release: CLI v0.6.0 + extension v0.1.5

[George-iam]

Summary

Combined release bump:

Track	Old	New	Tag
CLI (axme-code binary)	0.5.0	0.6.0	v0.6.0
VS Code / Cursor extension	0.1.4	0.1.5	extension-v0.1.5

CLI bump is MINOR (new features without breaking changes). Extension bump is PATCH (bundles the new CLI, no extension-side feature change since v0.1.4).

Highlights — CLI v0.6.0

Multi-IDE / multi-host release. Pulls in 35+ commits since v0.5.0 (2026-04-29).

Added

• First-class Cursor IDE support (feat(cursor): Phase 1 foundation (IDE abstraction + AgentSdk factory) — held until Phase 2 extension validates #129) — hook adapter, JSONL transcript parser, AgentSdk factory, cursor_sdk auth mode, unified conversation_id session keying across PreToolUse / PostToolUse / SessionEnd.
• error_class on setup_complete telemetry (feat(telemetry): capture error_class on setup_complete failures #144) — auth_check → \"oauth_missing\", init_scan → classifyError(err). Closes the dashboard's NULL bucket for setup failures.
• Cooperative-by-default auditor mode + sidebar credential UX. Background mode is opt-in and prompts for credential on first run.
• Mode-aware axme_decisions / axme_memories — catalog-only output in search mode (closes v0.5.0 regression where bodies were silently re-loaded).
• Active KB usage block in search-mode instructions — concrete trigger predicates instead of generic "use search".
• Shell-aware install.sh — emits the right PATH-add syntax for bash / zsh / fish / tcsh / csh; install.sh is also now safely sourceable for unit tests.
• Hooks fall back to stdin workspace_roots when --workspace is absent (Cursor's hook payload).

Changed

• axme_finalize_close schema: actionable required-field errors (fix(mcp): make axme_finalize_close required-field errors agent-actionable #145). Each of the 6 required strings now emits a named, contextual error with an empty-state placeholder. axme_begin_close checklist splits REQUIRED vs optional with omit-is-error rationale.
• Setup prompts are strictly imperative; summary lists decisions + memories + preset enforcement; KbWatcher handles late KB creation correctly.

Fixed

• Scanners block reads from credential / secret paths (.env*, id_rsa*, *.pem, …) during setup.
• Scanners stay inside the project being initialised — no more accidental reads from sibling repos under a common parent.
• Hooks normalize Cursor tool_name=Shell to Bash so the safety hook (force-push / rm -rf / secret-file blockers) actually fires on Cursor sessions.
• Search-mode install on Windows — node + npm-cli.js invocation (dodges CVE-2024-27980), keep sharp (drop --omit=optional), augment PATH for sharp postinstall, auto-extract bundled npm tarball on plain axme-code installs.
• Misc: inline claude-agent-sdk in extension bundle, fresh agentId per Cursor SDK call, suppress noisy fallback / MaxListeners warnings during setup, stop instructing agent to run axme-code setup autonomously, modernize tsconfig to NodeNext + ignoreDeprecations: \"5.0\".

Full CHANGELOG entry in this PR.

Highlights — extension v0.1.5

Bundles CLI v0.6.0. No extension-side feature deltas since v0.1.4 — this bump exists so the .vsix on Open VSX ships the new CLI behaviour to extension users.

Test plan

• Type-check clean (npx tsc --noEmit)
• 608/608 tests pass (npm test)
• Bundle builds (npm run build)
• After merge, push the two tags to fire the release workflows (see After merge).

After merge

The agent cannot push tags. Once this PR lands on main, run from a clean checkout of the updated main:

# Switch + sync
git checkout main && git pull origin main

# Tag the CLI release (fires .github/workflows/release-binary.yml)
git tag v0.6.0
git push origin v0.6.0

# Tag the extension release (fires .github/workflows/publish-extension.yml)
git tag extension-v0.1.5
git push origin extension-v0.1.5

Each tag push runs an independent CI matrix:

• v0.6.0 builds platform-specific binaries (Linux x64/arm64, macOS x64/arm64, Windows x64) + publishes via npm + creates the GitHub Release with attached archives.
• extension-v0.1.5 builds 5 platform-specific .vsix files + publishes to Open VSX + creates the GitHub Release with the .vsix attached. Cursor's marketplace mirror auto-syncs from Open VSX 1-3 days later.

Watch the workflow runs at https://github.com/AxmeAI/axme-code/actions.

🤖 Generated with Claude Code