Skip to content
Release Notes

What’s new in each version of Massu

Long-form release logs covering what shipped, why, and how the audit gates kept it honest. For a terse per-version diff, see the changelog.

All Releases

Newest first. Each entry links to the full release log.

v2.0.0July 21, 2026

**Breaking release.** The local database engine now defaults to Node's built-in `node:sqlite` instead of the native `better-sqlite3`, and the minimum Node version is raised to **22.13.0**.

**Breaking release.** The local database engine now defaults to Node's built-in `node:sqlite` instead of the native `better-sqlite3`, and the minimum Node version is raised to **22.13.0**. This ends the Node-ABI-mismatch failure class structurally — the default install has no compiled native module to `dlopen`, so a...

Read release notes
v1.17.0July 21, 2026

The memory system is now feature-complete: cross-repo sharing and the opt-in file renderer land here, both fail-closed and default-off.

The memory system is now feature-complete: cross-repo sharing and the opt-in file renderer land here, both fail-closed and default-off. This is the last release on the `better-sqlite3` engine and the last to support Node 20/21 — the next major (`2.0.0`) switches the local database to Node's built-in `node:sqlite` an...

Read release notes
v1.16.3July 15, 2026

Massu v1.16.3

Release v1.16.3.

Read release notes
v1.16.2July 15, 2026

Massu v1.16.2

Release v1.16.2.

Read release notes
v1.16.1July 14, 2026

Massu v1.16.1

Release v1.16.1.

Read release notes
v1.16.0July 14, 2026

Massu v1.16.0

Release v1.16.0.

Read release notes
v1.15.7July 14, 2026

Massu v1.15.7

Release v1.15.7.

Read release notes
v1.15.6July 14, 2026

Massu v1.15.6

Release v1.15.6.

Read release notes
v1.15.5July 14, 2026

Massu v1.15.5

Release v1.15.5.

Read release notes
v1.15.4July 13, 2026

Massu v1.15.4

Release v1.15.4.

Read release notes
v1.15.3July 6, 2026

**`massu login` hung forever in non-interactive shells (CI / scripts / agents) with `MASSU_API_KEY` set** (`plan-2026-07-06-login-noninteractive-env-hang`).

**`massu login` hung forever in non-interactive shells (CI / scripts / agents) with `MASSU_API_KEY` set** (`plan-2026-07-06-login-noninteractive-env-hang`). `runLogin()` never read the `MASSU_API_KEY` environment variable and then read a non-TTY stdin unbounded (`for await … process.stdin`, blocking on an EOF that n...

Read release notes
v1.15.2July 6, 2026

Massu v1.15.2

**CRITICAL production fix: the `validate-key` cloud edge function returned HTTP 500 on every real API key (deploy drift), silently downgrading every Enterprise/Pro customer to Free** (`plan-2026-07-06-validate-key-deploy-drift`). The DEPLOYED `validate-key` Supabase edge function was a stale bundle that never receiv...

Read release notes
v1.15.1July 5, 2026

**Node 26 compatibility — native-module (better-sqlite3) ABI fix + Node-major CI matrix**.

**Node 26 compatibility — native-module (better-sqlite3) ABI fix + Node-major CI matrix**. Restores massu on the now-default Node 26. `@massu/core` shipped a prebuilt `better-sqlite3` binary compiled for an older `NODE_MODULE_VERSION` (ABI) and declared `engines.node` `">=20.0.0 <26.0.0"`; when Homebrew's default No...

Read release notes
v1.15.0June 2, 2026

**Enterprise auto-learning governance + signed audit export (`plan-2026-06-01-enterprise-governance-audit-export`)**.

**Enterprise auto-learning governance + signed audit export (`plan-2026-06-01-enterprise-governance-audit-export`)**. Generalizes the Phase-3 per-rule two-operator review into an org-level governance policy enforced at the server promotion chokepoint + role-aware RLS, and adds a cryptographically-signed compliance e...

