0.6.0 - 2026-10-18

Release Notes

Added

• Machine-readable exit-code reference (CLI-73): hamstik commands --exit-codes prints the stable exit-code table (0–10) with name, meaning,
  and remediation as a human table, or the versioned exitCodesVersion: 1
  document under --json/--format json — riding the shared --fields,
  --jq, and output-mode contract. The same table is embedded in the
  commands --json manifest as the additive exitCodes block, so one
  manifest fetch yields both the command surface and the failure schema.
  Every entry is generated from the same exit constants the error renderer
  maps onto, so the table cannot drift from actual behavior, and contract
  tests assert the eleven documented codes stay contiguous and named.

• work diff <KEY> (CLI-56): review-style Work Item comparison with two
  server-authoritative modes. Default baseline mode compares against a local
  baseline recorded with work diff KEY --save-baseline — a per-user file
  under the config directory (baselines/<org>/<project>/<KEY>.json) that
  contains no credentials and is replaced only by another --save-baseline
  — and reports every changed field with before/after (title, description,
  status, priority, assignee, sprint, parent, labels, Attributes, due date,
  and more; identity, volatile, server-computed, and social fields are
  excluded and named in the output). --since <revision> reports the
  revision delta plus the field changes the server records in the item's
  activity feed with explicit coverage: partial and historySupported: false — the Public API v1 exposes no revision snapshots, and the CLI
  never fabricates a diff. Unchanged comparisons exit 0 with an explicit
  no-changes result; --fail-on-change exits with the conflict exit code
  (6) when differences exist. Human table rendering plus the versioned
  diffVersion: 1 document under --json.

• Shared saved-query library (CLI-57): SqueakQL queries can now live in a
  version-controllable directory, so teams share queries via the repository
  instead of only per-user local saves. Resolution precedence is strict and
  documented — repository .hamstik/queries/<NAME>.squeakql (discovered by
  walking up from the working directory), then config-dir
  queries/<NAME>.squeakql, then the existing queries.toml entries
  written by squeakql save (unchanged) — and collisions are never silent:
  the first source wins while squeakql list reports every holding source
  (sources) plus the winner (source). New squeakql run <NAME> executes
  a resolved query through the same pipeline as work search --saved NAME
  (also library-aware now), and squeakql validate --saved NAME and
  squeakql show resolve through the same precedence. Files hold only
  plain query text under the saved-query size cap; files with invalid name
  stems are ignored; there is no sync/upload — committing the file is the
  sharing mechanism, so a query committed to a repository runs identically
  for anyone who checks it out.

Fixed

• The CLI no longer crashes with a stack overflow on Windows when built in
  debug mode (the cargo build / cargo test profile). Windows defaults the
  main thread to a 1 MiB stack and some code paths — observed with large
  --file request bodies in the report/dashboard commands — exceeded it,
  aborting with STATUS_STACK_OVERFLOW before any diagnostic. hamstik now
  runs its full command dispatch on an explicitly 32 MiB thread on every
  platform, making stack depth uniform across Windows/macOS/Linux and across
  debug and release profiles. Release archives were never affected.

Internal

• Windows CI: the external-plugin integration tests now create
  platform-appropriate plugin stubs (.cmd batch files on Windows instead
  of extensionless #!/bin/sh scripts), so the six plugin invocation tests
  run and pass on windows-latest too. Test-only change; the CLI's plugin
  discovery and invocation were already correct on every platform.

Install hamstik-cli 0.6.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/blackboardstudios/hamstik-cli/releases/download/v0.6.0/hamstik-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/blackboardstudios/hamstik-cli/releases/download/v0.6.0/hamstik-cli-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install blackboardstudios/hamstik/hamstik

Download hamstik-cli 0.6.0

File	Platform	Checksum
hamstik-cli-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
hamstik-cli-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
hamstik-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
hamstik-cli-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
hamstik-cli-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum

0.5.0 - 2026-10-18

Release Notes

Changed

• Refreshed the frozen contract to Hamstik Public API v1.0.0: the parity ledger
  now classifies all 234 operations (125 newly exposed). hamstik api invoke <operationId> provides contract-aware coverage for method/path resolution,
  context-backed path parameters, documented query parameters, JSON and
  multipart bodies, operation-specific ETags/idempotency, binary downloads,
  dry-run previews, audit records, and structured output. The typed bulk-create
  model also accepts the expanded v1.0.0 request fields and template-backed
  creates whose title is supplied by the server template.

