve` (and the demo bundle) stamps a second `skill-map-version` meta, documented in the CLI contract's serve row, and upgrades wipe only what a crossed layout-break threshold declares, so a normal release keeps saved state. The locked Shell capture option is no longer natively disabled: it renders muted, refuses the click, and its tooltip explains where to enable it. - -## User-facing - -**The greyed-out Shell option now explains itself.** Hover it to see how to enable it (Settings > Project > Capture level). And upgrading the CLI no longer resets your saved layout and recordings unless the release actually changed how they are stored. diff --git a/.changeset/demo-session-replay.md b/.changeset/demo-session-replay.md deleted file mode 100644 index f1c1f98a0..000000000 --- a/.changeset/demo-session-replay.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@skill-map/web': patch ---- - -The public demo's Sessions tab now ships a curated session recording of the demo fixture (a `/publish` run) and can REPLAY it on the map: the demo bundle bakes `sessions.json` next to `data.json`, and the replay lens (pure client-side playback over recorded frames) is available in demo mode while live watching and recording stay honestly disabled. diff --git a/.changeset/journal-retention-config.md b/.changeset/journal-retention-config.md deleted file mode 100644 index c5977452d..000000000 --- a/.changeset/journal-retention-config.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@skill-map/spec': minor -'@skill-map/cli': minor ---- - -The session-journal retention ceilings are now project-config keys beside the master switch: `activity.journal.maxFiles` (default 50) and `activity.journal.maxTotalBytes` (default 20 MiB), read once at serve boot and applied oldest-first at boot and each finalization. The journal is the evidence window the observed-* volume gates count against, so keep `maxFiles` at or above the largest `min-active-sessions` in use. - -## User-facing - -You can now decide how many recorded sessions the project keeps (`activity.journal.maxFiles` / `maxTotalBytes` in settings.json): raise them if your never-runs detector needs a longer memory than the default 50 sessions. diff --git a/.changeset/perf-followup-streaming-fp-bundled-boot.md b/.changeset/perf-followup-streaming-fp-bundled-boot.md deleted file mode 100644 index dd286e350..000000000 --- a/.changeset/perf-followup-streaming-fp-bundled-boot.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@skill-map/cli': patch ---- - -Perf follow-up: the scan result fingerprint now hashes through a streaming canonical writer (no multi-MB intermediate string per warm scan), and the pure-JS boot dependencies (clipanion, smol-toml, js-yaml, semver, ignore) are bundled into the dist chunks, cutting eager module loads on startup from ~45 to 14 and `sm --version` to ~135 ms on the reference machine. diff --git a/.changeset/perf-sprint-scan-startup.md b/.changeset/perf-sprint-scan-startup.md deleted file mode 100644 index cfd5093b1..000000000 --- a/.changeset/perf-sprint-scan-startup.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -'@skill-map/cli': patch ---- - -Node perf sprint: the tokenizer moved to `gpt-tokenizer` behind a lazy handle (identical counts; a literal `<|endoftext|>` in prose no longer aborts the scan), warm rescans skip the SQLite replace-all via a whole-result fingerprint in `scan_meta` (schema fingerprint changes, so the derived DB rebuilds once after upgrading), the walk overlaps file reads with an ordered 16-deep read-ahead, and startup defers the kysely/sqlite, watcher and conformance subgraphs and enables the V8 compile cache. - -## User-facing - -Everything got faster: `sm` starts in about half the time, scans are quicker, and rescans of an unchanged project skip most database work. A file containing the literal text `<|endoftext|>` no longer breaks the scan. The project database rebuilds itself once after updating. diff --git a/.changeset/replay-scope-chip-session-title.md b/.changeset/replay-scope-chip-session-title.md deleted file mode 100644 index 161ba55c3..000000000 --- a/.changeset/replay-scope-chip-session-title.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -'@skill-map/cli': patch ---- - -The replay transport's scope chip now shows the session title (the touched-node names) instead of the short session id across the three Sessions-tab entry points (Play session, Play agent, step deep-link). The chip gained a full-label tooltip and a working ellipsis (as a non-shrinking flex item it used to overflow the fixed-width row), and the transport bar widened from 26rem to 30rem. - -## User-facing - -**Replay names the session.