Read release notes
v1.14.0June 2, 2026

**Curated Rule Packs — versioned, installable, actually-enforced (`plan-2026-06-01-curated-rule-packs`)**.

**Curated Rule Packs — versioned, installable, actually-enforced (`plan-2026-06-01-curated-rule-packs`)**. Closes the inert-marketplace bug class: the rule-pack marketplace existed but enforced nothing — installing a pack flattened its rules into `org_rules`, which no core enforcement path ever read. Now an installe...

Read release notes
v1.13.1May 20, 2026

**PreToolUse dispatcher SSOT promotion + hook docs drift closure**.

**PreToolUse dispatcher SSOT promotion + hook docs drift closure**. Closes a customer-blocking regression introduced in 1.13.0: every fresh `npx -y @massu/core@1.13.0 init` wrote `npx -y @massu/core@1.13.0 hook-runner pre-tool-use-gate` into `.claude/settings.local.json` (the consolidated PreToolUse hook landed by P...

Read release notes
v1.13.0May 20, 2026

**v0.2 Interactive Rule-Approval (`plan-v0.2-interactive-rule-approval`)**.

**v0.2 Interactive Rule-Approval (`plan-v0.2-interactive-rule-approval`)**. Closes the silent-self-attestation bug class in Massu's auto-learning system. v0.1 (`auto-learning.md:35-46`) was a protocol obligation the model self-enforces at `/massu-loop` end, audited post-hoc by `/massu-learning-audit`. v0.2 adds real...

Read release notes
v1.12.2May 18, 2026

**Security MEDIUM sweep (`plan-2026-05-18-security-medium-sweep`)**.

**Security MEDIUM sweep (`plan-2026-05-18-security-medium-sweep`)**. Closes the 5 MEDIUM findings from the post-1.12.0 `massu-security-reviewer` audit-loop with structural drift-guards for each. M-1 IP_HASH_PEPPER consistency (silent-fallback vs throw class), M-2 webhook POST schema symmetry, M-3 Lemon Squeezy webho...

Read release notes
v1.12.1May 18, 2026

**Pre-push ↔ CI parity (`plan-2026-05-18-pre-push-ci-parity`)**.

**Pre-push ↔ CI parity (`plan-2026-05-18-pre-push-ci-parity`)**. Closes the structural drift class surfaced 2026-05-18 when SHA `b26fbb1` passed `pre-push-light` locally but failed CI on 4 distinct gates spread across 3 separate workflow YAMLs (`@massu/types/dist` missing → `ci.yml`, `eslint-rules/` missing from `PU...

Read release notes
v1.10.4May 18, 2026

Massu v1.10.4

**Stage C FINAL RELEASE** — pre-launch audit HIGH-severity sub-stages C.7 (architecture, 1 of 3 items) + C.8 (production-live, 2 of 2 items) + C.9 (UX consistency, 4 of 4 items) per `docs/plans/2026-05-18-stage-c-high-batch.md` (plan token `plan-stage-c-high-batch`). 7 items shipped this release; 2 C.7 items (P-H032...

Read release notes
v1.10.3May 18, 2026

Massu v1.10.3

Stage C Release 3 — pre-launch audit HIGH-severity sub-stages C.4 (revenue path, 4 items) + C.6 (auth/billing, 4 items) per `docs/plans/2026-05-18-stage-c-high-batch.md` (plan token `plan-stage-c-high-batch`). 8 items shipped.

Read release notes
v1.10.2May 18, 2026

Massu v1.10.2

Stage C Release 2 — pre-launch audit HIGH-severity sub-stages C.3 (schema/DB, 4 items) + C.5 (security defense-in-depth, 5 of 7 items) per `docs/plans/2026-05-18-stage-c-high-batch.md` (plan token `plan-stage-c-high-batch`). 9 items shipped this release. Two C.5 items (P-H019 Ed25519 license signing + P-H022 nonce-b...

