v0.4.0

[0.4.0] - 2026-09-23

Added

• .gitignore-Aware Workspace Traversal: Added unified workspace walker (src/retrieval/workspace_walker.ts) shared across search_chunker, repomap, and ast_search. Evaluates hierarchical .gitignore files leaf-to-root with directory pruning (dir/), wildcard descent (dir/*), child negation overrides (!keep.ts), and additive .piignore support.
• Transactional Incremental Vector Updates: Added updateFile() to HybridSearchIndex to re-chunk only modified files on mutation and reuse cached 768d vectors by content hash across line shifts and untouched functions.
• Generational Protection & Query-Time Freshness: Protected in-flight file updates with generation counters to cancel superseded jobs, and made search() await active updates for strict snapshot freshness.
• Debounced Disk Persistence: Implemented scheduleDebouncedSave() and flushPendingSave() to coalesce rapid sequential mutations into debounced atomic writes and guarantee persistence on session shutdown.
• Direct Ignore Dependency: Added "ignore": "^7.0.5" as an explicit dependency for standards-compliant pattern matching.
• Reference Configuration Template: Added config.example.toml as a clean, documented template for project (.pi/config.toml) and global (~/.pi/agent/config.toml) settings.
• Test Suites: Added comprehensive regression suites for security hardening (tests/security-hardening/), Windows deep verification (tests/windows-deep-verification.ts), incremental updates (tests/retrieval/incremental_update.test.ts), and gitignore traversal parity (tests/retrieval/gitignore_traversal.test.ts).

Changed

• Profile Scope Expansion: Fully aligned configuration types, TUI selectors, and CLI subcommands to support auto (adaptive VPS/desktop profile) and off (completely disabled retrieval) alongside lean, hybrid, and full.
• Decoupled Snapshot Invalidation: Ignore configuration hashes (.gitignore, .piignore) are tracked in dedicated snapshot metadata (ignoreConfigHashes) rather than indexed code file tables, automatically purging newly-ignored files on the next search without reporting phantom files.
• Live Retrieval Configuration Sync: Unified /engine, SearchControlModal, and /agent-kernel commands to reconfigure running HybridSearchIndex instances and refresh statusline/footer badges immediately upon profile change without requiring session reloads.
• Hierarchical Config Scoping: Enforced strict configuration isolation where project-level changes write strictly to local .pi/config.toml, following the hierarchy: Project TOML > Global TOML > Legacy JSON > Lean defaults.
• Index Mutation Purity: Removed silent disk-write side effects from HybridSearchIndex.setProfile().

Fixed

• Retrieval Index Pollution: Search chunking respects .gitignore rules and hard exclusions (agent-kernel-benchmark/cache/, .git/, node_modules/), preventing third-party benchmark fixtures from polluting workspace search indexes.
• Symlink & Path Containment: Traversal skips symbolic links and confirms canonical paths remain bounded inside the workspace root.
• Windows Path & Line Ending Resilience: Preserved CRLF line endings during smart anchor edits and syntax verification without introducing mixed newlines. Normalized relative display paths to POSIX forward slashes in read, edit, and LSP formatters.
• NTFS Case-Insensitive Collisions: Prevented duplicate target path collisions in multi-file edits on case-insensitive filesystems. Handled case-insensitive path comparisons in LSP references and AST symbol search.
• PowerShell Clamping & Windows Executables: Intercepted and clamped powershell tool output in tool_result hooks alongside bash, and recognized .cmd, .bat, and .exe extensions in epistemic guard inspection.
• LSP Installer Discovery: Required confirmed executable presence on disk before reporting successful LSP server installation.
• Config Tracking Removal: Untracked root config.toml from Git and removed it from package distribution. Default configurations run purely in-memory, while user overrides persist cleanly to .pi/config.toml (workspace, gitignored) or ~/.pi/agent/config.toml (global).
• Deferred Settings Application in /agent-kernel TUI: Cycling through setting options (e.g. lean -> hybrid -> full) no longer writes intermediate states to disk or triggers intermediate re-indexing runs. Changes are buffered in-memory and applied in a single atomic batch only when the user closes the modal (Esc / q).
• In-Flight Re-indexing Cancellation on Profile Switch: Fixed a race condition where switching retrieval profiles while background indexing was active (e.g. hybrid -> full) continued running the superseded profile's embedding loop and overwrote the statusline with the old profile tag. In-flight sync jobs are now cleanly aborted via generation tokens and abort controllers, and the statusline immediately tracks the newly active profile.

Security

• TOML Prototype Pollution Hardening: Hardened parseToml and mergeDeep using null-prototype dictionaries and explicit rejection of dangerous keys (__proto__, constructor, prototype).
• Safe Executable Discovery: Replaced shell-spawning executable resolution with direct filesystem PATH/PATHEXT scanning and execFileSync.
• LSP Stdio Framing Guard: Enforced strict Content-Length boundary checks, exact decimal matching, and stream resynchronization recovery against malformed headers and buffer overflows.
• Bounded Session Repair: Added bounded session repair log scanning with atomic writes and filtered out symlinks during temporary spillover log cleanup in /tmp.

Removed

• Legacy /profile Command & codebase_profile: Completely removed the redundant /profile slash command (auto, light, heavy, status), codebaseProfileBySession tracking map, and unused repo-map scale injection code in before_agent_start.
• Codebase Scale Settings: Removed codebase_profile from RetrievalConfig, TOML defaults, environment variables (PI_CODEBASE_PROFILE), /agent-kernel CLI (set codebase), and the TUI settings modal. Code retrieval configuration is now unified exclusively under /engine and /agent-kernel.