v1.0.0

1.0.0 (2026-08-27)

⚠ BREAKING CHANGES

• CD: no longer requires manual workflow dispatch; release now triggers
  automatically on push to main when commit messages follow Conventional Commits

• fix(CD): split publish into 3-job pipeline with post-publish validation

• ci: lint + test on every push (gate before release)
• release: semantic-release bump + npm publish (only runs if ci passes)
• validate: download published package from npm + re-run smoke tests
  against the exact version that was published

This ensures the published package is tested before the pipeline
passes, catching any bundling or missing-file issues.

• fix(validate): test actual published npm tarball, not local build

• validate job now downloads the exact .tgz published to npm
• Verifies: critical files inside tarball, package.json version match,
  CLI binaries (codeatlas/codeatlas-mcp/codeatlas-enterprise) are installed and loadable
• Removed local dist/ reuse — every check runs against the real published artifact

• fix(release): expose bumped version as job output for downstream validate job

• Extract version from package.json after semantic-release bumps it in-place
• Pass version to validate job via needs.release.outputs.version
• Removed duplicate package/package.json check line

• address PR review: tighten permissions, document Conventional Commits

Permissions: drop id-token/write from top-level; only ci/release jobs
that need write receive it (release needs GITHUB_TOKEN push).

CONTRIBUTING.md: add Conventional Commits type table with version
bump semantics (feat=MINDIR, fix=PATCH, feat!=MAJOR, etc.) and
note that releases publish automatically to npm on merge to main.

.devlog note: no pre-release 'next' branch — public package, one
production channel.

• fix(CD): remove redundant prepublishOnly and version verification

• Remove prepublishOnly: @semantic-release/npm runs the build internally
  via its own prepare hook, so prepublishOnly is redundant and can cause
  double-build or ordering conflicts
• Remove custom version extraction from tarball: @semantic-release/npm
  guarantees the published tarball version matches package.json; a separate
  extraction step is unnecessary
• Add inline comments to CLI binary verification: each binary now has
  a comment explaining its purpose so failures are easier to triage

• fix(ci): add explicit Build step before lint and test

The build step must run independently so compilation errors are caught
separately rather than buried inside the test output. The same applies
to the release job — dist/ must exist before npm pack --dry-run.

• fix(CD): remove id-token write permission, clean up stale comments

• Remove id-token: write from release job — semantic-release uses
  GITHUB_TOKEN (auto-provided by GitHub Actions), not OIDC token
• Add clarifying comment to release job: npm pack --dry-run is a fast
  pre-publish check; semantic-release handles its own build internally

• docs: reference .releaserc.json in CONTRIBUTING.md

Reviewed feedback that isn't actionable: npm cache already handled by
setup-node@v4 (cache: npm), cancel-in-progress kept false for safety
(releases are idempotent per version, but mid-flight cancellation is risky).

Features

• --sync-dreams CLI flag — one-shot dream sync for Hermes/Claude pre-init (4fc8a66)
• add AI-powered security scan with DeepSeek V4 Pro (a1762f7)
• add CLI setup wizard and health diagnostics tool for CodeAtlas integration (de6c2a1)
• add GitHub Actions CI/CD pipeline (c5595eb)
• add hono dependency to package.json (f09ba61)
• add indexing progress tracking & smart workspace discovery (d490e93)
• add isSystemIdeDirectory helper to prevent indexing IDE system and extension directories (e10eb3d)
• add manage_adr and get_code_snippet MCP tools (5b86c3b)
• add project-level indexing status check via API and implement unit tests for watcher service (cc6be41)
• add sync_dreams MCP tool + offset pagination support (dbef270)
• auto-detect GEMINI_CLI_IDE_WORKSPACE_PATH for zero-config workspace fallback discovery, bump version to 2.1.43 (65ff2a6)
• CD: add semantic-release for automatic versioning and npm publish (#168) (85f8db7)
• database-first memory architecture and cloud sync integration (203773c)
• default enableEnterpriseSync to true and bump client version (e5ad57c)
• enforce strict sequential CI pipeline (5ea525e)
• implement automatic workspace discovery via parent process traversal and add test suite support (5b0bf2c)
• implement dreamingService for persistent AI memory storage and expose via MCP tools (fe808c4)
• implement episodic memory retrieval (GET) on mcp client version 2.2.0 (6bcc4f0)
• implement persistent file logging, CLI API key argument parsing, and add codeatlas-mcp binary alias (15ad08e)
• implement startup background auto-indexing for active workspace (v2.1.32) (0cd669c)
• implement ultra-fast incremental re-indexing (v2.1.36) (0f99f6f)
• include variables in parser statistics and code analysis metrics (9a8a98e)
• initial commit for ultra-lightweight CodeAtlas MCP Gateway (1c89dcd)
• public-ready optimization — docs, security, package boundary (#148) (7215847)
• restrict directory recursion depth and add common system paths to default ignore list (e0c2dc9)
• restrict project paths and limit recursive file traversal to prevent broad system scans (2751f87)
• security: complete local-first security refactoring, removed firebase & oracle, HTTPS REST sync, version 2.1.24 (882fbe9)
• support CODEATLAS_PROJECT_DIR and --projectDir fallback, bump version to 2.1.42 (2b88854)

Bug Fixes

• add apiKey query param to dreamingService HTTP calls (612814f)
• add missing authorization check to project_context tool (5896b72)
• add missing authorization check to project_context tool (00dc68d)
• API key no longer embedded in generated plugin files (#62) (cf8f91a), closes #58 #54
• auth: prevent authentication bypass by removing mock fallback user (7126686)
• change dependency and fallback spawn name to unscoped supergateway, version 2.1.22 (dbf7ead)
• collapse CI into single job (5ab7360)
• God Object detection uses 'contains' link type (was 'import' — never fired) ([#60](ht...