• hamstik agent skill install now installs the complete canonical skill,
  including its three references. Global installs honor HAMSTIK_SKILL_HOME
  as the .agents directory; modified reference files are protected from
  replacement without --force. The skill cookbook and installation guides
  now match the bundled CLI behavior.

Added

• Gated design stub for self update with stable/prerelease channels (CLI-79):
  design/SELF_UPDATE.md documents the intended
  hamstik self update [--channel stable|prerelease] surface, channel
  semantics, verified package replacement (checksum + provenance before any
  write, atomic and recoverable), and the safety constraints — explicit
  opt-in/opt-out, off-by-default automatic checks, no telemetry, and no silent
  network calls. No command or network behavior ships: the design names the
  packaging/release-milestone gate and the activation checklist, and the
  existing channel upgrade steps in design/INSTALL.md
  remain the only supported upgrade path.

• Webhook management (CLI-78): hamstik webhook now manages the Public API
  v1.0.0 Organization webhook surface with list/view/create/edit/delete,
  signing-secret rotation, server-owned test delivery, delivery history, and
  redelivery. The command validates required bodies, ETags, and idempotency
  from the frozen operation contract and never stores returned secrets.

• Server-side workflow automation rules (CLI-77): hamstik rule now manages
  Public API v1.0.0 Organization automation rules with
  list/view/create/edit/delete, run history, server preview, enablement toggle,
  and owner acceptance. The former local-rule proposal is superseded; no local
  evaluator, daemon, or polling event stream is introduced.

• SqueakQL query-plan passthrough and offline cache management (CLI-76):
  work search --explain forwards server-provided query-plan data under the
  response's explain field when the Public API returns it and otherwise
  degrades with a clear message on stderr (or explain.available: false in
  --json); the CLI never computes a cost model and never adds an unsupported
  field to the search request. squeakql cache size reports the local
  saved-query file's path, entry count, and on-disk byte size, and
  squeakql cache clear removes every locally saved query idempotently — both
  work fully offline and require no Organization or credential.

• API cookbook in command help (CLI-75): hamstik commands --cookbook prints
  a copy-pasteable read → search → edit → transition → comment loop with
  placeholder identifiers and safe automation defaults (--json --no-input,
  explicit --org/--project). --json emits the same steps as a versioned
  cookbookVersion: 1 document. The examples are the marker-delimited section
  of the canonical bundled Agent Skill, so the CLI cannot print guidance that
  hamstik agent skill check does not also validate.

• Failed-request journal and replay (CLI-72): when a Public API request
  fails, the CLI appends one redacted JSON line to a local
  request-journal.log capturing the method, path, intended header names, HTTP
  status, server request id, and timing. hamstik replay [--last N] prints the
  most recent entries as a human table or --json without making any network
  request, so a 5xx can be correlated with server-side diagnostics by request
  id. The journal never contains tokens, Authorization values,
  request/response bodies, or query strings; entries older than 7 days are
  dropped and at most 500 are retained, with compaction once the file exceeds
  256 KiB or its oldest entry passes 7 days. hamstik doctor reports the
  effective journal path.

• Support-bundle comparison (CLI-71): doctor --diff <bundle-file> diffs a
  freshly generated local-only support bundle against a previously saved
  doctor --bundle ZIP and reports only what changed. Differences are named
  by check id or JSON path (host, CLI version, context scopes, config
  metadata, and every redacted check), volatile capture noise
  (generatedAt, durationMs, requestId) is ignored, and an identical
  bundle yields an explicit "no differences" result in both human and
  --json output (noDifferences: true). --diff implies --local-only, so
  the comparison makes no network requests and reads no new sensitive data;
  --bundle can be combined to also write the fresh bundle; a missing or
  corrupt baseline fails clearly instead of reporting no differences.

