v0.9.0

What's Changed

• ADR-037 P1: local↔cloud two-way memory sync (sync mode, UUID identity, text-only push) by @usercise in #425
• arch: ADR-005 CLI slug→UUID resolution for cloud dogfooding by @usercise in #427
• CLI: resolve project slug to UUID for cloud-routing memory servers (ADR-005) by @usercise in #428
• feat(cli): spelunk login / logout commands (ADR-037 P3) by @usercise in #430
• build(deps): bump tower-http from 0.6.11 to 0.7.0 by @dependabot[bot] in #432
• build(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #431
• chore(deps): semver-compatible cargo update by @usercise in #433
• fix(cli): send JSON body on device-init so GFE doesn't reject spelunk login with 411 by @usercise in #436
• fix(login): persist token as server_key; remove redundant api_key field (#437) by @usercise in #438
• ci: fix macOS test job link failure (drop embed-native, bust stale cache) by @usercise in #440
• docs(changelog): roll [Unreleased] for the v0.9.0 cut by @usercise in #435
• feat: replace fastembed/Nomic with candle-served F2LLM-v2-330M (896-dim, Metal/GPU) by @usercise in #439
• feat(embedder): Q8_0 + int8 quantization for F2LLM (incl. #19 GQA fix) by @usercise in #441
• feat(cli): WorkOS-direct device login, token auto-refresh, org switch (ADR-047) by @usercise in #445
• docs: v0.9 embedder changelog + indexing/protocol docs by @usercise in #442
• release: cut v0.9.0 by @usercise in #447

Full Changelog: v0.8.3...v0.9.0

v0.8.3

What's Changed

• fix(indexer): use per-batch UUID delimiter in batch summariser (#404) by @usercise in #413
• fix(storage): escape LIKE metacharacters in file-path queries (#406) by @usercise in #414
• fix(fuzz): repair fuzz crate after 3-crate workspace migration by @usercise in #417
• fix(fuzz): suppress upstream tree-sitter-sequel scanner leak by @usercise in #418
• bench(memory): author blind question sets for Decision Archaeology by @usercise in #377
• fix(storage): parameterise SQL IN-clauses with bind-limit chunking (#405) by @usercise in #420
• fix(explore): confine read_file to indexed files within project root (#403) by @usercise in #419
• fix(server): use time-ordered UUIDv7 for instance_id; rename misnamed CLI nonce helper (#416) by @usercise in #421
• release: spelunk 0.8.3 by @usercise in #422

Full Changelog: v0.8.2...v0.8.3

v0.8.2

What's Changed

• ci: add job timeouts; build only rich-formats in CI by @usercise in #383
• docs: clarify spelunk explore --help visibility requires LLM config by @usercise in #381
• fix(bench): SWE-bench eval merge path/field + agent.py patch contamination by @usercise in #378
• security: block all writes on secret detection in memory add (#344) by @usercise in #387
• ADR-003: Cross-project memory visibility (locked decisions across linked projects) by @usercise in #386
• ADR-004: Unified memory storage — resolve local store split-brain by @usercise in #388
• fix(memory): emit JSONL from memory list --format jsonl by @usercise in #389
• fix(memory): make memory.db the single canonical CLI store (ADR-004) by @usercise in #390
• fix(bench): switch --save-patch from denylist to allowlist by @usercise in #393
• docs(security): update THREAT-MODEL.md to reflect ADR-004 memory data-flow by @usercise in #394
• docs: align CLAUDE.md + agent-guide.md + memory.md with ADR-004; flip ADR-004 Status to Approved by @usercise in #395
• test: fix harvest_upfront_check flakiness on machines with a local server by @usercise in #401
• chore(security): verify gix/gitoxide Dependabot alerts resolved (P1-2) by @usercise in #399
• fix(test): update stale e2e assertions for ADR-004 inference-only routing by @usercise in #398
• feat(memory): add 'spelunk memory reconcile' command (ADR-004 follow-up) by @usercise in #396
• P3-1 UX: correct memory watch help text and unhide explore by @usercise in #402
• build(deps): bump openssl-sys from 0.9.116 to 0.9.117 by @dependabot[bot] in #410
• build(deps): bump regex from 1.12.3 to 1.12.4 by @dependabot[bot] in #409
• build(deps): bump openssl from 0.10.80 to 0.10.81 by @dependabot[bot] in #408
• feat(memory): cross-project visibility for search/list/context (ADR-003) by @usercise in #397
• docs(changelog): document secret-scan write-block security fix (#344) by @usercise in #407
• docs(security): spec read_file path-boundary enforcement for explore (#403) by @usercise in #411
• docs(security): spec parameterised SQL IN-clause approach (#405) by @usercise in #412
• release: spelunk 0.8.2 by @usercise in #415