** The floating replay bar now labels a replay with the session's title, the same skill and agent names you see in the Sessions tab, instead of a short id. Long titles clip with an ellipsis and the full name shows in a tooltip. diff --git a/.changeset/scoped-browser-storage.md b/.changeset/scoped-browser-storage.md deleted file mode 100644 index 48a49fb72..000000000 --- a/.changeset/scoped-browser-storage.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@skill-map/spec': patch -'@skill-map/cli': minor ---- - -Browser-local project state (recording tape, node positions, map curation) is now namespaced per project: `sm serve` stamps the scope root into the served `index.html` as a `skill-map-scope` meta and the UI suffixes those localStorage keys with a hash of it, so two projects on one port stop seeing each other's sessions. A `sm.storage-version` gate resets stale layouts per-bump (this one wipes the pre-namespace era whole); `sm.scopes` maps hash to root for debugging. - -## User-facing - -Recorded sessions and your map layout now stay with their project: serving another folder on the same port no longer shows the other project's recordings. One-time cost on upgrade: node positions, curation and the browser tape reset (recordings on disk are kept). diff --git a/.changeset/sessions-intro-note.md b/.changeset/sessions-intro-note.md deleted file mode 100644 index 830bf46db..000000000 --- a/.changeset/sessions-intro-note.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@skill-map/spec': minor -'@skill-map/cli': minor ---- - -The Sessions tab gains a one-time intro note above the Record control stating what recordings are NOT (content-free: structure and timing, never prompts, file contents or results), dismissible machine-wide via the new `ui.dismissedNotes` list in the per-user settings file (`~/.skill-map/settings.json`), carried by the `GET`/`PATCH /api/preferences` envelope. - -## User-facing - -A small note above Record now explains that session recordings are content-free (what ran and when, never your prompts, files or results). Close it once and it stays closed on every project on this machine. diff --git a/.changeset/shell-capture-rung.md b/.changeset/shell-capture-rung.md deleted file mode 100644 index 24de66a88..000000000 --- a/.changeset/shell-capture-rung.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@skill-map/spec': minor -'@skill-map/cli': minor ---- - -The capture ladder's `shell` rung is live, double opt-in: `sm activity install claude --shell` persists the project-local `activity.shellCapture` key and renders an extra `PreToolUse` Bash hook (`--no-shell` or `activity uninstall` retires it, demoting a stored `shell` level to `mcp`), and the capture-level POST refuses `shell` while the key is off. Bash commands naming in-scope `.md` files yield path sightings (`access: "shell"`); the command text is never captured. Claude-only for now. - -## User-facing - -Recordings can now spot docs touched from shell commands: opt in with `sm activity install claude --shell`, then pick the Shell capture level. Only file paths are kept, never the commands themselves, and the fifth selector position stays locked until you opt in. diff --git a/.changeset/tokenizer-encoding-descriptions.md b/.changeset/tokenizer-encoding-descriptions.md deleted file mode 100644 index ac29de20e..000000000 --- a/.changeset/tokenizer-encoding-descriptions.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@skill-map/spec': patch ---- - -The `node.schema.json` and `project-config.schema.json` description strings now name the supported token encodings (`cl100k_base`, `o200k_base`) instead of the `js-tiktoken` library, which the CLI no longer uses; the enum and every normative shape are unchanged. diff --git a/CHANGELOG.md b/CHANGELOG.md index 2aff54b3a..574d618b7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,36 @@ > Forward-looking plan: [`ROADMAP.md`](./ROADMAP.md).
+1.12.0 · 2026-08-17 + +### CLI Minor +- New capture-level ladder: one cumulative runtime knob (`executions` < `reads` < `writes` < `mcp` < `shell`, default `mcp`) filtering resolved activity at ingest before stats, journal and broadcast, moved live via `POST /api/activity/capture-level` and persisted project-local (`activity.captureLevel`). Adapters now stamp `access: "write"` on write-shaped tools, recordings carry their minimum `captureLevel`, and the UI gains a selector beside Record plus a Settings mirror. +- The session-journal retention ceilings are now project-config keys beside the master switch: `activity.journal.maxFiles` (default 50) and `activity.journal.maxTotalBytes` (default 20 