Security

• Updated rustls to 0.23.46 and zip to 9.0.5 to resolve the current RustSec
  advisories. Linux/BSD credential storage now uses the maintained synchronous
  Secret Service backend instead of the unmaintained pre-zbus-6 wire stack;
  secrets remain in the operating system credential store.

Fixed

• The README no longer claims pre-alpha status with packaging "still under
  development"; the status banner now reflects the shipped installer/archive
  channels, the implemented Public API v1.0.0 surface, and the pre-1.0
  breaking-change policy (CLI-80).

• hamstik doctor now omits the proxy check when no proxy environment
  variable is configured instead of showing a confusing skipped row. A
  configured proxy is still reported by variable name with its value hidden;
  NO_PROXY alone does not count as a configured proxy.

• hamstik doctor now reports additive Public API v1 operations as a passing
  compatibility check instead of a warning. The additive operation count
  remains visible, while missing or moved operations required by this CLI
  continue to fail compatibility.

• doctor --bundle no longer prints its "support bundle written to ..."
  confirmation in --json mode, so doctor --json --bundle <PATH> output is
  a single parseable JSON document again.

• Git worktree context discovery (CLI-69): when the .hamstik.toml directory
  walk-up finds nothing and the working directory is inside a git checkout,
  the primary checkout behind a linked worktree is searched
  (git rev-parse --show-toplevel/--git-common-dir), mapping the current
  subtree onto the same relative path in the primary checkout. A linked
  worktree and monorepo Project subtree can therefore reuse the primary
  checkout's config without copying it; explicit flags, environment variables,
  and a worktree-local .hamstik.toml still win.

• Scheduled export and report snapshots (CLI-67): work export --query <SQUEAKQL> (or --query-file/--query-saved) selects a collection of
  Organization Work Items and renders it through the same output contract as
  work list/work search, so --format csv|jsonl|tsv|json|markdown|table,
  --columns, and --jq all apply and --output <PATH> writes exactly the
  bytes a stdout run would print. schedule list|save NAME -- <COMMAND…>|delete
  store the periodic invocation as a plain TOML file under
  <config-dir>/schedules/; the CLI ships no daemon, and an external scheduler
  (cron, systemd timers, Task Scheduler) invokes schedule run NAME, which
  re-executes the stored command through the same binary, context, and output
  mode, so a scheduled run is byte-identical to the equivalent manual
  invocation. Definitions contain only the hamstik argument vector — never
  credentials.

• work dashboard (CLI-65): a read-only, multi-project overview that
  composes the existing work mine read (GET /my/work, restricted to the
  Project set) with one work list read (GET .../projects/{key}/work-items) per configured Project. The Project set
  comes from repeated --project flags, otherwise from a
  dashboard_projects array in .hamstik.toml, otherwise from the resolved
  single Project. Project fetches run with bounded concurrency, and one
  Project's failure is reported in-band (per-section status/error and
  failedSections in --json, a stderr warning in human output) without
  hiding the other Projects' results; the exit code stays 0 for a partial
  snapshot, matching work triage. --mine false omits the My Work section,
  --scope selects the status scope (default open), and the shared
  pagination flags apply to every section. Human output renders one attributed
  table per section; --quiet prints only item keys.

• Deterministic color and terminal-profile negotiation (CLI-60): the global
  --color=auto|always|never flag (with the existing --no-color as the
  never alias) makes ANSI output explicit, and HAMSTIK_NO_COLOR joins
  NO_COLOR/CLICOLOR_FORCE/CLICOLOR under the documented precedence
  flag > environment > auto. HAMSTIK_TERM=auto|unicode|ascii pins the
  decoration profile: ascii emits ASCII stand-ins instead of Unicode
  swatches and separators, suppresses emoji, and fixes the board view width
  so captured CI logs are byte-stable. Default auto-detection is unchanged
  when no flag and neither new environment variable is set, and --json,
  --jsonl, and --tsv remain ANSI-free in every mode.

