|
| 1 | +# Changelog |
| 2 | + |
| 3 | +All notable changes to DSPy Code will be documented in this file. |
| 4 | + |
| 5 | +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), |
| 6 | +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). |
| 7 | + |
| 8 | +--- |
| 9 | + |
| 10 | +## [0.1.0] - 2025-11-21 |
| 11 | + |
| 12 | +### Added |
| 13 | + |
| 14 | +- Initial release of DSPy Code (formerly DSPy CLI) |
| 15 | +- Interactive mode with natural language interface |
| 16 | +- Slash commands for all operations |
| 17 | +- Code generation for Signatures, Modules, and complete programs |
| 18 | +- Model connection support (Ollama, OpenAI, Anthropic, Gemini) |
| 19 | +- Built-in MCP client integration |
| 20 | +- Real GEPA optimization support |
| 21 | +- Codebase RAG for project understanding |
| 22 | +- Code validation and sandboxed execution |
| 23 | +- Project initialization (fresh and existing projects) |
| 24 | +- Session management with auto-save |
| 25 | +- Export/import functionality |
| 26 | +- Comprehensive documentation with MkDocs |
| 27 | + |
| 28 | +### Changed |
| 29 | + |
| 30 | +- Renamed from "DSPy CLI" to "DSPy Code" with tagline "Claude Code for DSPy" |
| 31 | +- Updated branding to Superagentic AI |
| 32 | +- Made all commands interactive-only (slash commands) |
| 33 | +- Moved codebase indexing to `/init` command |
| 34 | +- Enhanced error handling and user feedback |
| 35 | + |
| 36 | +### Fixed |
| 37 | + |
| 38 | +- Context sharing between interactive session and slash commands |
| 39 | +- Codebase indexing to use installed packages instead of reference directory |
| 40 | +- Permission handling for restricted environments |
| 41 | +- Model connection error messages |
| 42 | + |
| 43 | +--- |
| 44 | + |
| 45 | +## [Unreleased] |
| 46 | + |
| 47 | +### 🎯 MAJOR CHANGE: Everything in CWD (2024-11-24) |
| 48 | + |
| 49 | +**BREAKING CHANGE**: All dspy-code data now stored in current working directory for better isolation and portability. |
| 50 | + |
| 51 | +#### What Changed |
| 52 | +- **Cache location**: Moved from `~/.dspy_cli/cache/` to `.dspy_code/cache/` in CWD |
| 53 | +- **Session data**: Moved from `~/.dspy_cli/sessions/` to `.dspy_code/sessions/` in CWD |
| 54 | +- **Optimization workflows**: Moved from `~/.dspy_cli/optimization/` to `.dspy_code/optimization/` in CWD |
| 55 | +- **Export history**: Moved from `~/.dspy_cli/exports/` to `.dspy_code/exports/` in CWD |
| 56 | +- **Command history**: Moved from `~/.dspy_code_history` to `.dspy_code/history.txt` in CWD |
| 57 | + |
| 58 | +#### Why This Matters |
| 59 | +✅ **True CWD-only operation**: Everything (code, cache, packages) stays in your project directory |
| 60 | +✅ **Enhanced security**: No home directory access at all |
| 61 | +✅ **Perfect isolation**: Each project is completely self-contained |
| 62 | +✅ **Easy cleanup**: Delete project folder to remove everything |
| 63 | +✅ **Portability**: Zip entire project directory to share or backup |
| 64 | +✅ **Simplicity**: One directory = one project with all its data |
| 65 | + |
| 66 | +#### Recommended Setup |
| 67 | +**CRITICAL**: Always create virtual environment INSIDE your project: |
| 68 | + |
| 69 | +```bash |
| 70 | +mkdir my-dspy-project |
| 71 | +cd my-dspy-project |
| 72 | +python -m venv .venv # Creates .venv IN project |
| 73 | +source .venv/bin/activate |
| 74 | +pip install dspy-code dspy |
| 75 | +dspy-code # Everything stays in my-dspy-project/ |
| 76 | +``` |
| 77 | + |
| 78 | +#### Migration |
| 79 | +Your old data in `~/.dspy_cli/` will not be automatically migrated. This is intentional - each project now has its own isolated cache and sessions. |
| 80 | + |
| 81 | +### 🚨 SECURITY FIXES (2024-11-24) |
| 82 | + |
| 83 | +#### File System Access Protection |
| 84 | +- **CRITICAL**: Fixed RAG indexer recursively scanning entire file system including personal directories |
| 85 | +- **CRITICAL**: Added safety checks to prevent accessing iCloud Photos, Documents, Downloads, and other user directories |
| 86 | +- **CRITICAL**: Implemented strict path boundary validation to limit operations to current working directory only |
| 87 | + |
| 88 | +#### Security Measures Added |
| 89 | +1. **Directory Safety Validation** |
| 90 | + - Blocks scanning of home directory (`~/`) |
| 91 | + - Blocks scanning of system directories (`/System`, `/Library`, `/usr`, `/private`) |
| 92 | + - Blocks scanning of user directories (Desktop, Documents, Downloads, Pictures, Photos, Music, Movies) |
| 93 | + - Blocks scanning of immediate home subdirectories |
| 94 | + |
| 95 | +2. **Path Boundary Protection** |
| 96 | + - All file operations validated to stay within project directory |
| 97 | + - Symlink attack prevention - verifies files are actually within project |
| 98 | + - Maximum depth limiting (10 levels) to prevent infinite recursion |
| 99 | + - Explicit permission checks before accessing any file |
| 100 | + |
| 101 | +3. **Startup Safety Checks** |
| 102 | + - Critical warning displayed if running from home directory |
| 103 | + - Warning displayed if running from user directories |
| 104 | + - Error and exit if running from system directories |
| 105 | + - Recommendations to use dedicated project directories with virtual environments |
| 106 | + |
| 107 | +4. **Limited Scanning Scope** |
| 108 | + - RAG indexer only scans: |
| 109 | + - Installed packages in current virtual environment (not system-wide) |
| 110 | + - Specific project directories: `generated/`, `modules/`, `signatures/`, `programs/`, `optimizers/`, `src/` |
| 111 | + - Python files in current directory (non-recursive) |
| 112 | + - Excludes test files, cache directories, hidden files automatically |
| 113 | + |
| 114 | +### Added |
| 115 | +- Comprehensive security test suite (`tests/test_security.py`) |
| 116 | +- Startup directory safety checks |
| 117 | +- Path boundary validation in all file operations |
| 118 | +- Project-specific command history |
| 119 | +- Complete CWD isolation |
| 120 | +- Security documentation page |
| 121 | + |
| 122 | +### Changed |
| 123 | +- **BREAKING**: All dspy-code internal data now in `.dspy_code/` in CWD instead of `~/.dspy_cli/` |
| 124 | +- RAG indexer strictly limited to project directory |
| 125 | +- Project scanner respects path boundaries |
| 126 | +- All `rglob()` operations use safe wrappers with depth limits |
| 127 | +- `.gitignore` updated to include `.dspy_code/` and `.dspy_cache/` |
| 128 | +- Documentation updated to emphasize virtual environment in project directory |
| 129 | + |
| 130 | +### Planned |
| 131 | + |
| 132 | +- Enhanced MCP tool integration |
| 133 | +- Additional DSPy module templates |
| 134 | +- Improved optimization workflows |
| 135 | +- Extended evaluation capabilities |
| 136 | +- Performance optimizations |
| 137 | + |
| 138 | +--- |
| 139 | + |
| 140 | +**For detailed development history, see [GitHub Commits](https://github.com/superagentic-ai/dspy-code/commits/main)** |
0 commit comments