devist 0.6.0

# Changelog

All notable changes to devist are documented here.

The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/).

## [0.6.0] - 2026-05-03

### Added
- `render.rs` now supports conditional blocks:
  - `{{#if VAR}}...{{/if}}` — render when `VAR` is set and non-empty
  - `{{#unless VAR}}...{{/unless}}` — render when `VAR` is unset/empty
  - Nesting works. Inside a *skipped* branch, unknown variable references
    are tolerated (they wouldn't be reachable anyway). Active regions
    still error on unknown vars.
- `agent_mode` is a recognized template variable. `devist init` derives
  `is_devist` and `is_vibe` boolean-style vars from it (default
  `agent_mode = "devist"`). Templates can now ship a single
  `CLAUDE.md.tmpl` that conditionally renders devist-flavored or
  vibe-flavored content.
- Companion `devist-templates` release pairs every template with
  `CLAUDE.md.tmpl` + `AGENT.md.tmpl`, and adds a new `react-vite`
  template (no Supabase, pure React + Vite + TS + Tailwind v4 +
  shadcn/ui).

### Tests
- 12 render unit tests covering conditional truthy/falsy/nested cases,
  skipped-branch tolerance, unmatched/unclosed errors.

## [0.5.0] - 2026-05-03

### Security
- New `src/worker/secrets.rs` module with a 4-layer blocklist
  (filenames, prefixes, extensions, path segments). Matched paths are
  dropped at the daemon — never recorded in SQLite, never pushed to
  Supabase, never read by the advice pipeline. Defense-in-depth check
  also runs in `advice.rs::collect_snippets`.
- 7 unit tests cover dotenv family, credential files, key extensions,
  `~/.ssh` / `~/.aws` / `secrets/` segments, case-insensitivity, and
  Windows separators.

### Changed
- mem0 search query now summarizes the burst's parent dirs, filenames,
  and extensions (e.g. `"Project foo: edits in src/auth affecting
  login.tsx (tsx, ts)..."`) instead of the prior keyword-style
  `"project: foo"` which never matched stored facts.

### Added (web dashboard)
- Realtime subscription via Supabase channel (`useRealtimeWorkerEvents`).
  Inbox, Project timeline, and Overview update live on INSERT/UPDATE.
  Project timeline subscribes with a server-side `project=eq.X` filter.
- Acknowledge flow: per-row Ack button on advice rows. Acked rows
  render muted with a strikethrough title and "ACKED" badge. Inbox and
  Project timeline have a "Show acked" toggle.

### Migrations
- `migrations/0003_worker_events_realtime_and_ack.sql` — adds the table
  to `supabase_realtime` publication and creates a column-restricted
  UPDATE policy (`GRANT UPDATE (acked_at)` + RLS) so authenticated
  dashboard users can only mutate `acked_at`, not other columns.
- Fixed `migrations/0002` — replaced unsupported
  `CREATE POLICY IF NOT EXISTS` with a `DROP POLICY IF EXISTS` + create
  pattern so the file is idempotent.

## [0.4.0] - 2026-05-02

### Added
- Real Supabase L2 push (replaces the prior stub):
  - `migrations/0001_worker_events.sql` defines the table, idempotency
    index `(client_id, client_event_id)`, and RLS enable.
  - `WorkerConfig.client_id` (defaults to hostname) is the per-host
    idempotency key.
  - Daemon batch-flushes up to 500 unsynced rows every
    `sync_interval_secs`, marks them synced on success, retries on the
    next interval otherwise.
- Rules system that shapes Claude advice deterministically:
  - Global `~/.devist/worker/rules.md` and per-project
    `<monitor>/<project>/.devist/rules.md`. Both plain markdown,
    concatenated and prepended to the advice prompt.
  - `devist worker rules path|show|init [--project N]` to manage them.
  - `rules init` writes a starter template (Korean tone, focus areas,
    mem0 persistence policy).

### Changed
- Advice prompt now starts with a "User-defined rules (follow these
  strictly)" section when rules are present.

