releases.sh Release Notes

Minor Changes

• 735ba8a: The local stdio MCP bridge's get_catalog_entry tool now accepts include_changelog, changelog_path, changelog_offset, changelog_limit, and changelog_tokens — matching the hosted server at mcp.releases.sh — so a source entry's tracked CHANGELOG can be inlined or sliced in the same call, without a separate lookup. changelog_tokens takes precedence over changelog_limit, and any changelog_* param implies include_changelog; the params are ignored (with a clear message) for product entries. The standalone get_source_changelog tool is now deprecated in favor of these params — it remains registered and functional for this release, but agents should migrate.
• 7ba0ebd: releases org get now renders stub-tier orgs (#1947): a stub · not yet tracked marker on the header and a Declared locations section listing each declared locator (kind, target, canonical flag), plus a hint to promote. Previously a stub printed as a bare identity block with no indication it was a declared-but-untracked listing. --json output is unchanged.

Patch Changes

• 64951a6: Add releases admin release refetch <releaseId> to re-fetch a single release's live page and heal it in place (title/content/publishedAt, same rel_ id). Supports --url for releases whose stored URL is a synthesized #fragment index anchor, defaults to a dry-run preview, and writes with --apply. …

**Added** - Homepage features an interactive CLI preview — job-led tabs demo live commands and responses, with a live vitals strip showing indexed source and release counts. - Compact release cards now show a media thumbnail when the release has associated imagery. - Org rows in the catalog and search results now display provenance — origin domain, alias badge, and a stub icon for listings awaiting verification. - Digest emails redesigned for scannability — releases grouped by org with compact multi-release blocks and clearer visual hierarchy. - In-place release re-fetch: `POST /v1/workflows/refetch-release` re-fetches a single release's live page and updates its title, content, and date in place without changing its ID. - `GET /v1/lookups/by-domain` now auto-materializes a listing stub on miss when the domain has a valid `releases.json` manifest, returning a 200 instead of 404. **Changed** - Release pages now use a shared org-level OG card across all releases from that org, instead of rendering a per-release image. - `/v1/search` release hits no longer include full markdown content by default; pass `?include_content=true` to opt in. **Fixed** - Org and product catalog pages now fall back to REST when GraphQL is unavailable during deploy windows, rather than showing an error state. - Root-relative per-post permalinks (e.g. `/blog/post`) now resolve correctly during extraction. - `GET /v1/orgs/:slug` now resolves by the org's primary domain, fixing l…

Minor Changes

• eaa4ad1: Add releases json export <org> — generate a releases.json v2 domain manifest from an already-tracked org. Reconstructs the manifest from what the registry knows about the org (products + release sources) by calling the backend GET /v1/orgs/:slug/manifest endpoint, so an owner can host the result at /.well-known/releases.json and take ownership of their listing. Prints to stdout by default (pipeable into releases json validate -) or writes to a file with -o/--output. Completes the owner round-trip alongside releases json validate. Re-ingest enriches missing fields only (fill-if-empty), never overwriting existing values.

  Bumps @buildinternet/releases-api-types to ^0.41.0 for the product-level tags field, so releases json validate accepts manifests that declare product tags. json export itself trusts the backend and does not strict-validate the API response against the pinned schema (the deployed API can run ahead of the published types), so it only guards for a version: 2 shape.

**Added** - `GET /v1/orgs/:slug/manifest` — export any tracked org as a `releases.json` v2 domain manifest; reconstructs declared products, source locators, and canonical flags from live registry data; intended as an editable baseline to host at `/.well-known/releases.json`. - `creating-releases-json` Claude Code skill — an agent-guided flow for writing a `releases.json` v2 manifest from your domain or repo; install via `npx skills add` from the monorepo; the `/submit` page now shows a click-to-copy install command alongside the listing check. - "Report an issue" button on org, product, source, and release pages — opens a contextual popover to send a short note to operators without leaving the page. **Changed** - The `/submit` listing check now previews richer details for valid manifests — org identity (name, slug), products with per-product source counts, and a table of detected release locations with kind chips and tier badges. **Fixed** - MCP `get_organization` now measures overview age from the last-edit timestamp instead of the original generation date — recently amended overviews no longer appear falsely stale.

Minor Changes

• f1f11ae: releases json validate <domain> now validates live against the registry's listing endpoint (previously deferred). The domain form POSTs the public /v1/listing/validate endpoint and renders the verdict plus the materialization plan — identity, products, and each release locator with its classification ("goes live" / "reviewed first") — ending with an activation pointer for unlisted domains. Exit codes: 0 valid, 1 invalid or check failed (the old unconditional exit 2 is gone). --json emits the raw ListingValidationResult merged with { target }. Bumps @buildinternet/releases-api-types to ^0.39.0 for the listing wire types.
• af88692: releases admin release update (and its deprecated release edit alias) now accept a --url <url> flag to set a release's canonical URL. Passing a non-empty value sets the URL; passing an empty string (--url "") clears it. The backend PATCH /v1/releases/:id route already accepted the url field — this wires it through the CLI. …

**Added** - Domain ownership claims — a new "Own this domain?" panel on listing pages lets signed-in users prove control via a `.well-known/releases-verify.txt` file or a DNS TXT record; once verified, a single click enables live release tracking and materializes sources without waiting for curator review. - Slack notifications are now a first-class setup path — a new guide at `/docs/integrations/slack` walks through connecting a Slack incoming webhook, and the notifications page gains a dedicated section to paste, test, and remove a hook without going into the advanced webhooks form. - Unlisted domains that are frequently searched now auto-create stub listings — domain lookup misses are captured as demand signals and a daily sweep probes high-demand unlisted domains for a `releases.json` manifest, creating stubs automatically. **Changed** - Anonymous API reads are now served from Cloudflare Workers Cache — a global tiered cache rather than per-datacenter, so catalog, org, and search responses warm once and hit worldwide. **Fixed** - Auth sessions are no longer cached — a Workers Cache heuristic was letting `GET /api/auth/get-session` responses land in the shared cache, causing signed-in users to appear signed out for up to two hours. - Admin-gated and authorization-required API responses are no longer stored in shared cache — a gap where write-scoped and admin responses could be served to anonymous callers has been closed.