• work attachment view (CLI-40): preview an image attachment inline on a
  terminal that advertises the Kitty, iTerm2, or SIXEL image protocol,
  without writing a file. Detection is capability-based (KITTY_WINDOW_ID,
  TERM/TERM_PROGRAM markers, and an explicit HAMSTIK_IMAGE_PROTOCOL
  override). The image is only re...

0.1.3 - 2026-09-17

Release Notes

Added

• hamstik org use <slug> and hamstik project use <key> now auto-create a
  config profile on-the-fly when HAMSTIK_TOKEN is set but no stored
  credential or config profile exists. The CLI calls GET /api/v1/me to
  populate the new profile (host + identity), then validates the requested
  organization or project through the API before persisting it as the
  default. This matches the existing env-token auth flow used by other
  commands and eliminates the previous "no active profile" error for
  headless or ephemeral setups (org, project).

• hamstik work await <KEY> polls until a Work Item reaches a server-reported
  condition (repeatable --status, --timeout up to 1h with exponential
  backoff, human-readable and --json output). (CLI-25)

• Global configuration commands (CLI-6): hamstik config path|list|get|set|unset
  manages safe, non-secret defaults in ~/.config/hamstik/config.toml
  (editor, pager, output, git_branch_template, profile,
  organization, project). set rejects credential-like values (use
  hamstik credential or the OS keyring), and get/set/unset expose
  stable { key, value } or { path } JSON envelopes. Unknown keys and
  unsupported schema versions fail deterministically with exit code 10.

• Opt-in live Public API v1 acceptance suite (CLI-6):
  cargo test --test live_acceptance -- --test-threads=1 --ignored drives the
  real hamstik binary against a dedicated test Organization/Project over
  documented /api/v1 routes. Gated behind HAMSTIK_TOKEN, HAMSTIK_HOST,
  HAMSTIK_ACCEPTANCE_ORG, and HAMSTIK_ACCEPTANCE_PROJECT (plus
  HAMSTIK_ACCEPTANCE_MUTATIONS=true for writes) and #[ignore]d, so offline
  cargo test only compiles it. A read-only smoke scenario proves auth, TLS,
  context, and the read routes; a mutation scenario exercises the full
  lifecycle — idempotent create/replay, edit, a real ETag conflict, status
  transitions, labels, comments, links, watchers, byte-for-byte attachment
  round-trip, sprints, and bulk create/update/transition — cleaning up every
  Work Item it created (delete, archive fallback) without masking the primary
  failure. All created resources carry a run-unique acc-<unix-ts>-<pid>
  marker; labels and sprints (undocumented delete routes) are the only
  residue. Runbook: crates/hamstik-cli/tests/live_acceptance/README.md;
  a manual workflow_dispatch job (.github/workflows/live-acceptance.yml)
  runs it against a configured test deployment when repository
  variables/secrets opt in.

• Doctor support bundle (CLI-6): hamstik doctor --bundle <path> produces a
  versioned ZIP bundle (bundleVersion: 1) containing a redacted
  doctor-report.json, context-explain.json, cli-info.json,
  api-compatibility.json, config-metadata.json, and
  bundle-manifest.json. The bundle never contains PAT values, Authorization
  headers, credential-store contents, token-bearing environment variables, or
  credential-bearing proxy URLs. It is compatible with --local-only; remote
  checks are safely skipped when the flag is active. Automated redaction unit
  tests verify all bundle sections are secret-free.

