- **`app.dir` and region key path traversal.** `appSpecSchema` now validates `dir` with `safeRelativePath` at parse time (rejecting `..`, absolute paths, and null bytes); the `regions` record key receives the same treatment. `applyModule` and `cmdRemove` re-check every resolved write/delete destination with the new `assertWithinRoot` helper, which walks the full symlink chain so a planted link can't redirect file operations outside the project root even if the lexical check passes.
- **Env var line injection in `.env.example`.** `envVarSchema` now validates `name` against `^[A-Za-z_][A-Za-z0-9_]*$` and rejects control characters in `example` and `description`; the `appendEnvVar` helper applies the same check as defense-in-depth so a crafted third-party module can't smuggle extra `KEY=value` lines into the generated file.
- **Cleartext registry/npm endpoint rejection.** Remote `http://` URLs for `STANZA_REGISTRY`, `registries[*].url`, and `STANZA_NPM_REGISTRY` are now refused (`STANZA_REGISTRY`/`STANZA_NPM_REGISTRY` hard-error; third-party `http://` entries warn and skip so the rest of the CLI keeps working). `file://`, bare filesystem paths, and loopback hosts stay allowed for local-dev and CI-fixture workflows. Set `STANZA_ALLOW_INSECURE_REGISTRY=1` to opt into a trusted internal `http://` mirror with a one-time stderr warning.
- Set `disableThanks`, `prettier: false`, `privatePackages: { version: false, tag: false }`, and `updateInternalDependents: "always"` in `.changeset/config.json`; simplify the release workflow by dropping `NPM_TOKEN` and `NPM_CONFIG_PROVENANCE` from the CI env and switching to `vp run version`
- Add `stanza-cli` as a second bin entry in `publishConfig` alongside `stanza` so the package is callable by either name; reset the CLI package version to `0.0.0` so changesets drive versioning from a clean baseline
- Update docs throughout to reflect the `doctor` command surface (CLI reference, agents guide, telemetry list), the main-file registry URL convention (`registries` entries now point at the full `index.json` URL, not a directory), and the `STANZA_REGISTRY` env var description
- **Registry main file.** The CLI now addresses any registry (first-party, third-party, or `STANZA_REGISTRY` override) by the full URL/path to its JSON index file. The `modules/<category>-<id>.json` convention, the in-repo source-tree loader, the directory-based auto-detect, and the inline-template disk fallback are all removed — one loader, no heuristics. `STANZA_REGISTRY` must be the full path/URL to the main file (not a directory); `registries` entries now carry `url` pointing at the main file instead of an `indexUrl`+template. **Breaking** (pre-release, clean break): registry index bumped to `schemaVersion: 2`; every module entry carries a `path` field resolved relative to the main file.
- **Auto-rollback.** `stanza add` (and each module in `stanza init`) now wraps its file writes in a transaction; a mid-apply failure restores touched files and `stanza.json` to their pre-apply state. `reportApplyFailure` updated to say "The change was rolled back" and demotes the `stanza remove` / `git restore` steps to a backstop note.
- **`stanza doctor`.** New read-only command that checks `stanza.json` against the filesystem (tracked files, deps, scripts, env vars, internal packages) and reports drift, exiting non-zero when found.
- Update integration tests to build the first-party registry once into a temp dir and point `STANZA_REGISTRY` at its main file; update the third-party HTTP fixture server to serve `/index.json` as the main file alongside per-module paths.
- Update `AGENTS.md` E2E smoke instructions and `apps/cli/README.md` to reflect the new loader and `doctor` command.
