v0.4.2

Fixed

• The secrets red line no longer asks on an argument ending in **, such as rg --glob '!**/node_modules/**' or ls src/**: a name of stars alone is as broad as *. Globs that can match a secret file (.e*, *.pem) are still held. Run npx flowrail upgrade to vendor the new guard.

v0.4.1

Fixed

• Skills: a skill or command name stays on one line; the description wraps instead.

v0.4.0

Added

• A Skills page (Automation, /skills, GET /api/skills): every skill and slash command Claude Code can use in the repo, from the project's .claude/, your own config folder ($CLAUDE_CONFIG_DIR or ~/.claude) and each enabled plugin, with what each is for. Filter by source, kind or text; a project skill opens in Docs.
• "shared": true in flowrail/config.json keeps comments and the activity journal in flowrail/, committed, so a team working in one repo sees the same comments and history. Comments become one file each (flowrail/comments/<id>.json); the journal is flowrail/activity/YYYY-MM.jsonl (add flowrail/activity/*.jsonl merge=union to .gitattributes). Without the flag nothing moves; the old per-machine files are always still read.
• Comments are signed by their person as well as their machine: an ed25519 key in the state folder, whose public half goes into keys in config.json ({ "email": "base64" }). npx @finalangel/flowrail-os key prints that line. A comment verifies when either signature checks out, so a teammate's comment is an instruction on your machine too once their key is in keys.
• Identity: every comment, task note, resolution and journal line names the person (git's user.email, named from the people folder) instead of "you". GET /api/me.
• The journal records task moves, record moves and comments added or resolved, each with who, by (human or agent) and, for an agent, its Claude Code session.
• SessionStart lists shared comments, says who wrote one that is not yours, and tells the agent to answer such a comment only from files tracked in git.

Changed

• keys joins port, actions and apps as guarded config: a key added without the human accepting it is drift. Run npx flowrail upgrade to vendor the new guard.

v0.3.3

Added

• A plugin can list styles: ['theme.css']: stylesheets from its ui folder that every page links in its <head>, after app.css. A plugin's colors now apply from the first paint on every page, not only after one of its own pages has loaded.

v0.3.2

Changed

• Drift detection on flowrail/config.json looks only at the keys that matter to safety: port, actions and apps. An edit elsewhere in the file (the nav, docs roots, duties) no longer makes every tool call ask; the snapshot follows it. red-lines.json is still watched whole, and a config.json that does not parse is still drift.

v0.3.1

Changed

• The Board's Backlog column reads like Done: a quiet list of ids and titles, as narrow as Done, and its rows still drag to Todo.

Fixed

• The secret-files red line held inline script code carrying a regex such as .*?, reading it as a glob that could reach .env. In code a wildcard is not a file pattern; a plain secret file name in a script is still held.

v0.3.0

Added

• The sidebar collapses to an icon rail from the button at its foot or with ⌘B / Ctrl+B (not while typing in a field, where it means bold). The choice is remembered per browser and applied before the first paint; collapsed, each page name shows as a tooltip and stays readable to screen readers. On a phone the sidebar stays a sheet.
• A read-only demo of flowrailOS on GitHub Pages: packages/flowrail-os/scripts/static-demo.js saves what the dashboard answers on the example workspace, and the page reads those files when it carries a flowrail-static meta tag. Pushing a version tag publishes both packages (.github/workflows/release.yml).

Changed

• The sidebar has its own background (--surface), set apart from the page, a thin scrollbar that shows only while the pointer or focus is in it, and a divider between Settings and the collapse button.

Fixed

• The quote on a comment card showed the button's default left border.