• Work Item context bundle (CLI-21): hamstik work context <KEY> returns a
  one-invocation, data-only read bundle for a Work Item — metadata,
  description, server-reported links, labels, recent comments, recent
  activity, and the authenticated user's watcher state — composed entirely
  from Public API v1 reads. --json emits a stable, deterministic envelope
  (bundleVersion: 1); --format markdown renders the same content
  readably; --comments N, --activity N, and --compact bound the
  output size, and every clipped or omitted section carries an explicit
  marker (nothing is silently truncated). The bundle is data, not
  instructions: no workflow meaning is computed client-side, and the
  command is strictly read-only.

• Public API v1 passthrough (CLI-20): hamstik api request /api/v1/...
  and the shorthand hamstik api /api/v1/... call any documented Public
  API v1 route through the official CLI, in the spirit of gh api —
  including server routes newer than the installed CLI (the OpenAPI
  snapshot is never an allowlist). GET is the default; --method
  POST/PATCH/PUT/DELETE, --body-file -|<file>, --field key=value,
  --query key=value, and allowlisted --header overrides
  (Accept, Content-Type, If-Match — Authorization and any
  credential-bearing header are rejected) reuse the typed commands'
  transport: profile auth, TLS/CA bundle, retries with Retry-After
  handling, automatic idempotency keys for POST/DELETE reused across
  internal retries, request-ID preservation, redacted diagnostics, and
  stable exit codes. --dry-run previews the exact request with the
  versioned preview envelope; --json emits
  { method, path, data, meta? } with meta carrying requestId,
  etag, idempotencyReplayed, location, and the rate-limit snapshot.

• Canonical Agent Skill installation and validation (CLI-3): the new
  hamstik agent skill install writes the skill bundled into the binary
  (skills/hamstik/SKILL.md) into an Agent
  Skills discovery location — the current project's portable
  .agents/skills/hamstik/ directory by default, the user-level portable
  location with --global (override with HAMSTIK_SKILL_HOME). Re-running
  an install is idempotent when the installed file is identical; a locally
  modified installed skill is never silently overwritten — --force is
  required for replacement. hamstik agent skill check validates frontmatter
  CLI-version compatibility plus every referenced command path and option
  against this binary's live hamstik commands --json manifest, for the
  installed skill by default (project location, then global) or an explicit
  file path (CI use); failures exit nonzero.

Fixed

• Network diagnostics are now classified from the concrete transport error
  source chain (DNS, connection, timeout, TLS) instead of pattern-matching
  the rendered error text, so a library rewording can no longer silently
  degrade doctor and error output to the generic network stage.
• hamstik org use and hamstik project use now make the auto-created profile
  the active profile when they create it under an ephemeral HAMSTIK_TOKEN.
  Previously the default organization/project was written into a profile that
  profile selection never chose, so doctor and every command reported
  "organization not selected" even though the config contained the default.
• Auto-created profiles now seed the user's default organization from
  GET /api/v1/me (matching auth login), and configuration write failures
  during org use/project use report the configuration error class (exit 10)
  instead of a generic internal error.

Install hamstik-cli 0.1.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/blackboardstudios/hamstik-cli/releases/download/v0.1.3/hamstik-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/blackboardstudios/hamstik-cli/releases/download/v0.1.3/hamstik-cli-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install blackboardstudios/hamstik/hamstik

Download hamstik-cli 0.1.3

File	Platform	Checksum
hamstik-cli-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
hamstik-cli-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
hamstik-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
hamstik-cli-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
hamstik-cli-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum

0.1.2 - 2026-09-15

Release Notes

Added

• Release lifecycle documentation (CLI-30): the maintainer release
  procedure is documented end-to-end in design/RELEASE.md
  (version prep → tag → automated build/publish → post-release checks),
  broken/yanked-release handling and per-channel rollback in
  design/INSTALL.md, and credential-safe troubleshooting guidance
  aligned with doctor --local-only / context explain. Release notes
  remain derived verbatim from CHANGELOG.md (the release pipeline
  generates the announcement from the renamed section); every release
  section now carries the artifact-verification pointer so it renders in
  the release notes. Updates stay channel-based per SPEC §73: no silent
  self-update, no telemetry, no background version checks.
• Verify downloads per design/SIGNING.md: run
  sha256sum -c sha256.sum against the release's sha256.sum and
  gh attestation verify <artifact> --repo blackboardstudios/hamstik-cli
  (Sigstore build provenance). See also upgrade/uninstall/rollback notes
  in design/INSTALL.md.

