# Changelog

## 0.4.0 (2026-11-02)

**Giga Brain is now Big Brain.** The command is still `brain` and existing brains keep working: an
install that already has `giga-brain` data/cache folders keeps using them; new installs use
`big-brain` (whichever folder actually holds data wins, so an empty new folder can't hide an
existing brain; `brain doctor` warns if both hold entries). `brain setup` installs the agent skill
as `big-brain`, replaces its old managed block in AGENTS.md, and moves the old `giga-brain` copies
it had installed (only ones it recognises, never user skills) into `<tool>/big-brain-migration/`;
nothing is deleted.

Keeping a shared brain accurate as it grows (ideas studied from GBrain and Gigabrain, both MIT;
no code taken).

- **Links between entries:** `related` and `supersedes` must name existing entries; `brain get` shows
  links in both directions ("see also", "replaces", "linked from"); `brain check` lists broken links;
  `brain rm` refuses to delete an entry others link to unless `--yes`.
- **Retiring:** `brain retire <id> --why "…" [--by <new-id>]`. Retired and superseded entries drop out
  of search, lists, stale checks, reviews and hooks, and stay readable (`brain get`, `--all`), so an
  old procedure can't outrank its replacement.
- **`brain maintain`:** nightly upkeep that never edits entries: index, librarian review of stale
  entries, broken links, near-duplicates, and a contradiction check of closely related entries (each
  pair judged once per version, confident verdicts only). `brain get` shows "may contradict";
  `brain doctor` counts contradictions and says when maintain last ran. `nightly.sh` now runs it.
- **Privacy masking:** emails, IP addresses and home-folder user names are masked in text sent to
  remote models, plus your own patterns (`[privacy] patterns`); local models get text unchanged.
- **Trust tie-break:** when two results score about the same, the verified one ranks first.
- **Safer automatic context:** hooks name stale entries and how many of their files changed, never
  file names (entry text is untrusted); `brain get` shows librarian verdicts, and their free-text
  notes only with `--notes`. Nothing that looks like a secret is sent to any model, search queries
  included. Masking fails closed on a bad pattern, more than 50 patterns, or more than 64 KB of text.
- **OpenAI's newer models work as the librarian:** OpenAI's GPT-5 and reasoning models refuse
  `max_tokens` and a custom temperature; brain now retries once with `max_completion_tokens` and
  keeps using it. Azure, LM Studio and other OpenAI-compatible services are unchanged.
- **Hardening (Grok audit):** requests to this machine (LM Studio, local servers) never go through
  an `HTTP_PROXY`/`HTTPS_PROXY`/`ALL_PROXY` proxy, since that traffic is unmasked and may carry a key.
  A service's error replies are no longer shown (only the HTTP status and a short error code), so a
  hostile endpoint can't put instructions or echoed keys in front of agents. Endpoint URLs with a
  `?query` are refused (keys belong in `auth`), and so is `user:password@` with any auth setting.
  Short passwords, quoted passphrases with spaces and YAML `|` blocks are caught
  as secrets, while references (`$DEPLOY_KEY`, `${TOKEN}`), placeholders and ordinary code
  (`password: String`, `self.password`, unquoted only: a quoted value is a literal) still pass
  (checked against about 6,000 files of real code). Network errors and privacy-pattern errors are
  fixed descriptions: no proxy URL, server text or pattern text in them.
  Quoted passwords made of ordinary words are secrets too; escaped Windows paths (`C:\\Users\\…`
  in JSON or code) are masked; the Azure VM sign-in request never follows redirects.
  Service error codes are shown only if they're on a known list. Doctor and sign-in errors no longer show
  a token command's arguments or `az`'s raw error output. Masking also catches `ip:2001:db8::1` and
  Windows home folders written with forward slashes (`c:/users/<name>`).

## 0.3.0 (2026-11-02)

Security and polish, from reviews by Codex and Grok.