## [0.3.0] - 2026-05-02

### Changed (breaking)
- Removed `devist brief`, `devist scan`, `devist explain`, `devist watch`
  CLI commands. The underlying scanner/git helpers remain as internal
  libraries for the worker.

### Added
- `devist worker` background daemon that observes a parent folder of
  projects and records every file event into a local SQLite store
  (`~/.devist/worker/worker.db`).
  - `worker start` (with first-run setup), `worker stop`, `worker status`,
    `worker watch` (live tail), `worker config show|get|set|path`.
- AI advice generation (Phase 2):
  - Idle-burst trigger: after `advice_idle_seconds` of quiet on a
    project, the daemon spawns the `claude` CLI with the changed
    snippets and recent mem0 memories to extract facts + advice.
  - mem0 Cloud integration (`api.mem0.ai`) for long-term semantic
    memory of facts above `mem0_confidence_threshold`.
  - 4-tier guard against runaway calls: `advice_enabled` kill switch,
    `advice_min_batch`, per-project `advice_max_per_hour`, global
    `mem0_max_writes_per_hour` sliding-window limiters.
  - `worker advice [--project N] [--limit N]` lists generated advice.
  - `worker memory search <query>` for ad-hoc mem0 lookup.
- `devist doctor` now also checks the `claude` CLI.

### Notes
- The daemon writes its log to `~/.devist/worker/worker.log` and PID to
  `worker.pid`. Restart after changing config (`worker stop && start`).
- mem0 + Claude integration is opt-in: without `mem0_api_key` the worker
  silently skips advice generation; the SQLite event log still works.

## [0.2.0] - 2026-05-02

### Changed (breaking)
- Renamed CLI command `devist projects` → `devist project`
  (e.g. `devist project list`, `devist project forget <name>`).

### Added
- `devist start <name> --dev` now runs the template's `install` command
  (e.g. `pnpm install`) automatically when `package.json` exists but
  `node_modules` is missing, before launching the dev server.
- Release workflow publishes GitHub Releases directly (no draft step).

## [0.1.1] - 2026-05-02

### Fixed
- Release workflow now downloads SHA files via GitHub API,
  supporting draft releases.
- `cargo publish` step is idempotent — re-running on an existing
  version is treated as a non-fatal no-op.

## [0.1.0] - 2026-05-02

Initial beta release. Phase 1 through Phase 4 complete.

### Added
- Core CLI with 12 commands: `setup`, `doctor`, `about`, `template` (list/add/sync/remove),
  `projects` (list/forget), `init`, `start`, `stop`, `brief`, `scan`, `explain`, `watch`.
- Template system with `devist.toml` manifest, variable substitution via
  `*.tmpl` files, automatic discovery of single- and multi-template repos.
- Lazy backend management: only one project's `supabase`/`docker-compose`
  stack runs at a time. `start` automatically stops any other active
  project's backend.
- Code comprehension commands (`brief`, `scan`, `explain`, `watch`) for
  understanding AI-assisted codebases.
- Workspace at `~/.devist/` with `config.toml`, `registry.toml`, `state.toml`,
  and template cache.
- 7 official templates: `react-supabase`, `react-native-supabase`,
  `flutter-supabase`, `fastapi-postgres`, `nestjs-postgres`, `rust-axum`,
  `wordpress`.

### Notes
- Beta — APIs and template manifest schema may change before v1.0.
- Public Homebrew tap and crates.io publish targeted for v1.0.

[Unreleased]: https://github.com/WebchemistCorp/devist/compare/v0.6.0...HEAD
[0.6.0]: https://github.com/WebchemistCorp/devist/releases/tag/v0.6.0
[0.5.0]: https://github.com/WebchemistCorp/devist/releases/tag/v0.5.0
[0.4.0]: https://github.com/WebchemistCorp/devist/releases/tag/v0.4.0
[0.3.0]: https://github.com/WebchemistCorp/devist/releases/tag/v0.3.0
[0.2.0]: https://github.com/WebchemistCorp/devist/releases/tag/v0.2.0
[0.1.1]: https://github.com/WebchemistCorp/devist/releases/tag/v0.1.1
[0.1.0]: https://github.com/WebchemistCorp/devist/releases/tag/v0.1.0