Install hamstik-cli 0.1.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/blackboardstudios/hamstik-cli/releases/download/v0.1.2/hamstik-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/blackboardstudios/hamstik-cli/releases/download/v0.1.2/hamstik-cli-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install blackboardstudios/hamstik/hamstik-cli

Download hamstik-cli 0.1.2

File	Platform	Checksum
hamstik-cli-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
hamstik-cli-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
hamstik-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
hamstik-cli-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
hamstik-cli-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum

0.1.1 - 2026-09-15

Release Notes

Added

• Installable release channels (CLI-29): a curl-able shell installer
  (hamstik-cli-installer.sh) for Linux/macOS, a PowerShell installer for
  Windows, and a Homebrew formula published per stable release to the
  blackboardstudios/homebrew-hamstik tap (brew tap blackboardstudios/hamstik https://github.com/blackboardstudios/homebrew-hamstik
  then brew install blackboardstudios/hamstik/hamstik). Winget manifests
  are generated per stable release into winget/ and submitted to
  microsoft/winget-pkgs by a maintainer (deliberate manual step). Linux
  ships tarball + installer; .deb/.rpm and hosted APT/RPM repositories
  are deliberately deferred (design/INSTALL.md decision record). The
  Homebrew formula's sha256 lines are injected from the release's
  aggregate checksums at publish time, and the tap push requires a
  dedicated fine-grained PAT (HOMEBREW_TAP_TOKEN) scoped to the tap
  repository only.

Install hamstik-cli 0.1.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/blackboardstudios/hamstik-cli/releases/download/v0.1.1/hamstik-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/blackboardstudios/hamstik-cli/releases/download/v0.1.1/hamstik-cli-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install blackboardstudios/hamstik/hamstik-cli

Download hamstik-cli 0.1.1

File	Platform	Checksum
hamstik-cli-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
hamstik-cli-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
hamstik-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
hamstik-cli-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
hamstik-cli-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum

0.1.1-rc.1 - 2026-09-15

Release Notes

Added

• Release supply-chain verification (CLI-28): every release now publishes
  CycloneDX 1.5 SBOMs (hamstik-cli.cdx.json,
  hamstik-api-client.cdx.json) generated from the committed Cargo.lock,
  and Sigstore build-provenance attestations for every downloadable asset.
  The release pipeline verifies all checksums and attestations before
  anything is published and fails closed on a mismatch. Verify downloads
  with sha256sum -c sha256.sum and gh attestation verify <artifact> --repo blackboardstudios/hamstik-cli; see design/SIGNING.md for the
  threat model and the deferred platform-signing decision (Windows
  Authenticode and macOS notarization await certificate provisioning).

Fixed

• Updated rustls to 0.23.45 for RUSTSEC-2026-0285 (TLS 1.3 handshake
  messages incorrectly accepted across encryption level boundaries).

Download hamstik-cli 0.1.1-rc.1

File	Platform	Checksum
hamstik-cli-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
hamstik-cli-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
hamstik-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
hamstik-cli-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
hamstik-cli-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum

0.1.0 - 2026-09-15

Release Notes

Added

• Versioned release builds (CLI-27): pushing a version tag (vX.Y.Z) now
  triggers a cargo-dist release pipeline that builds, smoke-tests, and
  publishes archives for the supported platform matrix — Linux glibc x64 and
  arm64 (.tar.gz), macOS Intel and Apple Silicon (.tar.gz), and Windows
  x64 (.zip), each with a sha256 checksum. The pipeline fails closed when
  the tag, the workspace Cargo.toml version, and the matching
  CHANGELOG.md release section disagree, and runs artifact-level smoke
  tests (the released binary itself: --help, version, and an offline
  doctor --local-only) before anything is published. Pull requests
  validate the release configuration in plan mode only. See
  design/RELEASE.md for the target matrix, exclusions, and maintenance
  workflow.