Read release notes
v1.10.1May 18, 2026

Hotfix release for Stage C `plan-stage-c-high-batch` Release 1 — closes the **wider P-H008 marketing-count drift class** caught by post-deploy smoke testing of 1.10.0.

Hotfix release for Stage C `plan-stage-c-high-batch` Release 1 — closes the **wider P-H008 marketing-count drift class** caught by post-deploy smoke testing of 1.10.0. The 1.10.0 P-H008 fix scope was narrow (just `installation.mdx` + `stats.ts`); post-deploy curl of `https://massu.ai/docs/getting-started/installatio...

Read release notes
v1.10.0May 18, 2026

Massu v1.10.0

Stage C Release 1 — pre-launch audit HIGH-severity sub-stages C.1 (hooks + doctor parity, 8 items) and C.2 (MCP tools, 2 items) per `docs/plans/2026-05-18-stage-c-high-batch.md` (plan token `plan-stage-c-high-batch`). 10 P-H items shipped; 28 remain across 1.10.1 / 1.10.2 / 1.10.3 per the operator-revised release pl...

Read release notes
v1.12.0May 17, 2026

**Stage E — LOW + INFO sweep (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-e-low-info-sweep`)**.

**Stage E — LOW + INFO sweep (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-e-low-info-sweep`)**. Closes the 14-agent pre-launch audit by addressing the residual 71 LOW + INFO items not handled in Stages A–D. Stage E ships ~25 actionable items + 2 mandatory CR-46 drift-guards + 5 deferred-idea/...

Read release notes
v1.11.1May 17, 2026

**Stage D — second half (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-d-medium-sweep`)**.

**Stage D — second half (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-d-medium-sweep`)**. Bundles D.5 (live + docs medium, 6 items) + D.6 (UX medium, 8 items) + 2 structural drift-guards (mass-assignment prevention + workflow filename uniqueness extension) = 16 deliverables. Combined with 1.11...

Read release notes
v1.11.0May 17, 2026

**Stage D — MEDIUM-severity sweep (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-d-medium-sweep`)**.

**Stage D — MEDIUM-severity sweep (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-d-medium-sweep`)**. First of the two Stage D patch releases. Bundles D.1 (DB lifecycle, 10 items), D.2 (API webhook hygiene, 14 items), D.3 (revenue + cron, 6 items), D.4 (architecture cleanup, 7 items), and the SQ...

Read release notes
v1.10.8May 17, 2026

**P-H033 — Adapter-pattern tool gating (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`)**.

**P-H033 — Adapter-pattern tool gating (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`)**. This is the FINAL Stage C deferred-item release. With 1.10.5 (Ed25519 license signing), 1.10.6 (CSP hardening), 1.10.7 (config-driven SQL table names), and now 1.10.8, all 4 Stage C deferred ...

Read release notes
v1.10.7May 17, 2026

**P-H032 — Config-driven SQL table names (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`)**.

**P-H032 — Config-driven SQL table names (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`)**. 207 SQL string substitutions across 21 source files migrated from hardcoded `'massu_<table>'` literals to `${t('<table>')}` template-literal substitutions resolving through a new `lib/sql-t...

Read release notes
v1.10.6May 17, 2026

**P-H022 partial advance — CSP hardening (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`)**.

**P-H022 partial advance — CSP hardening (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`)**. The full nonce-based CSP migration (per-request middleware nonce + Next.js consumption pattern + per-page smoke testing) requires multi-day operator-coordinated work and is tracked as the e...

Read release notes
v1.10.5May 17, 2026

**P-H019 Ed25519 license signing** — closes the deferred follow-up from Stage C (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`).

**P-H019 Ed25519 license signing** — closes the deferred follow-up from Stage C (parent plan `plan-2026-05-16-prelaunch-audit`, sub-plan `plan-stage-c-high-batch`). Pre-fix `packages/core/src/license.ts:280-318` accepted ANY `{valid:true,plan:'enterprise'}` JSON over HTTPS from whatever `config.cloud?.endpoint` poin...