MiB), read once at serve boot and applied oldest-first at boot and each finalization. The journal is the evidence window the observed-* volume gates count against, so keep `maxFiles` at or above the largest `min-active-sessions` in use. +- Browser-local project state (recording tape, node positions, map curation) is now namespaced per project: `sm serve` stamps the scope root into the served `index.html` as a `skill-map-scope` meta and the UI suffixes those localStorage keys with a hash of it, so two projects on one port stop seeing each other's sessions. A `sm.storage-version` gate resets stale layouts per-bump (this one wipes the pre-namespace era whole); `sm.scopes` maps hash to root for debugging. +- The Sessions tab gains a one-time intro note above the Record control stating what recordings are NOT (content-free: structure and timing, never prompts, file contents or results), dismissible machine-wide via the new `ui.dismissedNotes` list in the per-user settings file (`~/.skill-map/settings.json`), carried by the `GET`/`PATCH /api/preferences` envelope. +- The capture ladder's `shell` rung is live, double opt-in: `sm activity install claude --shell` persists the project-local `activity.shellCapture` key and renders an extra `PreToolUse` Bash hook (`--no-shell` or `activity uninstall` retires it, demoting a stored `shell` level to `mcp`), and the capture-level POST refuses `shell` while the key is off. Bash commands naming in-scope `.md` files yield path sightings (`access: "shell"`); the command text is never captured. Claude-only for now. + +### CLI Patch +- AJV now loads lazily through a synchronous `createRequire` seam in the kernel's ajv-interop helper (every construction site was already function-local, so no signatures changed), stays external to the dist bundle, and the user-settings store validates `~/.skill-map/settings.json` against its own single compiled schema instead of the full spec validator catalog. The five bundled boot deps (clipanion, smol-toml, js-yaml, semver, ignore) moved to devDependencies; installs no longer download them. +- The browser-storage reset gate now keys on the serving CLI version: `sm serve` (and the demo bundle) stamps a second `skill-map-version` meta, documented in the CLI contract's serve row, and upgrades wipe only what a crossed layout-break threshold declares, so a normal release keeps saved state. The locked Shell capture option is no longer natively disabled: it renders muted, refuses the click, and its tooltip explains where to enable it. +- Perf follow-up: the scan result fingerprint now hashes through a streaming canonical writer (no multi-MB intermediate string per warm scan), and the pure-JS boot dependencies (clipanion, smol-toml, js-yaml, semver, ignore) are bundled into the dist chunks, cutting eager module loads on startup from ~45 to 14 and `sm --version` to ~135 ms on the reference machine. +- Node perf sprint: the tokenizer moved to `gpt-tokenizer` behind a lazy handle (identical counts; a literal `<|endoftext|>` in prose no longer aborts the scan), warm rescans skip the SQLite replace-all via a whole-result fingerprint in `scan_meta` (schema fingerprint changes, so the derived DB rebuilds once after upgrading), the walk overlaps file reads with an ordered 16-deep read-ahead, and startup defers the kysely/sqlite, watcher and conformance subgraphs and enables the V8 compile cache. +- The replay transport's scope chip now shows the session title (the touched-node names) instead of the short session id across the three Sessions-tab entry points (Play session, Play agent, step deep-link). The chip gained a full-label tooltip and a working ellipsis (as a non-shrinking flex item it used to overflow the fixed-width row), and the transport bar widened from 26rem to 30rem. + +### Spec Minor (1.12.0) +- New capture-level ladder: one cumulative runtime knob (`executions` < `reads` < `writes` < `mcp` < `shell`, default `mcp`) filtering resolved activity at ingest before stats, journal and broadcast, moved live via `POST /api/activity/capture-level` and persisted project-local (`activity.captureLevel`). Adapters now stamp `access: "write"` on write-shaped tools, recordings carry their minimum `captureLevel`, and the UI gains a selector beside Record plus a Settings mirror. +- The session-journal retention ceilings are now project-config keys beside the master switch: `activity.journal.maxFiles` (default 50) and `activity.journal.maxTotalBytes` (default 20 MiB), read once at serve boot and applied oldest-first at boot and each finalization. The journal is the evidence window the observed-* volume gates count against, so keep `maxFiles` at or above the largest `min-active-sessions` in use. +- The Sessions tab gains a one-time intro note above the Record control stating what recordings are NOT (content-free: structure and timing, never prompts, file contents or results), dismissible machine-wide via the new `ui.dismissedNotes` list in the per-user settings file (`~/.skill-map/settings.json`), carried by the `GET`/`PATCH /api/preferences` envelope. +- The capture ladder's `shell` rung is live, double opt-in: `sm activity install claude --shell` persists the project-local `activity.shellCapture` key and renders an extra `PreToolUse` Bash hook (`--no-shell` or `activity uninstall` retires it, demoting a stored `shell` level to `mcp`), and the capture-level POST refuses `shell` while the key is off. Bash commands naming in-scope `.md` files yield path sightings (`access: "shell"`); the command text is never captured. Claude-only for now. + +### Spec Patch (1.12.0) +- The browser-storage reset gate now keys on the serving CLI version: `sm serve` (and the demo bundle) stamps a second `skill-map-version` meta, documented in the CLI contract's serve row, and upgrades wipe only what a crossed layout-break threshold declares, so a normal release keeps saved state. The locked Shell capture option is no longer natively disabled: it renders muted, refuses the click, and its tooltip explains where to enable it. +- Browser-local project state (recording tape, node positions, map curation) is now namespaced per project: `sm serve` stamps the scope root into the served `index.html` as a `skill-map-scope` meta and the UI suffixes those localStorage keys with a hash of it, so two projects on one port stop seeing each other's sessions. A `sm.storage-version` gate resets stale layouts per-bump (this one wipes the pre-namespace era whole); `sm.scopes` maps hash to root for debugging. +- The `node.schema.json` and `project-config.schema.json` description strings now name the supported token encodings (`cl100k_base`, `o200k_base`) instead of the `js-tiktoken` library, which the CLI no longer uses; the enum and every normative shape are unchanged. + +
+ +
1.11.0 · 2026-08-17 ### CLI Minor diff --git a/spec/CHANGELOG.md b/spec/CHANGELOG.md index b50170a0e..460753dec 100644 --- a/spec/CHANGELOG.md +++ b/spec/CHANGELOG.md @@ -1,5 +1,49 @@ # Spec changelog +## 1.12.0 + +### Minor Changes + +- New capture-level ladder: one cumulative runtime knob (`executions` < `reads` < `writes` < `mcp` < `shell`, default `mcp`) filtering resolved activity at ingest before stats, journal and broadcast, moved live via `POST /api/activity/capture-level` and persisted project-local (`activity.captureLevel`). Adapters now stamp `access: "write"` on write-shaped tools, recordings carry their minimum `captureLevel`, and the UI gains a selector beside Record plus a Settings mirror. + + ## User-facing + + A capture-level selector next to Record (and in Settings) decides how much detail the live map and recordings keep, from executions only up to reads, writes and MCP calls, chosen before each recording (it locks while one runs). Writes now show as their own access type. + +- The session-journal retention ceilings are now project-config keys beside the master switch: `activity.journal.maxFiles` (default 50) and `activity.journal.maxTotalBytes` (default 20 MiB), read once at serve boot and applied oldest-first at boot and each finalization. The journal is the evidence window the observed-* volume gates count against, so keep `maxFiles` at or above the largest `min-active-sessions` in use. + + ## User-facing + + You can now decide how many recorded sessions the project keeps (`activity.journal.maxFiles` / `maxTotalBytes` in settings.json): raise them if your never-runs detector needs a longer memory than the default 50 sessions. + +- The Sessions tab gains a one-time intro note above the Record control stating what recordings are NOT (content-free: structure and timing, never prompts, file contents or results), dismissible machine-wide via the new `ui.dismissedNotes` list in the per-user settings file (`~/.skill-map/settings.json`), carried by the `GET`/`PATCH /api/preferences` envelope. + + ## User-facing + + A small note above Record now explains that session recordings are content-free (what ran and when, never your prompts, files or results). Close it once and it stays closed on every project on this machine. + +- The capture ladder's `shell` rung is live, double opt-in: `sm activity install claude --shell` persists the project-local `activity.shellCapture` key and renders an extra `PreToolUse` Bash hook (`--no-shell` or `activity uninstall` retires