Full Changelog: v0.8.1...v0.8.2

v0.8.1

What's Changed

• chore: update Homebrew formula to v0.8.0 by @usercise in #362
• build(ci): give pr permission to release workflow by @usercise in #361
• fix(ci): replace EmbarkStudios/cargo-deny-action with direct script by @usercise in #363
• feat: surface backend_kind() in status/check --format json by @usercise in #364
• security: bind auto-spawned server to 127.0.0.1 (THREAT-MODEL req #9 / #303) by @usercise in #365
• test: verify spawn_daemon binds 127.0.0.1 (THREAT-MODEL req #9) by @usercise in #370
• refactor(storage): split remote.rs and git_notes.rs into module directories by @usercise in #367
• fix(embedder): fix memory spike, CPU saturation, and index timeout by @usercise in #368
• fix(search): honor effective config for auto-discovered loopback server by @usercise in #371
• refactor: rename ndjson → jsonl throughout the codebase by @usercise in #369
• build(release): publish Homebrew formula to spelunk-cloud/homebrew-spelunk by @usercise in #380
• docs: fix v0.8.0 deb URL 404 + docs review findings (#303-G) by @usercise in #372
• chore: release v0.8.1 by @usercise in #382

Full Changelog: v0.8.0...v0.8.1

v0.8.0

What's Changed

• chore: release 0.7.1 by @usercise in #301
• feat: add spelunk sync as top-level alias for memory push (#286) by @usercise in #299
• fix(harvest): up-front actionable error when no server or model configured (#287) by @usercise in #298
• bench(#247): Cross-Session Handoff task corpus by @usercise in #290
• bench(#248): call-graph task corpus — 42 tasks across ripgrep/django/sympy by @usercise in #281
• fix(#260): normalise ast-grep search output to SearchResult shape by @usercise in #304
• docs(#260): ADR-002 server AI endpoint contract — generic /llm/complete primitive by @usercise in #305
• chore(deps): bump serial_test from 3.4.0 to 3.5.0 by @dependabot[bot] in #306
• chore(deps): bump gix from 0.83.0 to 0.84.0 by @dependabot[bot] in #307
• feat(#260): add POST /v1/projects/{id}/llm/complete + route harvest through server by @usercise in #310
• Update gix dependencies to meet security requirements by @usercise in #313
• refact(#260,#312): route all CLI inference through ServerInferenceClient; strip OpenAiCompat from spelunk-core by @usercise in #314
• docs(CLAUDE.md): sync module map after PR #314 CLI inference strip by @usercise in #315
• feat(capability): loopback auto-discovery — spelunk#316 (0.8.0 cold-start Section A) by @usercise in #326
• chore(deps): drop cargo-audit library dev-dep to clear 7 Dependabot alerts by @usercise in #327
• feat(#303-F3): check/status/init UX for loopback auto-discovered server by @usercise in #330
• feat(#303-F2): spelunk search Tier-0 fall-through to text mode by @usercise in #331
• feat(#303-D): project_id loopback derivation in Config by @usercise in #328
• feat(#303-E): /v1/health enrichment with instance_id and started_by by @usercise in #329
• feat(#303-F1): POST /v1/projects/{id}/search — server-side query embedding by @usercise in #332
• chore(security): cargo update — drop gix 0.78.0 tree, clear Dependabot alerts by @usercise in #334
• feat(#303-B): spelunk server start/stop/status/logs + daemonisation by @usercise in #333
• feat(#303-B2): spelunk init auto-spawn integration (TTY-gated) by @usercise in #335
• feat(#303-C): native embedder via fastembed-rs (embed-native feature flag) by @usercise in #336
• chore: drop git-meta and entire integrations by @usercise in #337
• feat: git notes write-through on memory add (default on) by @usercise in #339
• feat(#325): install paths — install.sh, deb packaging, service units, brew tap by @usercise in #338
• chore: update crates to latest compatible version by @usercise in #341
• docs(security): model git-notes memory as new exfiltration sink (PR #339 follow-up) by @usercise in #343
• chore(deps): bump lopdf from 0.40.0 to 0.41.0 by @dependabot[bot] in #346
• chore(deps): bump rusqlite from 0.39.0 to 0.40.1 by @dependabot[bot] in #347
• feat: move Homebrew formula in-repo (ripgrep model), fix license and 404 by @usercise in #345
• docs: v0.8.0 documentation rewrite — zero-infrastructure-first architecture by @usercise in #276
• fix: percent-encode project_id, fix backend panic, honor server tier (v0.8.0 UAT) by @usercise in #349
• chore: bump version to 0.8.0 by @usercise in #351
• build(ci): move DEB package config writer to script by @usercise in #352
• release: v0.8.0 arm build fix by @usercise in #353
• fix(cli): correct stale "ca will:" to "spelunk will:" in hooks install message by @usercise in #355
• test(e2e): lock in project_id URL-encoding for slugs with slashes by @usercise in #356
• test(e2e): cover memory search/timeline with auto-discovered loopback server by @usercise in #358
• Release/0.8.0 arm build fix by @usercise in #354
• v0.8.0 retest: IMP-1/2 verified fixed, IMP-3 reveals new 422 bug (#359) by @usercise in #360