- **Security:**
  - the secret scanner catches JSON keys (`"password": …`), `client_secret` / `AZURE_CLIENT_SECRET`,
    `secret_access_key`, `Authorization: Bearer|Basic …`, passwords inside URLs and Azure SAS tokens;
  - entries (frontmatter and body) are checked for secrets again before being sent for embeddings or
    review, so hand edits and git pulls can't slip one out; flagged entries stay keyword-searchable and
    are reported;
  - credentials are never sent over plain http (except to this machine: `localhost` or a loopback IP)
    or along a redirect; the Azure sign-in token goes only to Azure OpenAI / AI Services endpoints, or
    to gateways you list in `token_hosts` (`brain setup` asks; API Management gateways must be listed);
  - `az` runs without a shell and token scopes must be plain https URLs; the managed-identity request
    encodes its parameters and checks `AZURE_CLIENT_ID`;
  - Azure tokens are cached per scope, identity and host in the private cache folder, outside the brain
    (on Windows `%LOCALAPPDATA%\giga-brain-cache`); an old cache in the brain folder is deleted; the
    cache file is created owner-only;
  - absolute and `~/` refs must be inside a registered project (agents open refs);
  - git reads ref paths literally (`--literal-pathspecs`), so a file name can't widen a diff;
  - librarian notes are flattened (no control characters or extra lines) and never enter hook context:
    hooks show only the verdict and point to `brain get`; the librarian is told entries and diffs are
    data, not instructions; file names in hook context are sanitised;
  - `skill-local.md` joins agent instructions only if it matches what is already installed or a person
    approves it at the keyboard (`--yes` never adds new or changed text); it is checked for secrets;
  - the brain folder is created readable only by its owner; `brain doctor` warns otherwise.
- **New:** `brain upgrade` (and `--check`): fetch the clone's upstream (https or ssh only), show
  what's new, fast-forward, and rebuild the exact fetched commit from a clean checkout, with the same
  features, into the same place (on Windows the running exe is moved aside and restored on failure).
  A token in the clone's address is moved to git's credential store, read back to confirm, and only
  then removed from the address. Off a terminal it needs `--yes`. It also rebuilds when an earlier
  build failed after fetching.
- **Look and feel:**
  - one layout for every listing (search, list, related, stale): numbered bold title, a meta line
    (kind · project · verified · date · stale), and the id;
  - `brain get` shows a readable view (header, sections, files with their state, related entries, the
    librarian's labelled note) instead of raw YAML; `--raw` is unchanged;
  - search says whether it matched by meaning or by keywords only (and why), wraps the matching passage
    to the terminal, and colours match scores against each provider's own thresholds;
  - `brain setup` runs as five numbered steps, keeps earlier answers when re-run, refuses empty
    required values, lists the files it will change before changing them, and ends with a summary;
  - doctor, stats and digest share the "Giga Brain" header; clearer empty states with the next command;
  - colours work in classic Windows consoles, and error colours follow stderr;
  - layouts follow the real terminal width (stats bars shrink on narrow terminals).
- **Docs:** Windows/macOS build prerequisites, `cargo install --locked`, PowerShell notes, the doctor's
  one-word embedding check, `token_hosts`, and where tokens are cached.

## 0.2.0 (2026-10-31)

- **New:** `brain doctor` checks settings, AI providers, the index and
  each agent tool's setup, with ✓/⚠/✗ and what to fix.
- **New:** `brain stats`, also shown by plain `brain`: entries per project and kind, stale counts, most
  active writers, newest entries.
- **New:** `brain digest [--since 24h|3d|2w|DATE]`: what agents recorded recently, grouped by project.
- **New:** `brain setup`: one-time, re-runnable configuration (name, reviewer, AI providers, agent
  tools, projects), merging into existing settings.
- **New:** pluggable AI. Embeddings: local (optional `local-embeddings` build feature), Azure OpenAI
  (keyless via managed identity or `az login`), any OpenAI-compatible server, or none (keyword
  search). Librarian: LM Studio, Azure, OpenAI-compatible, or none.
- **New:** Codex and Grok support (skill, always-on instructions, hooks); Copilot and other tools get an
  instruction block to paste.
- Search falls back to keywords when the embedding provider is unreachable, and catches up later.
- Stale-entry notes repeat after 10 messages if not handled; only entries actually shown count as told.
- Colour output in terminals (plain when piped or with `NO_COLOR`); help with examples.
- Duplicate check only compares entries of the same kind.
- Personal names and paths moved from code into settings; Windows and macOS paths.
- Security and robustness fixes from independent audits (Claude and Grok):
  - the librarian sends only git diffs of files inside registered projects, never whole files, and
    withholds secret-looking diffs; only real commit hashes reach `git diff`, with external diff tools off;
  - refs can't escape their project (`..`, symlinks, Windows drive letters);
  - the OS certificate store is used (corporate TLS inspection); Azure tokens are cached between runs;
    `AZURE_CLIENT_ID`, slow managed-identity endpoints, `…/openai` URLs and custom token scopes work;
  - `brain record` works when embeddings are down; brain commits ignore global signing and git hooks;
  - librarian notes reach agents marked as unverified AI notes;
  - `brain setup` writes settings atomically and keeps a one-time backup; `brain edit` uses a private
    temp file and editors with arguments; concurrent edits of one entry are refused, not lost;
  - match thresholds per provider (configurable); Azure keys and connection strings in the secret scan.
- Automated tests (`cargo test`).
- Removed `brain backup` (back up the brain folder however you back up other files).

## 0.1.0

- First version: entries in git, hybrid search, staleness via file fingerprints, hooks for Claude Code,
  runbook proposals, LM Studio librarian.