v0.2.0

This release lands the host bridge (run host dwe/docker/git from inside your containers), the new dwe vars command, a formalized and strictly-validated project config root, and a service config-rendering + generated-secrets subsystem — plus verbose/debug diagnostics and a reworked validation surface.

⚠️ Breaking changes

• lifecycle.yml → top-level update: block. The self-update policy moved out of lifecycle.run.update into a formalized top-level update: { mode: on|off } block. Enabling update no longer blanks your run phases. (#10)
• Strict project root. The merged workspace.yml → defaults.yml → local.yml root now rejects any unknown top-level key with a hard error. Free-form values belong in the new vars: sandbox. (#10)
• Host bridge is opt-in. bridge.enabled defaults to off for every service, and user commands are container-reachable only via an explicit bridge: block. (#9)

✨ Features

Host bridge (#9)

Run host-side dwe commands from inside a container through a host daemon + injected shim. Default-deny command allowlist, per-service opt-in (bridge.enabled, bridge.services), hardened env (strips LD_*/DYLD_*/PATH hijacking across the trust boundary), and a dwe bridge subtree (start/stop/status/logs). Container writes to vars: are gated by a deny-by-default bridge.vars_writable allowlist.

dwe vars (#14)

Inspect, edit, and trace the vars: sandbox: dwe vars (list), vars get, vars set (comment-preserving local.yml writer), and vars inspect with a field-aware usage scanner that shows exactly which config fields reference each variable. Includes a TUI vars browser.

Project config formalization (#10)

A strict, allowlisted top-level root; the vars: sandbox for arbitrary nestable values (${vars.db.host}, from: vars.db.x); and the formalized update: { mode } block, all 3-layer merged.

Service config rendering + generated-once values (#6)

Render per-service config files through the ${...} template substrate (render.config), and harvest service-generated secrets (e.g. php artisan key:generate) back into a write-once store via pattern. New dwe render config --harvest and reset --clear-generated. Replaces the legacy copy mechanism (now deprecation-warned).

Verbose / debug diagnostics (#8)

-v/--verbose echoes command actions and pipeline decisions; --debug (or DWE_DEBUG) adds docker probes, timings, exit codes, and compose env. All diagnostics go to stderr only — stdout (incl. --output json) stays clean.

Validation (#7, #13)

New post-setup check stage with a config_keys_present builtin, plus per-domain result tables, a severity filter, and cleaner linter output in dwe validate.

🐛 Fixes

• Skip extends-alias children during whole-project config render to avoid false missing-key warnings. (#12)
• Bound the prompt's stale-running trust cap and probe the configured daemon.
• Fall back to the project root for an untranslatable cwd across the bridge.

📚 Docs

• Host bridge concepts + reference, config render pack, bridge.vars_writable, verbose/debug mode, and re-synced RU translations.

Full changelog: v0.1.3...v0.2.0