• hamstik version now reports build identity: human output adds
  commit (short source commit) and target (Rust target triple) lines
  under the banner, and --json output adds additive commit (full
  commit sha, or "unknown" when built outside a git checkout) and
  target fields. The existing version field and the hamstik --version/-V terse line are unchanged.

• context explain (CLI-12): an offline precedence report for every resolved
  setting — host, Organization, Project, profile, credential source, and
  color/input/retry behavior — showing the winning source, every shadowed
  source, and context-file discovery. JSON output uses stable source/status
  enums; HAMSTIK_TOKEN and stored credentials are represented only as
  present/absent, never displayed. Malformed context files degrade the report
  rather than aborting it (context).

• SqueakQL query files and saved queries (CLI-8): squeakql validate and
  work search accept --file <PATH> (- = stdin) alongside the existing
  inline expression, with multi-source conflicts rejected at parse time and
  one trailing newline stripped (all other content verbatim). A local
  saved-query store (queries.toml next to the config; plain expressions
  only, never credentials) with squeakql list|show|save|delete, name
  validation, and --saved <NAME> on validate/search. Validation JSON
  preserves the full Public API response including error spans; read-only
  SqueakQL POSTs carry no Idempotency-Key (squeakql, work).

• Editor authoring and consistent stdin conventions (CLI-7):
  --description-editor/--body-editor launch $VISUAL (then $EDITOR,
  then a platform default) on a secure owner-only temporary file removed on
  every exit path; unchanged or empty content cancels the command without
  sending. Source conflicts (inline + file + editor) fail at argument-parse
  time. --no-input rejects editor authoring immediately. Text content is
  preserved verbatim (Unicode, Markdown # headings, final-newline
  semantics) (work, project).

• Work Item watcher commands backed by the newly additive Public API
  operations (getWorkItemWatcher, updateWorkItemWatcher): work watcher show|watch|unwatch|mute|unmute report and change the authenticated user's
  own watcher state (never other watchers'). Actions are idempotent
  (Idempotency-Key, replay note) and carry no revision guard; the
  operations are classified as Complete in openapi/api-parity.json with
  client and CLI wire tests (work).

• Coherent PAT onboarding and troubleshooting journey: auth status --json now
  reports credential type/name, expiry, the credential source (environment vs
  credential store), and a structured scope inventory; near-expiry credentials
  warn within 14 days on every authenticated run, and client-detected expiry
  fails auth status with the stable authentication exit code. me surfaces
  the same expiry summary and scope inventory. Structured 401/403 failures
  preserve code/status/request ID with CLI-added remediation
  (auth, me, doctor).

• README examples verification harness (scripts/readme_examples.py, guarded by
  the Rust readme_examples contract test in cargo test): every executable
  README shell block is classified (parse-only, mock, prose) and verified
  against the actual binary; untestable prose blocks are explicitly exempted,
  so examples cannot drift from real flags, enums, or output conventions.
  Run the harness with python3 scripts/readme_examples.py --verbose after
  cargo build --release.

• Bulk operations preflight: operation files are validated locally (JSON syntax,
  typed envelope, per-operation required fields, unknown fields, enum spellings,
  revision constraints, 1–50 count) before any request, with diagnostics naming
  the failing operation index and field path. Human bulk output states the
  selected concurrency mode, summarizes succeeded/failed counts, and prints
  actionable per-failure details with server request ids; JSON preserves all
  documented per-operation fields. Stdin and file inputs behave identically
  (work).

• doctor --local-only verifies configuration, context resolution, profile
  selection, credential-store accessibility, terminal behavior, and bundled
  compatibility metadata with zero network traffic; remote checks are reported
  as skipped, making the output safe for support bundles. Doctor now classifies
  network failures by failing stage (DNS, TCP connection, proxy, timeout, TLS)
  with stage-specific remediation and per-check latency, reports PAT expiration
  (expired / within 14 days / healthy) and scope readiness, and prints a final
  pass/warn/fail/skipped summary in human and JSON modes (doctor).

