diff --git a/CHANGELOG.md b/CHANGELOG.md index 9f9a20ad0..70aa590bd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,27 +7,50 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [1.2.73] - 2026-09-02 + +### Claude + +- Stop one task without stopping the rest. Square stop on a spawn card, Chat Info row, scheduled job, or `ade chat stop-task` ends that task; siblings keep running (#1220). +- Stop has four modes: turn only, turn and queue (the default), turn and background, or all three. Default Stop no longer tears down Claude background jobs once per-task stop is available. Settling a session still backgrounds the turn (#1220). +- Don't continue parks at the plan limit. Auto-continue is on for every chat; opt out per chat. ADE parks until Claude's window resets, then notifies. A busy query is interrupted without killing background work (#1220). +- `/context` is classified by kind. Rows use `used`, `free`, `buffer`, and `deferred` — never the category name `"free"` (#1220). +- A model switch is a quiet divider, not a chat message. Classifier context is only explicit approvals and text you typed (#1220). +- Ambient housekeeping tasks stay out of activity and the Subagents roster. Permission prompts honor `default_to_no` (no recommended Allow, no Allow for Session). Terminal-only slash commands stay out of agent palettes (#1216). + +### Work chat + +- Queued and staged messages stay cancellable. Codex queue ids are recovered; cancel and edit failures surface instead of looking successful. Touch clients keep the controls without hover (#1214). +- Cursor mode and ADE full-auto stay separate. Clearing a Cursor mode on one client reaches the others. Droid autonomy, including AGI, survives CLI, RPC, sync, and resume (#1214). +- Subagent trees show spawn depth. Finished branches collapse. Files a subagent returned are a copyable list (#1216). +- `ade chat status` is the live turn: RUNNING, BLOCKED, or IDLE with exit 0, 1, or 2. `ade chat show` stays the session summary (#1216). + ### ADE SDK -- A thread can carry its own instructions, working directory, and configuration layers. `instructions` replaces or appends to ADE's own personal-chat prompt without putting a hidden message in the transcript, `cwd` names the absolute directory the provider runs in, and `settingSources` decides which on-disk config it loads. Each one reports back what the provider actually did, so a host reads `level` instead of assuming (#1205, #1206, #1212). -- Permissions take a structured policy, not just a preset. Name tools with `allowedTools`, `deniedTools`, `autoApproveMcpServers` and a `sandboxRoot`, with a required `fallback` (#1208, #1212). -- A deny policy on Claude takes tools away instead of asking about them. Every mutating built-in the policy does not name is removed from the model's catalog, and the session reaches only the MCP servers the policy names. That holds whether or not Claude calls back into a permission prompt, which on measured builds it does not. An ask policy still relies on that prompt, and the thread says so in its own capability report rather than claiming enforcement it cannot deliver (#1208, #1212). -- A policy that would leave a hole now says so at open time. The SDK logs one line for an MCP server you injected that a deny policy blocks, and one for an allow entry naming a single MCP tool, which admits that tool's whole server on Claude. Both were silent before, and neither has a symptom you would otherwise see (#1208, #1212). -- A Codex policy has to name a directory before it approves anything on your behalf. A policy with no `sandboxRoot` approved no directory, so a sandbox escape now parks for an answer or is declined, instead of being accepted because a policy object happened to be present. Codex still raises no approval at all for work inside the chat's own working directory, so a policy governs escapes rather than everything the agent does (#1208, #1212). -- Reopening a chat by key no longer silently discards the options passed with it. A resume has always rebuilt the chat its key was created with, and it still does, but it now says which of the working directory, instructions, configuration layers, permissions, and tool servers it ignored. Believing an agent is confined to a directory and a rule set it is not confined to is the worst thing this surface can do quietly (#1212). -- A working directory is resolved to its real path before it is stored and checked. A symbolic link, or a Windows path differing only in letter case, can no longer pass a containment check that the directory it points at would fail (#1206, #1212). -- An approval can be answered. `thread.approve()` settles a blocked request, `thread.pendingApprovals()` restores the cards a reload lost, and `@ade-dev/chat-ui` draws each request inline in the transcript and settles it in place. A client without `approve` gets a read-only card instead of a throw. A request that wants prose or a choice rather than a verdict — a question, a plan, a model pick — is refused rather than answered with an Allow that would leave the turn parked (#1208, #1212). -- Claude no longer prompts by tool name. A policy replaces the substring heuristic that asked about a read-only `list_agents` and stayed silent for a destructive `delete_project`, so an MCP tool is gated by the host's rules rather than by what its name contains (#1208, #1212). -- Provider install and sign-in commands are correct and say the same thing everywhere. Settings, the model picker's empty states, the CLI, and the SDK now read one table instead of four copies, and the strings are reconciled against each vendor's own documentation. Windows users get the vendor's PowerShell installer for Claude, Cursor and Droid rather than a `curl` line that cannot work. Droid and Pi show the command that actually starts their sign-in, since neither has a non-interactive login (#1207, #1212). -- `providers.status()` reports what is actually on the machine: whether a CLI was found, its path and version, whether credentials are present, and the install and login commands ADE knows for it. Records say whether they were probed or derived from the model catalog, and provider cards say "Not detected" rather than "Not installed" when nobody looked (#1207, #1212). -- Electron embedders get a supported bridge. `@ade-dev/sdk/electron` registers the main-process handler, exposes a preload safe under `sandbox: true`, and returns a renderer client that feeds `@ade-dev/chat-ui` directly. Subscriptions are released on reload and navigation, error codes survive the boundary, and two windows never see each other's events (#1209, #1212). -- The runtime can ship inside a signed app. Released builds also publish as `@ade-dev/runtime-*` platform packages, `allowDownload: false` throws instead of reaching the network, and `doctor().runtime` reports which of the five resolution steps produced the binary plus what the OS thinks of its signature (#1210, #1212). -- A resumed chat keeps its injected MCP servers. Caller MCP servers, strict mode, and the capability report were dropped from the rehydrated session, so the first rename or status update after a restart deleted them from disk. A resumed chat also re-derives what each provider can honor rather than trusting the stored verdict, so a chat that outlives a change to those rules stops reporting the old answer (#1212). -- A chat opened in a host-supplied working directory stays in it. The directory was checked against the lane worktree and refused for being outside it, so the setting was rejected on the surface it exists for (#1206, #1212). -- Licensing is documented in one place. A new page states what the SDK package, the chat-ui package, the runtime binary, and ADE itself are licensed under, and CI now fails a release whose SPDX field, `LICENSE` file, tarball, and README disagree (#1211, #1212). -- `@ade-dev/sdk` and `@ade-dev/chat-ui` are MIT, and a proprietary app may ship the runtime binary. ADE itself, the desktop app, the CLI, and the runtime binary stay AGPL-3.0-only, but the new ADE Runtime Embedding Exception permits distributing an unmodified runtime binary inside a larger work that consumes it through the documented SDK interface. Re-signing the binary with your own identity does not count as modifying it. Modifying the runtime, or linking ADE source, keeps the AGPL in force. Every `@ade-dev/runtime-*` package now carries both documents (#1211). -- `@ade-dev/sdk` and `@ade-dev/chat-ui` are at 0.2.0. Every 0.1.x option keeps its exact behavior; everything above is additive (#1212). -- `@ade-dev/runtime*` publishes when a GitHub release is made public. `/release` undrafts; the same `release.published` event as the brew tap then packs and publishes the six platform packages at that tag's version. A separate Actions click is recovery, not the release path. +- A thread can carry its own instructions, working directory, and configuration layers. `instructions` replaces or appends to ADE's own personal-chat prompt without putting a hidden message in the transcript, `cwd` names the absolute directory the provider runs in, and `settingSources` decides which on-disk config it loads. Each one reports back what the provider actually did, so a host reads `level` instead of assuming (#1205, #1206, #1212, #1215). +- Permissions take a structured policy, not just a preset. Name tools with `allowedTools`, `deniedTools`, `autoApproveMcpServers` and a `sandboxRoot`, with a required `fallback` (#1208, #1212, #1215). +- A deny policy on Claude takes tools away instead of asking about them. Every mutating built-in the policy does not name is removed from the model's catalog, and the session reaches only the MCP servers the policy names. That holds whether or not Claude calls back into a permission prompt, which on measured builds it does not. An ask policy still relies on that prompt, and the thread says so in its own capability report rather than claiming enforcement it cannot deliver (#1208, #1212, #1215). +- A policy that would leave a hole now says so at open time. The SDK logs one line for an MCP server you injected that a deny policy blocks, and one for an allow entry naming a single MCP tool, which admits that tool's whole server on Claude. Both were silent before, and neither has a symptom you would otherwise see (#1208, #1212, #1215). +- A Codex policy has to name a directory before it approves anything on your behalf. A