Read release notes
v1.9.5May 16, 2026

Massu v1.9.5

Pre-launch comprehensive audit remediation — combined Stage A + Stage B release covering all 22 CRITICAL findings from the 14-agent adversarial audit fleet (`docs/plans/2026-05-16-prelaunch-audit-remediation.md`, plan token `plan-2026-05-16-prelaunch-audit`). Every fix is structural — paired with a vitest drift-guar...

Read release notes
v1.9.3May 15, 2026

Bug-fix release.

Bug-fix release. Closes upstream issue [massu-ai/massu#4](https://github.com/massu-ai/massu/issues/4) — `tools/list` emitted a non-standard top-level `tier` field on every Tool object, which Claude Code 2.1.143 (released 2026-05-15) silently rejects, causing all 67 `mcp__massu__*` tools to disappear from the deferre...

Read release notes
v1.9.2May 15, 2026

Plan `plan-1.9.2-deploy-smoke-test-production-host` — `/massu-deploy` smoke tests now target the canonical production host (`https://massu.ai`) instead of the per-deploy Vercel preview URL.

Plan `plan-1.9.2-deploy-smoke-test-production-host` — `/massu-deploy` smoke tests now target the canonical production host (`https://massu.ai`) instead of the per-deploy Vercel preview URL. Closes the structural bug discovered 2026-05-15 during the 1.9.1 ceremony where every smoke test on `/`, `/docs`, `/changelog`,...

Read release notes
v1.9.1May 15, 2026

Bug-fix release.

Bug-fix release. Closes the structural rendering bug discovered 2026-05-15 in the auto-derived `/releases/<version>` path shipped in 1.9.0 (CR-46 consolidation). Each section's bullet items were pushed as separate elements of the `parts` array and joined with `\n\n`, so the blank lines between consecutive `- foo` ma...

Read release notes
v1.8.0May 14, 2026

Massu 1.8.0: MCP permission seeding suite — install-commands extension + permissions <sub> CLI cluster

install-commands now seeds the canonical mcp__massu__* glob into .claude/settings.local.json and propagates global defaultMode into the project-local file (closing an empirically-observed settings-merge trap). New massu permissions install|verify|check-drift CLI cluster + pre-push drift detection.

Read release notes
v1.9.0May 14, 2026

Massu 1.9.0: Plan-token-aware CHANGELOG batcher — release-boundary generator + pre-tag gate

New massu changelog generate|verify CLI cluster auto-drafts CHANGELOG entries by grouping commits by (plan-<token>) paren-notation and pulling each plan's ## Changelog Summary section. New pre-push step 11/11 BLOCKS pushes when version drifts from tag without a matching changelog entry.

Read release notes
v1.5.x → 1.6.0May 11, 2026

Massu 1.5.x → 1.6.0: structural drift-guards + workspace adapter publish

Two minors in 36 hours: 1.5.8 ships the plan-status structural drift-guard (CR-40) and 1.6.0 publishes the workspace adapter packages (Phase 9b). Soak verdict: PASS. Includes patches through @massu/core@1.7.0 (cohesive cleanup).

Read release notes
v1.7.0May 11, 2026

Massu 1.7.0: cohesive cleanup — stats SoT + monorepo domain-inferrer + npm dist-tag hygiene

Cohesive minor release bundling three structural-quality fixes in one ceremony: stats-vs-source-truth drift-guard for the homepage, monorepo domain-inferrer fix for non-src/ layouts, and removal of the stale `next: 1.2.1` npm dist-tag with policy documented in CLAUDE.md.

Read release notes
v1.6.3May 11, 2026

Massu v1.6.3

Plan `plan-1.6.3-website-feature-discoverability` — Website + scanner patch eliminating two structural drift classes surfaced 2026-05-11 when the user asked "where do these changelogs show up on the website?": (a) public page added without nav link discoverable only via direct URL; (b) website code shipped to npm + ...