• Deep parsed-OpenAPI schema parity guards: parameters, header parameters
  (If-Match, Idempotency-Key), request/response content types (multipart
  uploads, binary avatar downloads), response status codes, component schema
  drift (required/optional/nullable, enums, formats, property removals), and
  bulk envelope bounds are checked structurally against the checked-in
  snapshot, with additive changes classified separately from breaking drift
  and failures naming the operation or JSON pointer (openapi).

• Global --dry-run flag for mutation commands (work create/edit/transition/start/close/ archive/unarchive/delete, work label add|remove, work attachment upload|delete,
  work comment add|edit|delete, work link add|delete, work bulk create|update|transition,
  project create/edit/archive/unarchive, sprint create/transition, label create).
  The CLI resolves identifiers and validates local input exactly as a real invocation
  would, then emits a versioned preview (previewVersion: 1) with method, path template,
  resolved path, sanitized header intent (If-Match, Idempotency-Key — never
  Authorization), and the typed request body, without sending any mutation request or
  consuming an idempotency key. Read commands reject the flag with a usage error
  (work).

• Canonical portable Hamstik Agent Skill at skills/hamstik/SKILL.md, covering
  credential-safe CLI usage, explicit context discovery, deterministic output,
  concurrency-aware mutations, Work Item workflows, user/Org member resolution,
  bulk update/transition concurrency modes, and structured failure handling.

• Full support for the current 53-operation Hamstik Public API v1 contract,
  including me, first-class work mine / work my, SqueakQL search via
  work search, independent squeakql validate, and unauthenticated
  api openapi contract retrieval.

• Parsed OpenAPI parity enforcement through openapi/api-parity.json; adding,
  removing, or moving an operation now fails a test until client, CLI, and test
  support are deliberately classified.

• scripts/update-openapi.sh --check|--update for explicit live-contract drift
  checks and validated byte-for-byte snapshot refreshes without making offline
  builds network-dependent.

• Typed API client crate (hamstik-api-client) with bearer injection,
  retry policy with Retry-After awareness, idempotency-key generation,
  ETag capture, cursor pagination helpers, and multipart upload support.

• Frozen Hamstik Public API v1 OpenAPI snapshot (openapi/hamstik-v1.json)
  as the development contract.

• auth login --with-token, auth status, auth list, auth switch,
  auth logout, and auth forget with PAT storage in the OS credential
  store (Windows Credential Manager, macOS Keychain, Linux Secret Service);
  headless automation via the HAMSTIK_TOKEN environment variable (auth).

• Working-context management: context init, context show, context set,
  context clear, backed by a project-local .hamstik.toml plus global
  profile defaults (context).

• Organization and project commands: org list|view|use,
  project list|view|create|use (org, project).

• Work item commands: work list|view|create|edit, status transitions
  (work transitions, work transition, work start, work close),
  comments (work comment list|add|delete), labels
  (work label add|remove), and attachments
  (work attachment list|upload|download|delete) (work).

• Sprint commands: sprint list|view|create|transitions|transition with
  completion actions (--move-to-backlog / --move-to-sprint) and Sprint
  ETag handling (sprint).

• Project label management: label list|create (label).

• Work item list filters, including label, labelName, parent,
  topLevel, sprint, and updatedAfter.

• Machine-facing output: --json / --quiet global modes, stable exit
  codes (SPEC §52), raw API body echo in --json, and an ANSI-free JSON
  failure envelope on stderr.

• Dependency-aware diagnostics: hamstik doctor reports configuration and
  context sources, credential source/store health, proxy presence,
  network/TLS reachability, live OpenAPI availability and compatibility,
  authentication, selected Organization/Project validity, and terminal
  rendering. JSON checks have stable IDs and explicit
  pass|warn|fail|skipped statuses while retaining the origina...