v1.0.0

First stable release. The command grammar, JSON envelope, exit codes and
config layout are now considered stable; breaking changes to them will come
with a major version bump.

Added

• plivo agents — manage AI agent flows against the public Agents API:
  create, get, list, update, delete, the publish/pause/resume
  lifecycle verbs, plus agents runs for executions and agents nodes for
  the node catalogue. --all auto-paginates agents list and
  agents runs list, and is registered only on the commands that implement
  it rather than globally.
• Multi-organization login. plivo login now names the saved profile after
  the organization instead of always default, so authorizing a second
  organization no longer overwrites the first. -n/--name still overrides,
  re-authorizing the same organization updates it in place, and a different
  organization gets its own profile rather than clobbering one. plivo auth list shows the organization per profile.
• plivo ask sends a client-minted conversation id, so the turns of one
  conversation group together instead of appearing unrelated.

Fixed

• plivo ask no longer treats a handful of event names as stream
  terminators that the server does not send; they are retained as
  forward-compatible no-ops and documented as such.

---

Verifying this release

for f in SHA256SUMS SHA256SUMS.sig SHA256SUMS.pem; do
  curl -fsSLO "https://github.com/plivo/plivo-cli/releases/latest/download/$f"
done

cosign verify-blob SHA256SUMS \
  --signature SHA256SUMS.sig --certificate SHA256SUMS.pem \
  --certificate-identity cx-tech@plivo.com \
  --certificate-oidc-issuer https://accounts.google.com

v0.4.1

Fixed

• The agent skill file taught the retired JSON shape. Three of its own
  examples still used .data[] for list commands, which v0.3.0 moved to
  .data.objects[] — the same file that documents the change. An agent
  installing the skill and copying an example got
  Cannot index string with string "number". A test now runs the file's
  examples, so this cannot ship again.
• --explain was a global flag that only 7 commands implemented, so on the
  other 165 it was silently ignored — the same defect that got --all
  removed in v0.3.0. It is now registered only on the commands that support
  it (api, applications create, auth whoami, calls make,
  messaging send, numbers buy, numbers release); elsewhere it returns
  unknown flag: --explain instead of pretending.

Added

• The skill file now points at the three product skills
  (plivo-audio-streaming, plivo-sip-trunking, plivo-voice-xml), which
  an agent installing the CLI skill previously had no way to discover.

---

Verifying this release

cosign verify-blob SHA256SUMS \
  --signature SHA256SUMS.sig --certificate SHA256SUMS.pem \
  --certificate-identity cx-tech@plivo.com \
  --certificate-oidc-issuer https://accounts.google.com

v0.4.0

Added

• voice streams forward no longer needs ngrok. It defaults to
  localhost.run over ssh — no install, no account, nothing to sign up for —
  and uses ngrok instead when it is already on PATH. --tunnel auto | ngrok | localhost.run forces a choice.

• Release provenance. SHA256SUMS is now signed with cosign keyless, and
  install.sh, install.ps1 and plivo upgrade all verify that signature when
  cosign is available — pinning the signer identity and OIDC issuer, without
  which any Sigstore identity would produce a passing check. Unsigned releases
  and machines without cosign still install; a signature that is present and
  fails is fatal.

• plivo docs — read the documentation from the terminal. docs search <keywords> full-text searches every page (a page must contain all the
  keywords, ranked by frequency), docs list shows the index, and
  docs show <path-or-title> prints one page. Backed by the docs site's own
  llms.txt / llms-full.txt exports, so it needs no credentials and works
  in a bare container. The full text is cached under ~/.plivo/cache for a day;
  --refresh re-fetches, and a stale cache is served if the network is down.