Full Changelog: v0.7.1...v0.8.0

v0.7.1

What's Changed

• chore(deps): bump blake3 from 1.8.4 to 1.8.5 by @dependabot[bot] in #180
• fix: GitNotesBackend unsupported methods return typed BackendUnsupported error by @usercise in #193
• fix: cap GitNotesBackend list at 500 entries to prevent O(n) hang by @usercise in #194
• feat: add schema_version to NoteRecord for forward-compat detection by @usercise in #195
• feat(#199,#200): remove ask, plan, spec, snapshot, history, verify commands by @usercise in #204
• feat(#198): GitMetaBackend — zero-infra memory via git-meta-lib 0.1.9 by @usercise in #203
• chore(deps): bump tower-http from 0.6.8 to 0.6.10 by @dependabot[bot] in #210
• chore(deps): bump calamine from 0.34.0 to 0.35.0 by @dependabot[bot] in #209
• chore(deps): bump tokio from 1.52.1 to 1.52.3 by @dependabot[bot] in #208
• chore(deps): bump utoipa from 5.4.0 to 5.5.0 by @dependabot[bot] in #207
• feat(#201): add spelunk context command as agent session entry point by @usercise in #206
• docs: reframe spelunk as index-free by default by @usercise in #211
• feat(#197): memory harvest --source entire (Entire.io checkpoints) by @usercise in #212
• fix(#197): add contains_secret checks to harvest_entire LLM fallback path by @usercise in #213
• chore: clean up dirty worktree by commiting left over files by @usercise in #218
• fix: prevent self-referential .spelunk symlink in git worktrees by @usercise in #219
• refactor(#214): replace git rev-parse subprocess calls with gix::discover by @usercise in #217
• feat: benchmarking using deepseek by @usercise in #234
• bench(repobench): add control conditions and fix seed plumbing by @usercise in #233
• bench(memory): add blind question-authoring protocol by @usercise in #236
• chore(deps): bump assert_cmd from 2.2.1 to 2.2.2 by @dependabot[bot] in #239
• bench(memory): give grep baseline a fair query in Decision Archaeology by @usercise in #235
• bench(repobench): add --repo-filter for indexed-repo overlap by @usercise in #238
• chore(deps): bump git-meta-lib from 0.1.9 to 0.1.10 by @dependabot[bot] in #240
• chore(deps): bump gix from 0.81.0 to 0.83.0 by @dependabot[bot] in #241
• bench(graph): add code-graph benchmark — grep vs search vs graph by @usercise in #245
• bench(perf): add perf_scale.sh orchestrator for multi-repo scale benchmarks by @usercise in #244
• bench(swebench): wire up Docker harness for resolve_rate by @usercise in #242
• bench(memory): redesign Cross-Session Handoff with verifiable tasks by @usercise in #243