Read release notes
v1.6.2May 10, 2026

Plan `plan-1.6.2-server-lazy-db-deps` — Daemon-code patch eliminating the structural bug where every MCP tool/call eagerly opened both CodeGraph + Data SQLite DBs at the top-level dispatcher.

Plan `plan-1.6.2-server-lazy-db-deps` — Daemon-code patch eliminating the structural bug where every MCP tool/call eagerly opened both CodeGraph + Data SQLite DBs at the top-level dispatcher. In any repo without `.codegraph/codegraph.db`, ALL tools failed — even memory/audit/knowledge tools with no logical codegraph...

Read release notes
v1.6.1May 10, 2026

Plan `plan-changelog-sot` — Website changelog now renders from `CHANGELOG.md` source-of-truth at build time.

Plan `plan-changelog-sot` — Website changelog now renders from `CHANGELOG.md` source-of-truth at build time. The hardcoded `ChangelogEntry[]` array on `website/src/app/changelog/page.tsx` (stale by 5+ major releases, last entry `0.6.3`, mismatched `0.x` scheme vs npm's `1.x`) and the orphaned `website/content/change...

Read release notes
v1.6.0May 9, 2026

Plan 3c Phase 9b — workspace adapter publish (`plan-3c-phase9b`).

Plan 3c Phase 9b — workspace adapter publish (`plan-3c-phase9b`). Closes the 1.5.0 Infrastructure note ("5 workspace placeholder packages remain at `0.0.0-prework`") by shipping the 5 first-party AST adapters as standalone npm packages alongside `@massu/core@1.6.0`. Architecture is **Z+II**: workspace package source...

Read release notes
v1.5.8May 9, 2026

Plan-status drift-guard release.

Plan-status drift-guard release. Closes the recurring "manual refresh of stale plan-Status headers" pattern with three structural layers: schema validator, commit-link drift scanner, and a vitest drift-guard test. Adds a canonical `**Plan Token**:` field to all 55 plans so commits can be cross-referenced bidirection...

Read release notes
v1.5.7May 8, 2026

Test infrastructure release.

Test infrastructure release. Closes the two follow-ons documented in 1.5.5 and 1.5.6 CHANGELOGs as the structural drift-prevention against the class of bug that produced both hotfixes (FIRST_PARTY_ADAPTERS divergence + bundle-vs-source CI gap).

Read release notes
v1.5.6May 8, 2026

Hotfix on 1.5.5.

Hotfix on 1.5.5. 1.5.5 added the 6 Phase 7 adapters to `FIRST_PARTY_ADAPTERS` correctly, but the bundled `dist/cli.js` inlined `web-tree-sitter` while its companion `tree-sitter.wasm` runtime artifact was NOT copied to `dist/`. R-011 evidence (live test against published 1.5.5):

Read release notes
v1.5.5May 8, 2026

Hotfix on 1.5.4 (published ~10 min earlier same day).

Hotfix on 1.5.4 (published ~10 min earlier same day). 1.5.4 shipped the file sampler + introspect piping correctly but `codebase-introspector.ts:FIRST_PARTY_ADAPTERS` only listed the 4 original Plan-3b adapters. Phase 7 adapters (`rails`, `phoenix`, `aspnet`, `spring`, `go-chi`, `python-flask`) were committed Phase ...

Read release notes
v1.5.4May 8, 2026

Closes Plan 1.5.1 §3 item #4 (the explicitly-deferred AST adapter output piping).

Closes Plan 1.5.1 §3 item #4 (the explicitly-deferred AST adapter output piping). Pre-1.5.4 `introspectAsync()` handed AST adapters `SourceFile[] = []` because of a placeholder at `codebase-introspector.ts:160-170`. Adapters always worked (verified by `adapter-grammar-strict.test.ts` 10/10 fixtures with `'high'` con...