it, demoting a stored `shell` level to `mcp`), and the capture-level POST refuses `shell` while the key is off. Bash commands naming in-scope `.md` files yield path sightings (`access: "shell"`); the command text is never captured. Claude-only for now. + + ## User-facing + + Recordings can now spot docs touched from shell commands: opt in with `sm activity install claude --shell`, then pick the Shell capture level. Only file paths are kept, never the commands themselves, and the fifth selector position stays locked until you opt in. + +### Patch Changes + +- The browser-storage reset gate now keys on the serving CLI version: `sm serve` (and the demo bundle) stamps a second `skill-map-version` meta, documented in the CLI contract's serve row, and upgrades wipe only what a crossed layout-break threshold declares, so a normal release keeps saved state. The locked Shell capture option is no longer natively disabled: it renders muted, refuses the click, and its tooltip explains where to enable it. + + ## User-facing + + **The greyed-out Shell option now explains itself.** Hover it to see how to enable it (Settings > Project > Capture level). And upgrading the CLI no longer resets your saved layout and recordings unless the release actually changed how they are stored. + +- Browser-local project state (recording tape, node positions, map curation) is now namespaced per project: `sm serve` stamps the scope root into the served `index.html` as a `skill-map-scope` meta and the UI suffixes those localStorage keys with a hash of it, so two projects on one port stop seeing each other's sessions. A `sm.storage-version` gate resets stale layouts per-bump (this one wipes the pre-namespace era whole); `sm.scopes` maps hash to root for debugging. + + ## User-facing + + Recorded sessions and your map layout now stay with their project: serving another folder on the same port no longer shows the other project's recordings. One-time cost on upgrade: node positions, curation and the browser tape reset (recordings on disk are kept). + +- The `node.schema.json` and `project-config.schema.json` description strings now name the supported token encodings (`cl100k_base`, `o200k_base`) instead of the `js-tiktoken` library, which the CLI no longer uses; the enum and every normative shape are unchanged. + ## 1.11.0 ### Minor Changes diff --git a/spec/index.json b/spec/index.json index 6e1a01a3a..c0c7e2a57 100644 --- a/spec/index.json +++ b/spec/index.json @@ -476,11 +476,11 @@ } ] }, - "specPackageVersion": "1.11.0", + "specPackageVersion": "1.12.0", "integrity": { "algorithm": "sha256", "files": { - "CHANGELOG.md": "17a255d2fbe31ba19db59f20de896d4e537582f1ade37f9b7ee9607b556851a0", + "CHANGELOG.md": "b37b4655c9b1fc063293ea3b109b3013ecbf09363ce67ec429753f73684010eb", "README.md": "35ac6cc3ce8379c5087f739a528d3b80a140aef5cdeeba9c49b59c5dd5df4c54", "architecture.md": "20cb9a20ef6218bcbbde99fd81011f1ed216545e5c2cd085c508d6bcbc6144a5", "cli-contract.md": "958ed2df1bee33ce89275e5a8493e74bfe00104d3a5061e1e1d3685eecdf7d61", diff --git a/spec/package.json b/spec/package.json index 20503c584..4823b1a7d 100644 --- a/spec/package.json +++ b/spec/package.json @@ -1,6 +1,6 @@ { "name": "@skill-map/spec", - "version": "1.11.0", + "version": "1.12.0", "description": "JSON Schemas, prose contracts, and conformance suite for the skill-map specification.", "license": "MIT", "type": "module", diff --git a/src/CHANGELOG.md b/src/CHANGELOG.md index 9caf3cd2a..6bc0355ec 100644 --- a/src/CHANGELOG.md +++ b/src/CHANGELOG.md @@ -1,5 +1,63 @@ # skill-map +## 1.12.0 + +### Minor Changes + +- New capture-level ladder: one cumulative runtime knob (`executions` < `reads` < `writes` < `mcp` < `shell`, default `mcp`) filtering resolved activity at ingest before stats, journal and broadcast, moved live via `POST /api/activity/capture-level` and persisted project-local (`activity.captureLevel`). Adapters now stamp `access: "write"` on write-shaped tools, recordings carry their minimum `captureLevel`, and the UI gains a selector beside Record plus a Settings mirror. + + ## User-facing + + A capture-level selector next to Record (and in Settings) decides how much detail the live map and recordings keep, from executions only up to reads, writes and MCP calls, chosen before each recording (it locks while one runs). Writes now show as their own access type. + +- The session-journal retention ceilings are now project-config keys beside the master switch: `activity.journal.maxFiles` (default 50) and `activity.journal.maxTotalBytes` (default 20 MiB), read once at serve boot and applied oldest-first at boot and each finalization. The journal is the evidence