- Replace `npm create stanza@latest` → `npm init stanza` and `bun create stanza@latest` → `bun create stanza` in docs, SKILL.md, and `buildCommand` to match how these package managers actually resolve the initializer
- Update the agents.mdx rule to reference `npm init` instead of `npm create`
- Derive `init` vs `create` sub-command in `buildCommand` based on the selected package manager so generated install snippets are correct for npm
- Condense `AGENTS.md` by moving CLI-specific guidance into `skills/stanza-cli/SKILL.md` where it is co-located with the skill it describes
- Expand `SKILL.md` with the relocated context so agent runs against the CLI skill have the full picture without loading root-level agent instructions
- Minor cleanup to `stats.tsx` layout/typography
- Add `packages/registry/src/registry-config.ts` with a Zod schema for the `registries` field in `stanza.json` (string URL prefix or `{ url, indexUrl?, headers?, params? }` object), plus `parseModuleSpec` to split `@ns/id` specs and `expandEnv` to substitute `${VAR}` tokens in header values (dropping the header silently when the env var is unset)
- Replace `loadRegistry` with `loadRegistries(manifest)` in `registry-loader.ts`; the loader reads `registries` from `stanza.json`, builds a per-namespace fetch client with auth headers, and routes module loads to the correct HTTP endpoint — `@stanza` remains the implicit default namespace backed by the existing registry URL
- Update `add`, `remove`, `search`, and `list` commands to accept `[@<namespace>/]<id>` syntax; `namespace` is recorded alongside each module entry in `stanza.json` at install time so `remove` knows which registry to refetch from
- Enforce that codemods are catalog-only: third-party modules may reference first-party codemod IDs but cannot introduce new ones; catalog ID validation runs before any writes so unknown IDs are caught on `--dry-run` too
- Add a full third-party registry test suite in `commands.test.ts` using a stub `node:http` server: covers install + manifest recording, unknown-namespace rejection, remove round-trip (asserts correct namespace URL is hit), `${ENV_VAR}` header expansion, and codemod-catalog enforcement
- Export `DEFAULT_NAMESPACE` and `parseModuleSpec` from `@stanza/registry`; telemetry `cli_module` events now include a `namespace` field so first- vs. third-party installs can be distinguished in PostHog
- Add `apps/web/content/docs/authoring.mdx` covering the full module-authoring reference (schema fields, templates, adapters, codemods, third-party registry config)
- Rename `styling` → `ui` across the entire codebase (CATEGORIES array, docs, AGENTS.md, CLI tests, resolver, template tests, codemod runner); `ui` is `home: package` so shadcn installs into `packages/ui/` as a workspace dep rather than wiring directly into the app shell
- Add `ui-shadcn-base` (Tailwind v4 / CSS-first, no Radix peer) and `ui-shadcn-radix` (Tailwind v4 + Radix primitives) with full per-framework template sets for Next.js and TanStack Start: `components.json`, `globals.css`, `postcss.config.mjs`, `theme-provider.tsx`, shared `Button` + `utils.ts`; light/dark logos inlined from svgl
- Rename `styling-tailwind` → `ui-tailwind` to match the new category id; update its module definition to `category: "ui"` and `home: package`
- Add four new codemod builtins with tests: `add-array-entry-in-call` (inserts an element into a named array argument of any `CallExpression`), `replace-import` (rewrites a specifier in an existing import declaration), `set-html-attributes` (sets attributes on an HTML/JSX element by tag name or selector), `set-tsconfig-paths` (merges `compilerOptions` entries into a `tsconfig.json` AST node); register all four in the builtins index and export from `@stanza/codemods`
- Add `wrap-root-layout` builtin tests
- Update registry.mdx, concepts.mdx, cli.mdx, getting-started.mdx, agents.mdx, index.mdx, AGENTS.md, README.md, TODO.md, and SKILL.md to reflect the category rename and new modules
- Introduce `AppSpec` (`{ id, dir, kind }`) and `AppKind = "web" | "native"` types; `stanza.json` now declares `apps: AppSpec[]` alongside modules, and `stanza init` scaffolds a default web app via `defaultWebApp()`
- Add optional `apps?: string[]` to `StanzaModuleRecord` to encode which apps a record targets; `home: app` modules require it, `home: package` modules use it to scope workspace deps (omitting means all apps), `home: repo` modules forbid it
- Make cardinality enforcement app-scoped for `home: app` categories: `selectedOne(m, cat, appId?)` and `selectedAll(m, cat, appId?)` now filter by app, and `add`/`remove` thread a `targetApp` through the runner so per-app single-choice rejection works correctly
- Extend the template render context with an `app: { id, dir, kind }` binding (plus the legacy `project.appDir` alias) re-bound per target app; the codemod runner fans out template/codemod/dep application once per consuming app in a loop
- Update `synthesizePackageJsons`, `synthesizeTemplates`, `buildRenderContext`, and related web-preview helpers to accept an `apps` array and produce per-app output
- Update `package-json.ts` to strip workspace deps from all apps' `package.json` on remove and to inject them into every consuming app on install
- Expand `manifest.test.ts` and `template.test.ts` with multi-app fixture coverage; add `"use client"` directive to codemod test files to satisfy the RSC boundary