policy with no `sandboxRoot` approved no directory, so a sandbox escape now parks for an answer or is declined, instead of being accepted because a policy object happened to be present. Codex still raises no approval at all for work inside the chat's own working directory, so a policy governs escapes rather than everything the agent does (#1208, #1212, #1215). +- Reopening a chat by key no longer silently discards the options passed with it. A resume has always rebuilt the chat its key was created with, and it still does, but it now says which of the working directory, instructions, configuration layers, permissions, and tool servers it ignored. Believing an agent is confined to a directory and a rule set it is not confined to is the worst thing this surface can do quietly (#1212, #1215). +- A working directory is resolved to its real path before it is stored and checked. A symbolic link, or a Windows path differing only in letter case, can no longer pass a containment check that the directory it points at would fail (#1206, #1212, #1215). +- An approval can be answered. `thread.approve()` settles a blocked request, `thread.pendingApprovals()` restores the cards a reload lost, and `@ade-dev/chat-ui` draws each request inline in the transcript and settles it in place. A client without `approve` gets a read-only card instead of a throw. A request that wants prose or a choice rather than a verdict — a question, a plan, a model pick — is refused rather than answered with an Allow that would leave the turn parked (#1208, #1212, #1215). +- Claude no longer prompts by tool name. A policy replaces the substring heuristic that asked about a read-only `list_agents` and stayed silent for a destructive `delete_project`, so an MCP tool is gated by the host's rules rather than by what its name contains (#1208, #1212, #1215). +- Provider install and sign-in commands are correct and say the same thing everywhere. Settings, the model picker's empty states, the CLI, and the SDK now read one table instead of four copies, and the strings are reconciled against each vendor's own documentation. Windows users get the vendor's PowerShell installer for Claude, Cursor and Droid rather than a `curl` line that cannot work. Droid and Pi show the command that actually starts their sign-in, since neither has a non-interactive login (#1207, #1212, #1215). +- `providers.status()` reports what is actually on the machine: whether a CLI was found, its path and version, whether credentials are present, and the install and login commands ADE knows for it. Records say whether they were probed or derived from the model catalog, and provider cards say "Not detected" rather than "Not installed" when nobody looked (#1207, #1212, #1215). +- Electron embedders get a supported bridge. `@ade-dev/sdk/electron` registers the main-process handler, exposes a preload safe under `sandbox: true`, and returns a renderer client that feeds `@ade-dev/chat-ui` directly. Subscriptions are released on reload and navigation, error codes survive the boundary, and two windows never see each other's events (#1209, #1212, #1215). +- The runtime can ship inside a signed app. Released builds also publish as `@ade-dev/runtime-*` platform packages, `allowDownload: false` throws instead of reaching the network, and `doctor().runtime` reports which of the five resolution steps produced the binary plus what the OS thinks of its signature (#1210, #1212, #1215). +- A resumed chat keeps its injected MCP servers. Caller MCP servers, strict mode, and the capability report were dropped from the rehydrated session, so the first rename or status update after a restart deleted them from disk. A resumed chat also re-derives what each provider can honor rather than trusting the stored verdict, so a chat that outlives a change to those rules stops reporting the old answer (#1212, #1215). +- A chat opened in a host-supplied working directory stays in it. The directory was checked against the lane worktree and refused for being outside it, so the setting was rejected on the surface it exists for (#1206, #1212, #1215). +- Licensing is documented in one place. A new page states what the SDK package, the chat-ui package, the runtime binary, and ADE itself are licensed under, and CI now fails a release whose SPDX field, `LICENSE` file, tarball, and README disagree (#1211, #1212, #1215). +- `@ade-dev/sdk` and `@ade-dev/chat-ui` are MIT, and a proprietary app may ship the runtime binary. ADE itself, the desktop app, the CLI, and the runtime binary stay AGPL-3.0-only, but the new ADE Runtime Embedding Exception permits distributing an unmodified runtime binary inside a larger work that consumes it through the documented SDK interface. Re-signing the binary with your own identity does not count as modifying it. Modifying the runtime, or linking ADE source, keeps the AGPL in force. Every `@ade-dev/runtime-*` package now carries both documents (#1211, #1215). +- `@ade-dev/sdk` and `@ade-dev/chat-ui` are at 0.2.0. Every 0.1.x option keeps its exact behavior; everything above is additive (#1212, #1215). +- `@ade-dev/runtime*` publishes when a GitHub release is made public. `/release` undrafts; the same `release.published` event