window the observed-* volume gates count against, so keep `maxFiles` at or above the largest `min-active-sessions` in use. + + ## User-facing + + You can now decide how many recorded sessions the project keeps (`activity.journal.maxFiles` / `maxTotalBytes` in settings.json): raise them if your never-runs detector needs a longer memory than the default 50 sessions. + +- Browser-local project state (recording tape, node positions, map curation) is now namespaced per project: `sm serve` stamps the scope root into the served `index.html` as a `skill-map-scope` meta and the UI suffixes those localStorage keys with a hash of it, so two projects on one port stop seeing each other's sessions. A `sm.storage-version` gate resets stale layouts per-bump (this one wipes the pre-namespace era whole); `sm.scopes` maps hash to root for debugging. + + ## User-facing + + Recorded sessions and your map layout now stay with their project: serving another folder on the same port no longer shows the other project's recordings. One-time cost on upgrade: node positions, curation and the browser tape reset (recordings on disk are kept). + +- The Sessions tab gains a one-time intro note above the Record control stating what recordings are NOT (content-free: structure and timing, never prompts, file contents or results), dismissible machine-wide via the new `ui.dismissedNotes` list in the per-user settings file (`~/.skill-map/settings.json`), carried by the `GET`/`PATCH /api/preferences` envelope. + + ## User-facing + + A small note above Record now explains that session recordings are content-free (what ran and when, never your prompts, files or results). Close it once and it stays closed on every project on this machine. + +- The capture ladder's `shell` rung is live, double opt-in: `sm activity install claude --shell` persists the project-local `activity.shellCapture` key and renders an extra `PreToolUse` Bash hook (`--no-shell` or `activity uninstall` retires it, demoting a stored `shell` level to `mcp`), and the capture-level POST refuses `shell` while the key is off. Bash commands naming in-scope `.md` files yield path sightings (`access: "shell"`); the command text is never captured. Claude-only for now. + + ## User-facing + + Recordings can now spot docs touched from shell commands: opt in with `sm activity install claude --shell`, then pick the Shell capture level. Only file paths are kept, never the commands themselves, and the fifth selector position stays locked until you opt in. + +### Patch Changes + +- AJV now loads lazily through a synchronous `createRequire` seam in the kernel's ajv-interop helper (every construction site was already function-local, so no signatures changed), stays external to the dist bundle, and the user-settings store validates `~/.skill-map/settings.json` against its own single compiled schema instead of the full spec validator catalog. The five bundled boot deps (clipanion, smol-toml, js-yaml, semver, ignore) moved to devDependencies; installs no longer download them. + +- The browser-storage reset gate now keys on the serving CLI version: `sm serve` (and the demo bundle) stamps a second `skill-map-version` meta, documented in the CLI contract's serve row, and upgrades wipe only what a crossed layout-break threshold declares, so a normal release keeps saved state. The locked Shell capture option is no longer natively disabled: it renders muted, refuses the click, and its tooltip explains where to enable it. + + ## User-facing + + **The greyed-out Shell option now explains itself.** Hover it to see how to enable it (Settings > Project > Capture level). And upgrading the CLI no longer resets your saved layout and recordings unless the release actually changed how they are stored. + +- Perf follow-up: the scan result fingerprint now hashes through a streaming canonical writer (no multi-MB intermediate string per warm scan), and the pure-JS boot dependencies (clipanion, smol-toml, js-yaml, semver, ignore) are bundled into the dist chunks, cutting eager module loads on startup from ~45 to 14 and `sm --version` to ~135 ms on the reference machine. + +- Node perf sprint: the tokenizer moved to `gpt-tokenizer` behind a lazy handle (identical counts; a literal `<|endoftext|>` in prose no longer aborts the scan), warm rescans skip the SQLite replace-all via a whole-result fingerprint in `scan_meta` (schema fingerprint changes, so the derived DB rebuilds once after upgrading), the walk overlaps file reads with an ordered 16-deep read-ahead, and startup defers the kysely/sqlite, watcher and conformance subgraphs and enables the V8 compile cache. + + ## User-facing + + Everything