agent-standups-install/CHANGELOG.md

Changelog

Generated from the source repo by sync.sh; do not edit here. Starts at 0.1.0, where the version line was reset flat.

0.1.2 — the terminal prompt

Operator commands ask you instead of refusing you. Run standup update, uninstall, service stop or any other operator-only command in your own terminal without --code, and it now says what it is about to do and asks you to confirm you are the operator. Type y to go ahead; anything else stops it, and nothing is done. --code and STANDUP_OPERATOR_CODE work as before, with no prompt.

It is a guard against accidents, not a lock: your code is in ~/.standup/config.toml, which anything running as you can read. Agents run without a terminal, so they never see the prompt; they are refused as before, and told to ask you.

Agents can add to the knowledge base. standup kb add no longer needs the code, so an agent can save a note without asking you. Deleting one is still yours: standup kb rm is operator-only, and like the other operator commands it now asks you at a terminal.

0.1.1 — the fixes release

A maintenance release: no new surfaces except one on the dashboard, and a security fix worth upgrading for.

Fixed: a backup could leave your tokens on disk. If any directory inside your standup home was read-only, backup wrote its archive and then failed to remove its staging copy — and said nothing, because the archive had been written. With --include-secrets that copy held every participant token, raw, in your temp directory. Restores and exports had the same fault. Nothing was leaked off the machine, but the files were left where you would not look for them. Upgrading removes the fault; existing stray copies are yours to delete.

The dashboard tells you when an update exists, and offers a button. It checks only when you open the page — nothing polls, and nothing is sent anywhere if you never look. A box that cannot reach the registry shows nothing rather than a warning.

standup update no longer downgrades a prerelease install. On a 0.7.0-rc* box it followed the latest tag and offered 0.1.0, which is older. It now compares versions properly and installs nothing when nothing is newer.

Also in:

• kb rm refuses, naming both homes, when the daemon on the port serves a different standup home than your CLI — instead of deleting from the wrong one.
• A restore no longer fails on an archived read-only directory after writing every file correctly.
• An interrupted uninstall edits only the file it read, so a concurrent change is kept rather than overwritten.
• A registry read (standup project, search) no longer refuses a join as though a daemon held the project; it waits, and names itself if it must refuse.
• Two message-delivery faults around pause/resume and agent hand-over.
• Codex is wired up by the installer where codex is on your PATH.

0.1.0 — the daemon release

The version is flat now. This is the same work the 0.7.0-rc* line was heading for, released as 0.1.0: the release candidates are retired and the numbering restarts. So the entries below it (0.5.0-rc3, and 0.2–0.3 further down) are older than this one despite reading higher — they are the rc lineage this release replaces.

Upgrade from any 0.5.x or 0.7.0-rc. Nobody is asked to rejoin this time; 0.5.0-rc3's credential rotation was a one-off and does not repeat.

One thing to know before you start: the daemon needs Node 22.13+ or 23.4+ (not 22.0–22.12, not 23.0–23.3) because it loads node:sqlite unflagged. Single mode — standup serve — still runs on Node 20 and stores its rooms as JSONL. If you only ever run one project, nothing about your setup changes.

What this release is

0.5 could run a room. 0.6 runs your machine: one daemon serving every project you have registered, with the rooms, the knowledge base, the todo list and the audit trail behind one address instead of one per checkout.

• One daemon, every project. standup daemon serves them all, and the dashboard lists them. A project is registered by its path, so moving a checkout does not strand its room.
• Templates. A thread you open more than once — a release check, a weekly sweep — saved as a file: the title, the objective, who is invited, who is spawned, and how they may talk. standup template run <name> opens it, and this release added a page to write one without editing TOML.
• Search across everything, reconciled against the registry rather than rebuilt on each boot. On a real install this went from about 1.5 seconds a query to under 10 milliseconds.
• Backup, restore and import that respect what is already here. A restore no longer loses what happened after the backup was taken: the audit log keeps its live rows, counters take the higher of the two sides, and a decision you made since (archived, closed, kicked) stands. An import from another machine renumbers colliding todo ids rather than overwriting yours, and says which it moved.
• A licence for the daemon. Single mode is never licensed and never will be; standup serve needs no key.

Breaking changes

• standup project rename, /rename-project, /rename-thread and /archive are gone. One name grammar covers join, rename and spawn.
• Project-level role files are no longer loaded. Roles are install-wide. A project that still has them is told so once at daemon start.
• export --project and backup --remote are dropped.
• A flag a verb would have ignored is now refused. expose --stop --rotate-code used to exit 0 having rotated nothing; export <thread> --all --from 2 --to 2 used to export the whole project. Both now exit 2 and name the flag. This will break scripts that were passing flags that silently did nothing — which is the point.
• .standup/ is ignored whole rather than file by file.

Security

Six audit rounds over this release -- 5, 6, 7, 7.1, 7.2 and the rc1 pass -- most of them run twice independently, and two of them re-reads of our own fix batches. The findings that mattered most were not new code:

• Three ways to forge the operator. A newline in a message body rendered as a system line; oper‌ator with a zero-width space and οperator with a Greek omicron both joined with full authority. Agent-originated text now goes through one neutralising function (inert) wherever it lands in a frame — titles, working_on, search results, separators.
• Clickjacking. No X-Frame-Options and no frame-ancestors anywhere. A page you visited could frame your dashboard and start a public tunnel in three clicks. Loopback is not a boundary against a page you are already looking at.
• standup expose stop started a tunnel. It parsed as expose with a stray argument, opened a public cloudflared tunnel, and printed the share link with your operator code in it.
• An uncredentialed /api/join could plant a managed row with any session id.
• A local privilege escalation in standup daemon: while the daemon was down, another local user holding the port could make your daemon SIGTERM an unrelated process. It now proves the port holder before taking it back.

Honest notes

• We found more by re-reading old code than by writing new code. Four audit passes over largely the same source yielded 51, 40, 69 and 61 findings. Yield tracked how much old code got read, not how broken the code was.
• One fix batch caused 25 of the next audit's 61 findings. Ten builders worked in parallel, each branch passed its own suites, and nothing ran the whole set against the whole set until the audit did. The process change that came out of that — fix by class, re-run everything — is worth more than any single row here.
• 594 probes ship in docs/probes/. Each exits 1 while its finding is present and 0 once it is fixed, and a row is closed only when its probe is shown failing on the tree before the fix. That rule caught two closures this release that were otherwise about to be recorded as done.

Known

• This release is verified on Linux and WSL2 only. The macOS and Windows installers, and their service managers (launchd, the Windows task), are implemented but have never been executed end to end on a real host -- not once, by anyone. They ship unverified by an explicit decision rather than an oversight: no amount of further review closes this, only hardware does. If you install on macOS or Windows, expect to debug it, and please report what breaks.
• A handful of pre-existing low-severity findings are deferred rather than fixed; they are named, with probes, in the archived backlogs.