- Refresh `AGENTS.md`, `SKILL.md`, and all affected docs (`concepts.mdx`, `registry.mdx`, `cli.mdx`, `getting-started.mdx`, `agents.mdx`) to document the new apps schema and routing semantics
- Add `concepts.mdx` covering categories, cardinality, home, vendoring, peers/adapters, manifest, regions, and the open registry model
- Flesh out `getting-started.mdx` with prerequisites, install/run steps, package-manager variants, inspect/remove commands, and a non-interactive `--yes` example
- Rewrite `cli-reference.mdx` with per-verb sections, global flags, environment variables, and dependency-versioning semantics
- Expand `README.md` with a "Why Stanza?" section, quick-start snippet, docs link, and updated module list; swap `pnpm create` example for `npm init`
- Add `concepts` to `meta.json` nav order
- Replace the `slot` / `add-on` discriminated-union split with one `Category` shape carrying two orthogonal fields: `cardinality` (`"one"` for single-choice, `"many"` for coexisting) and `home` (`"app"` / `"repo"` / `"package"`) — the old `packageDir` + `repoScoped` pair is dropped
- `Module` is no longer a discriminated union; it carries a single `category` field referencing a `Category` id; `KNOWN_SLOTS`, `KNOWN_ADDONS`, `ADDON_CATEGORIES`, and all related helpers are replaced by a single `CATEGORIES` array and derived `categoryHome` / `categoryLabel` / `PACKAGE_DIRS` lookups
- Manifest schema bumped to version `0.2` — `modules` is now one record keyed by category holding arrays; `cardinality: "one"` categories are enforced to ≤ 1 entry at install time; no migration (stanza is pre-1.0 and unpublished)
- Peer/constraint logic is now emergent from cardinality: the resolver treats only `cardinality: "one"` categories as peers, so `testing` (many) can never accidentally become a peer; install routing is a single `categoryHome` lookup shared by the CLI runner, codemod runner, and web preview
- Update all CLI commands (`add`, `remove`, `init`, `list`, `search`), the wizard, `codemod-runner`, `registry-loader`, all web builder/detail/search components, server functions, OG route, sitemap, analytics, and selection logic to use the new category API
- Update all first-party `module.ts` files, `registry-build.ts`, tests, and docs (`AGENTS.md`, `REGISTRY.md`, `SKILL.md`) to reflect the unified taxonomy
- Add `apps/cli/src/lib/telemetry.ts` — a dependency-free telemetry module that accumulates events in memory and flushes them as a single `fetch` POST at the end of each run; identity is an ephemeral per-process UUID (no on-disk state); suppressed by `--no-telemetry`, `STANZA_TELEMETRY=0`, `DO_NOT_TRACK=1`, or any recognized CI environment variable
- Wire `telemetry.configure` / `telemetry.capture` / `telemetry.flush` into `run.ts` so every command emits a `cli_command` event (with `status` and `duration_ms`) and individual `init`/`add`/`remove` calls emit `cli_module` events (with `action`, `group`, and `module`)
- Rename the `mri` boolean from `no-telemetry` to `telemetry` in `bin.ts` so mri's `--no-` prefix convention populates `argv.telemetry === false` as `isTelemetryDisabled` expects
- Add `apps/web/src/routes/api.events.ts` — a TanStack Start API route that receives the CLI's batched event payload and forwards each event to PostHog via the REST `capture` endpoint using `POSTHOG_API_KEY`; non-`POST` requests, missing keys, and upstream errors all return appropriate status codes without leaking details
- Document the `--no-telemetry` flag, `STANZA_TELEMETRY`, and `DO_NOT_TRACK` env vars in `skills/stanza-cli/SKILL.md`
- Add `apps/cli/src/lib/npm-version.ts` with `resolveRange(name, range)` and `resolveRanges(deps)` — fetches the abbreviated packument from the npm registry (or `STANZA_NPM_REGISTRY`), picks the `semver.maxSatisfying` version, and re-attaches the original modifier (e.g. `^1.6.11` → `^1.8.3`); non-`^`/`~` ranges, workspace specs, and tags are left verbatim without hitting the network; results are cached per package name for the process lifetime so a multi-module `init` fetches each package at most once
- Wire `resolveRanges` into `applyModule` in `codemod-runner.ts` — both `dependencies` and `devDependencies` are re-pinned before being written to `package.json`; dry-run skips the network entirely since nothing is written
- Add `STANZA_NO_NPM_LOOKUP=1` env var to bypass lookups and fall back to verbatim ranges (network errors also fall back per-entry); set it in `commands.test.ts` `beforeEach` to keep integration tests hermetic
- Add `npm-version.test.ts` covering caret/tilde bumping, pass-through of other range shapes, `STANZA_NO_NPM_LOOKUP` bypass, network error fallback, non-ok response fallback, nothing-satisfies fallback, per-package caching, and scoped name URL encoding
- Document the new behavior and env vars in `skills/stanza-cli/SKILL.md` under a new "Dependency Versions" section
- Add `skills/stanza-cli/SKILL.md` — a self-contained agent skill covering the published CLI surface: runtime contract, non-interactive `init`/`add`/`remove`/`list`/`search` usage, slot vs. add-on semantics, safety flags (`--dry-run`, `--dangerously-allow-dirty`, `STANZA_REGISTRY`), error handling, and agent rules; intended for agents that don't have access to this source repo
- Add `skills/stanza-cli/agents/openai.yaml` with display name, short description, and default prompt for OpenAI agent tooling
- Update `AGENTS.md` with a "Distributed Skill" section noting that `skills/stanza-cli/SKILL.md` must be kept in sync whenever CLI flags, command behaviour, slot/add-on names, or published package names change
jakeandGitHub