Read release notes
v1.5.3May 8, 2026

Test infrastructure release that closes the source-vs-bundle gap demonstrated by 1.5.1 → 1.5.2 hotfix.

Test infrastructure release that closes the source-vs-bundle gap demonstrated by 1.5.1 → 1.5.2 hotfix. Pre-1.5.3, `init-end-to-end.test.ts` ran against TS source via vitest where `__dirname` resolves at `src/commands/`-depth; production `dist/cli.js` has different depth and was failing the same scenarios despite the...

Read release notes
v1.5.2May 8, 2026

Hotfix on 1.5.1 (published ~30 min earlier same day).

Hotfix on 1.5.1 (published ~30 min earlier same day). 1.5.1's variant-template merge was structurally correct but `resolveTemplatesDir()` had a long-standing path-resolution bug that returned `null` from the bundled `dist/cli.js` — so `applyVariantTemplate` always bailed at its first guard, leaving `framework.router...

Read release notes
v1.5.1May 8, 2026

Patch release closing two CR-39 violations discovered via end-to-end fixture verification of `npx massu init` against all six Phase 7 frameworks.

Patch release closing two CR-39 violations discovered via end-to-end fixture verification of `npx massu init` against all six Phase 7 frameworks. Phoenix and ASP.NET projects could not previously install Massu (`error: no languages detected`); Rails / Spring / Go-chi installed but emitted generic configs missing the...

Read release notes
v1.5.0May 7, 2026

Plan 3c (adapter registry + framework coverage).

Plan 3c (adapter registry + framework coverage). Registry infrastructure (`registry.massu.ai`) is live and signed; six new first-party AST adapters bring supported framework count from 4 to 10 (rails, phoenix, aspnet, spring, flask, go-chi added on top of the 1.4.0 baseline of fastapi, django, nextjs-trpc, swiftui)....

Read release notes
v1.4.0May 7, 2026

Promotes the `1.4.0-soak.0` build (in soak since 2026-05-02) to `latest`.

Promotes the `1.4.0-soak.0` build (in soak since 2026-05-02) to `latest`. Soak-check verdict on 2026-05-07 09:00 PDT: **PASS** (samples=188, rss_p99=290 MB / budget 700, cpu_load=0.044 / budget 50, alive_pct=100, errors=0, slope=-11.35 MB/hr).

Read release notes
v1.3.0April 26, 2026

Stack-aware command templates with per-stack variant resolution.

Stack-aware command templates with per-stack variant resolution. Local-edit protection via 3-hash manifest. (Retroactive entry: not previously logged in CHANGELOG; corresponds to npm-published version `1.3.0` from 2026-04-26.)

Read release notes
v1.2.1April 20, 2026

`@massu/core init --ci` no longer rolls back on fresh monorepo installs (turbo, nx, pnpm workspaces, lerna, rush, generic).

`@massu/core init --ci` no longer rolls back on fresh monorepo installs (turbo, nx, pnpm workspaces, lerna, rush, generic). Fixes the 2026-04-20 monorepo `paths.source` rollback regression.

Read release notes
v1.2.0April 20, 2026

`config upgrade` and `config refresh` no longer silently drop user-authored config data.

`config upgrade` and `config refresh` no longer silently drop user-authored config data. Fixes the 2026-04-19 HIGH-severity config-data-loss regression.

Read release notes
v1.1.0April 19, 2026

`massu config` CLI surface + drift detection runtime.

`massu config` CLI surface + drift detection runtime. Unblocks the config-migration workflow for downstream repos. Additive only — no breaking changes.

Read release notes
v1.0.0April 19, 2026

Auto-detect on install; zero manual config; migration via `migrateV1ToV2()`.

Auto-detect on install; zero manual config; migration via `migrateV1ToV2()`.

Read release notes
v0.3.0February 25, 2026

Massu v0.3.0

Release v0.3.0.

Read release notes

Try the latest release

Install Massu and start governing your AI development today.