• docs(bench): rewrite benchmarking report as infrastructure status by @usercise in #246
• chore: bump version to 0.7.0 by @usercise in #249
• chore: add AGENTS.md, bench/AGENTS.md, simplify PROTOCOL.md by @usercise in #250
• refactor: replace git subprocess with gix status API (#215) by @usercise in #253
• feat(graph): add --live flag and ast-grep fallback for symbol queries (#216) by @usercise in #254
• feat(server): optional server-side embedding via SPELUNK_EMBEDDING_URL (#221) by @usercise in #256
• chore(deps): bump tree-sitter from 0.26.8 to 0.26.9 by @dependabot[bot] in #257
• chore(deps): bump tower-http from 0.6.10 to 0.6.11 by @dependabot[bot] in #258
• fix(test): isolate context tests from project .spelunk dir by @usercise in #264
• feat(server): reject entries with prompt-injection patterns (#222) by @usercise in #255
• refactor: 3-crate Cargo workspace split (#220) by @usercise in #262
• fix(worktree): replace .spelunk symlink with runtime root resolution (#266) by @usercise in #267
• feat(capability): implement compatibility tier model (#259) by @usercise in #265
• docs: convention extraction architecture spec (#268) by @usercise in #271
• chore: consolidate personas + comms protocol to Spelunk root by @usercise in #272
• fix(harvest): swallow per-entry errors instead of fast-failing the run by @usercise in #273
• docs(arch): spelunk-server HTTP API spec — AuthProvider trait, data promise, /v1 contract by @usercise in #275
• bench(swebench): switch default dataset to full split to fix 24/50 denominator gap by @usercise in #274
• chore(deps): bump serde_json from 1.0.149 to 1.0.150 by @dependabot[bot] in #279
• feat(#261): spelunk-server HTTP API — AuthProvider, embed, explore, plan by @usercise in #282
• feat(#268): heuristic convention extraction — naming, async, testing, docs by @usercise in #277
• feat(#269): spelunk status --format json by @usercise in #278
• fix(#288): spelunk-server spec gaps — text query, JSON errors, OpenAPI CI by @usercise in #291
• bench(#251): cold-start perf scale baselines — ripgrep / django / sympy by @usercise in #280
• chore: drop POST /v1/projects/{id}/plan endpoint by @usercise in #292
• feat(memory watch): kind filter, since-seq resume, and auto-reconnect by @usercise in #293
• fix: add missing read convenctions cmd by @usercise in #294
• feat: --detach flag for spelunk index and memory harvest (#295) by @usercise in #296
• feat: default spelunk search to ast-grep when no embedder (#284) by @usercise in #300
• feat: gate spelunk explore behind Tier 2/3 (#285) by @usercise in #297

