chore: version packages

[github-actions]

Primary change type

• Maintenance or refactor

Problem and motivation

Publish the merged Studio Agent Map, onboarding, and managed desktop-provider work with consistent package versions and release notes. This is the versioning step before the desktop beta and production release.

Summary and scope

Consume the 29 pending Changesets and update manifests, lockfile, CLI peer requirements, and changelogs:

Package	Version
@sapiom/harness	0.15.0
@sapiom/harness-desktop	0.4.5
@sapiom/agent-studio	0.1.24
@sapiom/cli	14.0.0
@sapiom/sandbox	0.8.5

Clarify that current format-2 storage is never reset, authored maps/history are protected, and eligible empty containers can receive their first map. Describe Plan Agents as an ordinary session and delegation as available functionality.

Related work

Related issue or discussion: release requested by the maintainer for #819, #820, #822–#834, #836, #844, #845, and #843. Package repository metadata is tracked in #847.

Validation

The final merged implementation passed all checks on #845 and #843, including Node 20/22 tests, browser tests, desktop smoke, and examples. Local verification of the same implementation included 3,852 harness tests, 567 browser tests, 11 canvas tests, macOS packaging/smoke, actual Claude Code and Codex inference, copied-profile migration/restart, and authenticated ordinary-session map edits.

git diff --check — passed
Generated version commit contains the final implementation merge — verified
Versioned package CI — all checks passed (Node 20/22, browser/canvas, Linux desktop smoke, examples, CodeQL, and automated review)
Versioned macOS build + full installer packaging + smoke — passed; 15 applicable smoke checks

Tests and documentation

This PR changes generated release metadata and changelog wording. Product regression coverage is included in the merged implementation PRs. No additional implementation tests are needed for the wording changes.

Compatibility and release impact

• Breaking or externally visible changes: harness 0.15.0 removes superseded role/planner APIs in favor of neutral project identity and ordinary sessions; the changelog includes the migration instructions. CLI 14 raises its optional harness peer minimum to 0.15.0. Desktop 0.4.5 includes map initialization and managed coding-provider updates.
• Changeset: consumes the existing Changesets; no new Changeset is appropriate for the generated version PR.
• Desktop delivery: publish and verify a matching beta tag before the stable tag. npm publication is separate; the existing sandbox Trusted Publisher authentication failure is being tracked independently and does not affect Studio's dependency closure.

Security

• I have not included secrets, credentials, private data, or unsanitized logs.
• This pull request does not publicly disclose a suspected vulnerability. I will follow the Security Policy for private reporting.

AI assistance

• I used AI assistance and have described it below.

Codex reviewed the generated version changes, clarified release notes against the implementation, and ran the release verification. Changesets generated package versions and dependency updates.

Checklist

• I read CONTRIBUTING.md, and this contribution follows the direct-PR or issue-first policy.
• This pull request addresses one focused problem and contains no unrelated cleanup.
• I added or updated tests, or explained above why tests are not applicable.
• I ran the relevant build, typecheck, lint, and test commands, or explained any N/A checks above.
• I updated documentation for user-facing changes, or marked it N/A above.
• I added a Changeset for a published-package change, or explained why it is not applicable.
• I can explain and maintain every submitted change, including any AI-assisted work.

[github-actions]

Review — PR #793 (chore: version packages)

Confidentiality sweep: clean. Every added CHANGELOG line was read as npm-facing copy. The
only named parties are Sapiom, Claude Code / Codex, Electron, xterm, Windows, GitHub and npm —
all inside the public provider vocabulary. No customer or partner names, no business or
billing arrangements, no internal hostnames, incident/Slack references, employee names, or
private repo links.

---

1. Hand-edited generated CHANGELOG — the edits will be silently reverted, and already diverge across packages

Commit 3f43afdf ("docs(release): clarify Agent Map migration and session notes") rewrites four
entries in packages/harness/CHANGELOG.md — 58fb5cf, d5c26ae, 4622f40, cf2369c — without
touching the changeset sources on main. Two concrete consequences:

a) The clarifications are one push away from disappearing. .github/workflows/release-pr.yml
re-runs changeset version on every push to main that isn't CHANGELOG-only and force-updates
this branch. The next changeset that lands regenerates packages/harness/CHANGELOG.md from
.changeset/*.md and restores the original wording — including "in preparation for tool
activation" and "independently of later storage and tool activation", which appear to be exactly
the phrases the commit was trying to remove before publish.

b) The same changeset already ships two different texts. cf2369c now reads:

• packages/harness/CHANGELOG.md:107 — "…bootstrap in the first ordinary session, titled Plan Agents."
• packages/harness-desktop/CHANGELOG.md:17 — "…bootstrap in the first Plan Agents session."

packages/harness/package.json lists CHANGELOG.md in files, so the harness copy is published
and unretractable.

Worth noting for the wording review specifically: scripts/provider-neutral-copy-check.mjs:225
skips CHANGELOG.md by design and audits .changeset/*.md instead
(scripts/provider-neutral-copy-check.mjs:235). Editing the generated file therefore routes the
new copy around the one automated guard that exists for it.

Fix: revert 3f43afdf, apply the four wording changes to
.changeset/durable-delegation-state.md, .changeset/immutable-project-version-contracts.md,
.changeset/initialize-existing-project-agent-maps.md and .changeset/unified-project-agents.md
on main, and let the action regenerate this branch. Both changelogs then agree and the copy
check sees the new text.

2. @sapiom/cli publishes a major with a changelog that says only "Patch Changes"

packages/cli/CHANGELOG.md gains a ## 14.0.0 section whose entire body is 26 "Updated
dependencies" lines under the heading ### Patch Changes. A consumer reading npm sees a major
bump with no breaking note and no migration text.

The bump is real, not cosmetic: packages/cli/package.json widens
peerDependencies["@sapiom/harness"] from >=0.14.0 to >=0.15.0, which fails peer resolution
for anyone pinned to harness 0.14. But nothing in the changelog says so.

The cause is changesets' default rule that a peer-dependency bump majors the dependent. It has
now fired seven times — packages/cli/CHANGELOG.md shows 8.0.0 through 14.0.0 all with
patch-only bodies — so the cli major number carries no information, while every one of them
trips renovate/dependabot major gates and blocks automatic upgrades downstream.

Fix, pick one: (a) add a @sapiom/cli changeset each release documenting the peer-range
change, so the major at least has a migration line; or (b) set
___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH.onlyUpdatePeerDependentsWhenOutOfRange: true
in .changeset/config.json so the cli only majors when the range genuinely goes out of range.
(b) is the durable one; do it in a separate PR, not this release.

Nits

• cf2369c's migration paragraph in both changelogs contains a stray line break mid-sentence
  ("…generic session routes. An\nembedder that already owns…"), a leftover from an earlier edit;
  harmless in rendered Markdown but it is the paragraph consumers are most likely to read.
• The contribution: incomplete label is a labeler artifact on a bot-authored PR whose body is
  fixed by changesets — not actionable here, but it means the label carries no signal on release PRs.

---

Verdict: No leaks, but do not merge as-is — the hand-edited packages/harness/CHANGELOG.md
should be moved into the source changesets (finding 1) so the published text is reproducible and
consistent across packages.