as the brew tap then packs and publishes the six platform packages at that tag's version. A separate Actions click is recovery, not the release path (#1217, #1218, #1219). + +### iOS + +- Work matches desktop stop and Don't continue. Four-mode stop, per-task square stop, and a Don't-continue banner. The kind-classified `/context` card stays desktop-only; the meter still decodes kind (#1220). +- Subagent trees, returned files, and queued-message controls match desktop, including touch-reachable cancel and edit (#1214, #1216). ## [1.2.72] - 2026-09-02 @@ -1921,7 +1944,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Initial public release. -[Unreleased]: https://github.com/arul28/ADE/compare/v1.2.72...HEAD +[Unreleased]: https://github.com/arul28/ADE/compare/v1.2.73...HEAD +[1.2.73]: https://github.com/arul28/ADE/compare/v1.2.72...v1.2.73 [1.2.72]: https://github.com/arul28/ADE/compare/v1.2.71...v1.2.72 [1.2.71]: https://github.com/arul28/ADE/compare/v1.2.70...v1.2.71 [1.2.70]: https://github.com/arul28/ADE/compare/v1.2.69...v1.2.70 diff --git a/changelog/index.mdx b/changelog/index.mdx index 6aa1d010f..e4e351299 100644 --- a/changelog/index.mdx +++ b/changelog/index.mdx @@ -5,6 +5,6 @@ description: "Latest ADE release notes and release history." ADE release notes live here in newest-first order. Start with the latest release, or browse the release list in the sidebar. - - v1.2.72 - Run Claude Code 2.1.258 for Fable 5.1, add Grok/Kimi/Qwen/Copilot to the picker, and let a newer release replace a staged update without relaunching. + + v1.2.73 - Per-task stop, four stop modes, Don't continue at the usage limit, and ADE SDK 0.2.0 with instructions, permissions, and a bundled runtime. diff --git a/changelog/v1.2.73.mdx b/changelog/v1.2.73.mdx new file mode 100644 index 000000000..07aa91b82 --- /dev/null +++ b/changelog/v1.2.73.mdx @@ -0,0 +1,35 @@ +--- +title: "v1.2.73" +description: "Release notes for ADE v1.2.73 - September 2, 2026" +--- + +Claude chats get per-task stop, four stop modes, a kind-classified `/context` card, and Don't continue at the usage limit. The ADE SDK is 0.2.0: instructions, working directory, permissions, approvals, an Electron bridge, and a bundled runtime. + +--- + +## Claude + +- **Stop one task without stopping the rest.** Square stop on a spawn card, Chat Info row, scheduled job, or `ade chat stop-task` ends that task; siblings keep running. +- **Stop has four modes.** Turn only, turn and queue (the default), turn and background, or all three. Default Stop no longer tears down Claude background jobs once per-task stop is available. Settling a session still backgrounds the turn. +- **Don't continue parks at the plan limit.** Auto-continue is on for every chat; opt out per chat. ADE parks until Claude's window resets, then notifies. A busy query is interrupted without killing background work. +- **`/context` is classified by kind.** Rows use `used`, `free`, `buffer`, and `deferred` — never the category name `"free"`. +- **A model switch is a quiet divider**, not a chat message. Classifier context is only explicit approvals and text you typed. + +## Work chat + +- **Queued and staged messages stay cancellable.** Codex queue ids are recovered; cancel and edit failures surface instead of looking successful. Touch clients keep the controls without hover. +- **Cursor mode and ADE full-auto stay separate.** Clearing a Cursor mode on one client reaches the others. Droid autonomy, including AGI, survives CLI, RPC, sync, and resume. +- **Subagent trees show spawn depth.** Finished branches collapse. Files a subagent returned are a copyable list. Ambient housekeeping stays out of activity. +- **`ade chat status` is the live turn.** RUNNING, BLOCKED, or IDLE with exit 0, 1, or 2. `ade chat show` stays the session summary. +- **Permission prompts honor `default_to_no`.** Elevated-risk asks are not recommended Allow, and there is no Allow for Session on those. Terminal-only slash commands stay out of agent palettes. + +## ADE SDK + +- **`@ade-dev/sdk` and `@ade-dev/chat-ui` are 0.2.0.** A thread can carry `instructions`, `cwd`, `settingSources`, and a structured permission policy. `thread.approve()` answers a blocked request; chat-ui draws the card inline. +- **Electron embedders get a supported bridge.** `@ade-dev/sdk/electron` registers main, preload (sandbox-safe), and renderer. Two windows never see each other's events. +- **The runtime can ship inside a signed app.** Platform packages publish as `@ade-dev/runtime-*` when a GitHub release is made public. `doctor().runtime` reports which resolution step produced the binary. + +## iOS + +- **Work matches desktop stop and Don't continue.** Four-mode stop, per-task square stop, and a Don't-continue banner. The kind-classified `/context` card stays desktop-only; the meter still decodes kind. +- **Subagent trees, returned files, and queued-message controls** match desktop, including touch-reachable cancel and edit. diff --git a/docs.json b/docs.json index cecf43839..24d988bea 100644 --- a/docs.json +++ b/docs.json @@ -218,6 +218,7 @@ "expanded": true, "pages": [ "changelog", + "changelog/v1.2.73", "changelog/v1.2.72", "changelog/v1.2.71", "changelog/v1.2.70",