Fixed

• voice streams emitted the wrong audio contract. The <Stream> XML
  carried contentType and sampleRate as two attributes; the rate belongs
  inside contentType (audio/x-mulaw;rate=8000) and there is no sampleRate
  attribute. The l16 MIME type was also wrong — audio/x-l16, not audio/l16.
  Separately, streams test --codec l16 announced 16-bit PCM but generated
  mu-law bytes at half the expected frame size, so the pre-flight passed while
  the endpoint received noise. Both spellings and the audio generator now come
  from one place, and an unsupported codec/rate pair is rejected up front —
  there is no mu-law 16kHz stream.
• An unknown subcommand exited 0. plivo voice streams bogustypo printed
  help and reported success; the same hole existed on 35 command groups. Cobra
  only rejects an unrecognized subcommand for the true root, so every parent
  command that hosts only subcommands silently short-circuited to help. A bare
  group invocation still prints help and exits 0.
• -o json is now honoured by voice streams test, voice streams forward
  and upgrade, which previously always printed prose. Each emits a single
  machine-readable summary of the run, and progress output is suppressed so
  stdout stays parseable.
• make sign-release failed outright against cosign 3.x, which defaults to a
  bundle format requiring --bundle. The signing path had never been executed
  end to end.

---

Verifying this release

cosign verify-blob SHA256SUMS \
  --signature SHA256SUMS.sig --certificate SHA256SUMS.pem \
  --certificate-identity cx-tech@plivo.com \
  --certificate-oidc-issuer https://accounts.google.com

v0.3.0

What's Changed

• chore: remove dead code flagged by golangci-lint by Priyanshu (@priyanshu-plivo) in #24
• docs: add npx skills install method to README by Priyanshu (@priyanshu-plivo) in #26
• feat(ask): animated working spinner so long runs don't look frozen by Priyanshu (@priyanshu-plivo) in #27
• SER-6419: exercise every shipped platform and test the installers in CI by Priyanshu (@priyanshu-plivo) in #31
• SER-6421: make -o json lossless by Priyanshu (@priyanshu-plivo) in #32
• SER-6422: telemetry opt-out and a plivo config command by Priyanshu (@priyanshu-plivo) in #33
• SER-6427 + SER-6428: streams forward safety and the small-fixes batch by Priyanshu (@priyanshu-plivo) in #34
• SER-6429: let env-var credentials beat a stored profile by Priyanshu (@priyanshu-plivo) in #35
• deps: bump the gomod-minor-patch group across 1 directory with 3 updates by Dependabot (@dependabot)[bot] in #28
• ci: bump actions/upload-artifact from 4.6.2 to 7.0.1 by Dependabot (@dependabot)[bot] in #15
• SER-6423: stop diagnose turning a typo into a support ticket by Priyanshu (@priyanshu-plivo) in #41
• docs: document the v0.3.0 changes, including the breaking JSON shape by Priyanshu (@priyanshu-plivo) in #42
• docs(changelog): cut v0.3.0 by Priyanshu (@priyanshu-plivo) in #43

New Contributors

• Dependabot (@dependabot)[bot] made their first contribution in #28

Full Changelog: v0.2.0...v0.3.0

v0.2.0

What's Changed

• CLI: stream ask answers, slim profile, add plivo skill install, fix login copy by Priyanshu (@priyanshu-plivo) in #21
• v0.2.0: interactive ask (-i) + SHA256 supply-chain verification by Priyanshu (@priyanshu-plivo) in #23

Full Changelog: v0.1.2...v0.2.0

v0.1.1

What's Changed

• fix(login): send cb_port instead of cb URL to dodge WAF SSRF block on browser login by Priyanshu (@priyanshu-plivo) in #16

Full Changelog: v0.1.0...v0.1.1

v0.1.0 — first public release

v0.1.0 — first public release

First post-public release after the repo flip. Includes the chokepoint
analytics work, voice streams test/forward, feedback (manual + auto-prompt),
the LLM-agent skill, and identity-header plumbing for PostHog Person
stitching. See CHANGELOG.md.

v0.1.0-beta.1

Full Changelog: https://github.com/plivo/plivo-cli/commits/v0.1.0-beta.1