devist 0.7.0

Project bootstrap CLI for AI-assisted development. Spin up new projects from templates, manage backends, and keep your codebase comprehensible.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192

# Changelog

All notable changes to devist are documented here.

The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/).

## [0.7.0] - 2026-05-03

### Added
- `devist project sync <name>` — add-only sync from the project's
  template. Walks the latest template files and copies any that don't
  already exist in the project. Existing files are never overwritten,
  so user edits are safe. Useful for catching old projects up to new
  template scaffolds (e.g. the `.claude/`, `_workspace/`, `.devist/`
  files added in the recent templates release).
- `--dry-run` flag prints what would change without writing.
- `--var key=value` overrides for rendering newly added templated files
  (mirrors `devist init`).

### Notes
- Idempotent: a second sync with no template changes is a no-op.
- This is intentionally a one-way "fast forward" for missing files
  only. A full 3-way merge (with lockfile + diff) is a separate
  feature that will land later if needed.

## [0.6.0] - 2026-05-03

### Added
- `render.rs` now supports conditional blocks:
  - `{{#if VAR}}...{{/if}}` — render when `VAR` is set and non-empty
  - `{{#unless VAR}}...{{/unless}}` — render when `VAR` is unset/empty
  - Nesting works. Inside a *skipped* branch, unknown variable references
    are tolerated (they wouldn't be reachable anyway). Active regions
    still error on unknown vars.
- `agent_mode` is a recognized template variable. `devist init` derives
  `is_devist` and `is_vibe` boolean-style vars from it (default
  `agent_mode = "devist"`). Templates can now ship a single
  `CLAUDE.md.tmpl` that conditionally renders devist-flavored or
  vibe-flavored content.
- Companion `devist-templates` release pairs every template with
  `CLAUDE.md.tmpl` + `AGENT.md.tmpl`, and adds a new `react-vite`
  template (no Supabase, pure React + Vite + TS + Tailwind v4 +
  shadcn/ui).

### Tests
- 12 render unit tests covering conditional truthy/falsy/nested cases,
  skipped-branch tolerance, unmatched/unclosed errors.

## [0.5.0] - 2026-05-03

### Security
- New `src/worker/secrets.rs` module with a 4-layer blocklist
  (filenames, prefixes, extensions, path segments). Matched paths are
  dropped at the daemon — never recorded in SQLite, never pushed to
  Supabase, never read by the advice pipeline. Defense-in-depth check
  also runs in `advice.rs::collect_snippets`.
- 7 unit tests cover dotenv family, credential files, key extensions,
  `~/.ssh` / `~/.aws` / `secrets/` segments, case-insensitivity, and
  Windows separators.

### Changed
- mem0 search query now summarizes the burst's parent dirs, filenames,
  and extensions (e.g. `"Project foo: edits in src/auth affecting
  login.tsx (tsx, ts)..."`) instead of the prior keyword-style
  `"project: foo"` which never matched stored facts.

### Added (web dashboard)
- Realtime subscription via Supabase channel (`useRealtimeWorkerEvents`).
  Inbox, Project timeline, and Overview update live on INSERT/UPDATE.
  Project timeline subscribes with a server-side `project=eq.X` filter.
- Acknowledge flow: per-row Ack button on advice rows. Acked rows
  render muted with a strikethrough title and "ACKED" badge. Inbox and
  Project timeline have a "Show acked" toggle.

### Migrations
- `migrations/0003_worker_events_realtime_and_ack.sql` — adds the table
  to `supabase_realtime` publication and creates a column-restricted
  UPDATE policy (`GRANT UPDATE (acked_at)` + RLS) so authenticated
  dashboard users can only mutate `acked_at`, not other columns.
- Fixed `migrations/0002` — replaced unsupported
  `CREATE POLICY IF NOT EXISTS` with a `DROP POLICY IF EXISTS` + create
  pattern so the file is idempotent.

## [0.4.0] - 2026-05-02

### Added
- Real Supabase L2 push (replaces the prior stub):
  - `migrations/0001_worker_events.sql` defines the table, idempotency
    index `(client_id, client_event_id)`, and RLS enable.
  - `WorkerConfig.client_id` (defaults to hostname) is the per-host
    idempotency key.
  - Daemon batch-flushes up to 500 unsynced rows every
    `sync_interval_secs`, marks them synced on success, retries on the
    next interval otherwise.
- Rules system that shapes Claude advice deterministically:
  - Global `~/.devist/worker/rules.md` and per-project
    `<monitor>/<project>/.devist/rules.md`. Both plain markdown,
    concatenated and prepended to the advice prompt.
  - `devist worker rules path|show|init [--project N]` to manage them.
  - `rules init` writes a starter template (Korean tone, focus areas,
    mem0 persistence policy).