Full Changelog: v0.6.0...v0.7.1

v0.7.0

What's Changed

• chore(deps): bump blake3 from 1.8.4 to 1.8.5 by @dependabot[bot] in #180
• fix: GitNotesBackend unsupported methods return typed BackendUnsupported error by @usercise in #193
• fix: cap GitNotesBackend list at 500 entries to prevent O(n) hang by @usercise in #194
• feat: add schema_version to NoteRecord for forward-compat detection by @usercise in #195
• feat(#199,#200): remove ask, plan, spec, snapshot, history, verify commands by @usercise in #204
• feat(#198): GitMetaBackend — zero-infra memory via git-meta-lib 0.1.9 by @usercise in #203
• chore(deps): bump tower-http from 0.6.8 to 0.6.10 by @dependabot[bot] in #210
• chore(deps): bump calamine from 0.34.0 to 0.35.0 by @dependabot[bot] in #209
• chore(deps): bump tokio from 1.52.1 to 1.52.3 by @dependabot[bot] in #208
• chore(deps): bump utoipa from 5.4.0 to 5.5.0 by @dependabot[bot] in #207
• feat(#201): add spelunk context command as agent session entry point by @usercise in #206
• docs: reframe spelunk as index-free by default by @usercise in #211
• feat(#197): memory harvest --source entire (Entire.io checkpoints) by @usercise in #212
• fix(#197): add contains_secret checks to harvest_entire LLM fallback path by @usercise in #213
• chore: clean up dirty worktree by commiting left over files by @usercise in #218
• fix: prevent self-referential .spelunk symlink in git worktrees by @usercise in #219
• refactor(#214): replace git rev-parse subprocess calls with gix::discover by @usercise in #217

Full Changelog: v0.6.0...v0.7.0

v0.6.0

What's Changed

• test: expand fuzzer to cover secrets, chunker, escape_xml, NDJSON, and history entry parsing by @usercise in #167
• chore: update dependencies in Cargo by @usercise in #169
• chore: update Rust dependencies to latest by @usercise in #173
• fix: resolve fuzzer crashes, OOMs, and doc_comment skip bug by @usercise in #174
• feat: support .spelunkignore files by @usercise in #176
• feat: LinearRAG two-stage retrieval (spelunk search --retrieval linearrag) by @usercise in #172
• feat: failure patterns memory — antipattern kind, failures harvest, spelunk memory failures by @usercise in #178
• Fix/bench scripts by @usercise in #171
• chore: release v0.6.0 by @usercise in #179

Full Changelog: v0.5.0...v0.6.0

v0.5.0

What's Changed

• refactor: split large modules into focused files (Unix architecture prep) by @usercise in #134
• feat: benchmark scripts for spelunk evaluation by @usercise in #86
• fix: resolve security audit bugs #136 #137 #138 #145 by @usercise in #146
• refactor: standardize --format flags across porcelain commands (#127) by @usercise in #153
• docs: plumbing command reference and explainer (#132 #133) by @usercise in #155
• test: add unit tests for escape_xml and NoteStore (#151 #152) by @usercise in #154
• [#128] refactor: share embed helper between search and plumbing embed by @usercise in #156
• refactor: split storage/memory.rs into focused sub-modules (#144) by @usercise in #157
• [#130] test: Phase 4 integration tests — porcelain/plumbing composition by @usercise in #159
• feat: add intent memory kind and surface in spelunk check (#147) by @usercise in #160
• feat: spelunk memory harvest --source claude-code (#158) by @usercise in #161
• feat: server-side conflict detection on memory write (#149) by @usercise in #164
• feat: surface intent details and file overlap in spelunk check (#150) by @usercise in #162
• chore: fix fuzz-found parser safety issues (stack overflow + OOM) by @usercise in #163
• feat: /memory/since endpoint, SSE stream, and CLI watch/since (#148) by @usercise in #166
• docs: update SKILL.md and docs for v0.5.0 by @usercise in #168
• chore: bump version to 0.5.0 by @usercise in #165

Full Changelog: v0.4.1...v0.5.0

v0.4.1

What's Changed

• chore(deps): bump rand from 0.9.2 to 0.9.4 in the cargo group across 1 directory by @dependabot[bot] in #111
• chore(deps): bump tokio from 1.51.0 to 1.51.1 by @dependabot[bot] in #110
• feat: historical code snapshots and history command (#93, #94) by @usercise in #107
• chore: bump version to 0.4.1 by @usercise in #112

Full Changelog: v0.3.0...v0.4.1