got faster: `sm` starts in about half the time, scans are quicker, and rescans of an unchanged project skip most database work. A file containing the literal text `<|endoftext|>` no longer breaks the scan. The project database rebuilds itself once after updating. + +- The replay transport's scope chip now shows the session title (the touched-node names) instead of the short session id across the three Sessions-tab entry points (Play session, Play agent, step deep-link). The chip gained a full-label tooltip and a working ellipsis (as a non-shrinking flex item it used to overflow the fixed-width row), and the transport bar widened from 26rem to 30rem. + + ## User-facing + + **Replay names the session.** The floating replay bar now labels a replay with the session's title, the same skill and agent names you see in the Sessions tab, instead of a short id. Long titles clip with an ellipsis and the full name shows in a tooltip. + ## 1.11.0 ### Minor Changes diff --git a/src/package.json b/src/package.json index bafbcdba5..2d953de46 100644 --- a/src/package.json +++ b/src/package.json @@ -1,6 +1,6 @@ { "name": "@skill-map/cli", - "version": "1.11.0", + "version": "1.12.0", "description": "skill-map reference implementation: kernel + CLI + adapters.", "license": "MIT", "type": "module", diff --git a/ui/src/data/user-changelog.json b/ui/src/data/user-changelog.json index dd0dce2dc..558da8090 100644 --- a/ui/src/data/user-changelog.json +++ b/ui/src/data/user-changelog.json @@ -1,6 +1,67 @@ { "schemaVersion": 1, "entries": [ + { + "version": "1.12.0", + "date": "2026-08-17", + "kind": "user-facing", + "highlights": [ + { + "body": "A capture-level selector next to Record (and in Settings) decides how much detail the live map and recordings keep, from executions only up to reads, writes and MCP calls, chosen before each recording (it locks while one runs). Writes now show as their own access type.", + "packages": [ + "@skill-map/cli", + "@skill-map/spec" + ] + }, + { + "body": "**The greyed-out Shell option now explains itself.** Hover it to see how to enable it (Settings > Project > Capture level). And upgrading the CLI no longer resets your saved layout and recordings unless the release actually changed how they are stored.", + "packages": [ + "@skill-map/cli", + "@skill-map/spec" + ] + }, + { + "body": "You can now decide how many recorded sessions the project keeps (`activity.journal.maxFiles` / `maxTotalBytes` in settings.json): raise them if your never-runs detector needs a longer memory than the default 50 sessions.", + "packages": [ + "@skill-map/cli", + "@skill-map/spec" + ] + }, + { + "body": "Everything got faster: `sm` starts in about half the time, scans are quicker, and rescans of an unchanged project skip most database work. A file containing the literal text `<|endoftext|>` no longer breaks the scan. The project database rebuilds itself once after updating.", + "packages": [ + "@skill-map/cli" + ] + }, + { + "body": "**Replay names the session.** The floating replay bar now labels a replay with the session's title, the same skill and agent names you see in the Sessions tab, instead of a short id. Long titles clip with an ellipsis and the full name shows in a tooltip.", + "packages": [ + "@skill-map/cli" + ] + }, + { + "body": "Recorded sessions and your map layout now stay with their project: serving another folder on the same port no longer shows the other project's recordings. One-time cost on upgrade: node positions, curation and the browser tape reset (recordings on disk are kept).", + "packages": [ + "@skill-map/cli", + "@skill-map/spec" + ] + }, + { + "body": "A small note above Record now explains that session recordings are content-free (what ran and when, never your prompts, files or results). Close it once and it stays closed on every project on this machine.", + "packages": [ + "@skill-map/cli", + "@skill-map/spec" + ] + }, + { + "body": "Recordings can now spot docs touched from shell commands: opt in with `sm activity install claude --shell`, then pick the Shell capture level. Only file paths are kept, never the commands themselves, and the fifth selector position stays locked until you opt in.", + "packages": [ + "@skill-map/cli", + "@skill-map/spec" + ] + } + ] + }, { "version": "1.11.0", "date": "2026-08-17", diff --git a/web/package.json b/web/package.json index 1ccd41385..88d074fed 100644 --- a/web/package.json +++ b/web/package.json @@ -1,6 +1,6 @@ { "name": "@skill-map/web", - "version": "1.0.1", + "version": "1.0.2", "private": true, "type": "module", "description": "skill-map.ai public site source. Static HTML + i18n; deployed via Caddy/Docker.",