### Changed
- Advice prompt now starts with a "User-defined rules (follow these
  strictly)" section when rules are present.

## [0.3.0] - 2026-05-02

### Changed (breaking)
- Removed `devist brief`, `devist scan`, `devist explain`, `devist watch`
  CLI commands. The underlying scanner/git helpers remain as internal
  libraries for the worker.

### Added
- `devist worker` background daemon that observes a parent folder of
  projects and records every file event into a local SQLite store
  (`~/.devist/worker/worker.db`).
  - `worker start` (with first-run setup), `worker stop`, `worker status`,
    `worker watch` (live tail), `worker config show|get|set|path`.
- AI advice generation (Phase 2):
  - Idle-burst trigger: after `advice_idle_seconds` of quiet on a
    project, the daemon spawns the `claude` CLI with the changed
    snippets and recent mem0 memories to extract facts + advice.
  - mem0 Cloud integration (`api.mem0.ai`) for long-term semantic
    memory of facts above `mem0_confidence_threshold`.
  - 4-tier guard against runaway calls: `advice_enabled` kill switch,
    `advice_min_batch`, per-project `advice_max_per_hour`, global
    `mem0_max_writes_per_hour` sliding-window limiters.
  - `worker advice [--project N] [--limit N]` lists generated advice.
  - `worker memory search <query>` for ad-hoc mem0 lookup.
- `devist doctor` now also checks the `claude` CLI.

### Notes
- The daemon writes its log to `~/.devist/worker/worker.log` and PID to
  `worker.pid`. Restart after changing config (`worker stop && start`).
- mem0 + Claude integration is opt-in: without `mem0_api_key` the worker
  silently skips advice generation; the SQLite event log still works.

## [0.2.0] - 2026-05-02

### Changed (breaking)
- Renamed CLI command `devist projects` → `devist project`
  (e.g. `devist project list`, `devist project forget <name>`).

### Added
- `devist start <name> --dev` now runs the template's `install` command
  (e.g. `pnpm install`) automatically when `package.json` exists but
  `node_modules` is missing, before launching the dev server.
- Release workflow publishes GitHub Releases directly (no draft step).

## [0.1.1] - 2026-05-02

### Fixed
- Release workflow now downloads SHA files via GitHub API,
  supporting draft releases.
- `cargo publish` step is idempotent — re-running on an existing
  version is treated as a non-fatal no-op.

## [0.1.0] - 2026-05-02

Initial beta release. Phase 1 through Phase 4 complete.

### Added
- Core CLI with 12 commands: `setup`, `doctor`, `about`, `template` (list/add/sync/remove),
  `projects` (list/forget), `init`, `start`, `stop`, `brief`, `scan`, `explain`, `watch`.
- Template system with `devist.toml` manifest, variable substitution via
  `*.tmpl` files, automatic discovery of single- and multi-template repos.
- Lazy backend management: only one project's `supabase`/`docker-compose`
  stack runs at a time. `start` automatically stops any other active
  project's backend.
- Code comprehension commands (`brief`, `scan`, `explain`, `watch`) for
  understanding AI-assisted codebases.
- Workspace at `~/.devist/` with `config.toml`, `registry.toml`, `state.toml`,
  and template cache.
- 7 official templates: `react-supabase`, `react-native-supabase`,
  `flutter-supabase`, `fastapi-postgres`, `nestjs-postgres`, `rust-axum`,
  `wordpress`.

### Notes
- Beta — APIs and template manifest schema may change before v1.0.
- Public Homebrew tap and crates.io publish targeted for v1.0.

[Unreleased]: https://github.com/WebchemistCorp/devist/compare/v0.7.0...HEAD
[0.7.0]: https://github.com/WebchemistCorp/devist/releases/tag/v0.7.0
[0.6.0]: https://github.com/WebchemistCorp/devist/releases/tag/v0.6.0
[0.5.0]: https://github.com/WebchemistCorp/devist/releases/tag/v0.5.0
[0.4.0]: https://github.com/WebchemistCorp/devist/releases/tag/v0.4.0
[0.3.0]: https://github.com/WebchemistCorp/devist/releases/tag/v0.3.0
[0.2.0]: https://github.com/WebchemistCorp/devist/releases/tag/v0.2.0
[0.1.1]: https://github.com/WebchemistCorp/devist/releases/tag/v0.1.1
[0.1.0]: https://github.com/WebchemistCorp/devist/releases/tag/v0.1.0