[AbhishekDoshi26]

Dependencies

• None. Entries for changes merged but not yet released (CLI after 1.6.130, _shorebird after the 2026-10-20 prod deploy) are left out on purpose. docs: list Shorebird's hosts and how to download from an internal mirror #744 adds the mirror entry for the next CLI release.

Description

Audits the changelog against every CLI release through 1.6.130 (RELEASE_NOTES.md, PR bodies and source at each tag) and every successful "Deploy All to Prod" run in _shorebird from 2026-10-08 through 2026-10-20, and adds the 29 user-visible changes that had no entry. Dates follow the template: the CLI release date, or the US Pacific day of the first prod deploy containing the change.

CLI 1.6.129 (2026-10-16): shorebird api, shorebird metrics, shorebird releases delete, --yes on deletes, one JSON object from every --json command, the whoami plan line, Apple builds keeping .dart_tool, and the remaining fixes.

CLI 1.6.130 (2026-10-17): DEX diff details and --show-dex-diff, --confirm removed from release and patch, the remaining fixes (including the CLI's User-Agent), and three more bullets on the existing api-method-and-paginate.md (--jq slices, repeated /api/v1, the 405 hint).

Console, API and Code Push:

Date	Entry
10-13	usage-owned-orgs
10-14	org-switcher, saml-sha1-refused, failed-payment-invoices-voided
10-15	audit-log-siem-export, audit-log-roles, api-errors-and-paging, api-plan-limits, patch-cache-cleared-on-delete, wrong-provider-message
10-16	audit-log-actor-details
10-17	roles-plan-no-longer-offers, saml-first-sign-in-keeps-account
10-18	delete-tracks-hide-rolled-back, session-revoke-immediate, console-fixes-2026-10-18
10-20	name-new-organizations, patch-check-publish-race

Left out on purpose: internal, staff-only and feature-flagged changes (the hidden /enterprise page, the unused news dialog), a first-load blank-page fix, the organization_id field, and the Mission Control adoption version note.

Docs pages the new entries link to, updated so they describe what the entries say:

• Organizations, Creating an organization: still said to click your email in the bottom left and that a new org is called "My Organization". It now describes the org switcher, the name dialog, and that creating one needs a paid plan of your own (org-switcher.tsx, create-organization-dialog.tsx, can-create-organization.ts). The two screenshots of the old UI are removed, with their image files.
• Organizations, Member roles: Developer is offered on every plan, Free included (planOffersRole in role_grants.dart).
• SAML, How sign-in works and Troubleshooting: an existing account moving onto SSO, and SHA-1 as a cause of "SSO login failed".
• Tracks, Delete a track: the Console's delete button.
• Troubleshooting, native changes warning, and Patch options: the DEX detail Android warnings now show, and --show-dex-diff (1.6.130).
• Release and Patch sample output: drops the Would you like to continue? (y/N) line, a prompt 1.6.130 removed.
• Rollback, Roll Forward: rolled-back patches are hidden in the Console until Show rolled back and deactivated is turned on.
• FAQ, Can you use Shorebird with your team?: says what limits the Free plan (personal organizations can't take invitations, and a team organization needs a paid plan) instead of "a single developer".
• Organizations, Member roles intro: roles depend on the organization's plan, which is its owner's.

npm run build (which validates every entry and docLink anchor), Prettier, cspell and Vale pass.

Screenshots

New entries render from the existing template; the Organizations section loses two outdated screenshots.

Landing

As soon as approved.

[AbhishekDoshi26]

Round 1 (two fresh reviewers, CLI and server-side halves): 28 findings. All will be fixed.

CLI entries

1. delete-confirm-yes.md (high): says delete commands used to exit 0 on decline, but at v1.6.128 channels delete and apps delete had no prompt (they required --confirm-name) and releases delete didn't exist. #4085 changed patches set-track and the native/asset "Continue anyway?" prompt of shorebird patch from 0 to 1; the latter is missing.
2. metrics-commands.md: the shorebird_plan_insufficient_tier bullet describes an error users can't hit today (every tier carries the Insights features in plan_feature.dart). Delete it.
3. delete-confirm-yes.md: "apps delete still needs the name, typed at the prompt" implies it already prompted; #4098 added that prompt in 1.6.129.
4. cli-fixes-1-6-130.md: the User-Agent value is truncated; #4106 sends shorebird-cli/<version> (<os>; dart <version>).
5. cli-fixes-1-6-129.md: "share one login refresh" overstates #4073. A second process reuses an unexpired token on disk or refreshes with the newest refresh token.
6. cli-fixes-1-6-129.md: #4058 covers iOS framework patches too.
7. cli-fixes-1-6-129.md: "before downloading anything" is too broad; #4051 checks before the release's artifacts are downloaded.
8. cli-fixes-1-6-129.md: #4057 is about paths deleted before the command finishes, not already deleted.
9. cli-fixes-1-6-130.md: missing "when it needs a confirmation", so it reads as if every command asks for --yes.
10. release-patch-confirm-removed.md: the docLink target never mentions --confirm. Drop it.
11. whoami-plan-only.md, release-patch-confirm-removed.md (nit): titles start lowercase, unlike every other entry.
12. whoami-plan-only.md (nit): null means the server didn't report a level.
13. delete-confirm-yes.md, releases-delete.md (nit): --yes is also required in CI and with --json.
14. patch-dex-diff-details.md (nit): the 10-method cap is per DEX file (#4072).

Console, API and Code Push entries

15. saml-sha1-refused.md: users see "SSO login failed" (saml_failed in auth-errors.ts), not "SAML sign-in failed".
16. audit-log-siem-export.md: nextCursor was a response field, not a parameter.
17. api-errors-and-paging.md: #3517 adds WWW-Authenticate to 401s and scope 403s only, not every 403.
18. patch-cache-cleared-on-delete.md: rollbacks already reached devices on the next check (#3571 only made a failed cache clear retryable), the release-delete fix was a race, and #3570 deletes the patches' files for that platform, not the patches.
19. account/orgs.mdx Member roles table: Free has no Developer check, but planOffersRole always allows Developer (role_grants.dart:34), which two new entries state.
20. audit-log-roles.md: Auditor is held only by service accounts (not on any plan's member roles), the bullet repeats service-accounts.md, and the summary should say Enterprise and the API.
21. api-plan-limits.md: "Hobby" should be "Free", the role check reads the organization's plan, the blank-name rule is validation not a plan rule, and it applies on create too.
22. account/orgs.mdx Creating an organization: only the name can be edited, and creating needs a paid plan of your own (can-create-organization.ts), otherwise the switcher shows "Upgrade to create an organization".
23. delete-tracks-hide-rolled-back.md: the app transfer bullet (#3798) doesn't belong; move it to console-fixes-2026-10-18.md.
24. patch-check-publish-race.md: the title doesn't cover the transfer bullet.
25. enterprise/saml.mdx Troubleshooting: the docLink target doesn't list SHA-1 as a cause.
26. enterprise/saml.mdx How sign-in works: doesn't describe an existing account moving onto SSO.
27. code-push/tracks.mdx Delete a track: only describes the CLI, not the new Console button.
28. usage-owned-orgs.md (nit): the docLink should be Organizations & billing, not Overage billing. Also delete the two now-unused screenshots.

Verified correct: every date against the first prod deploy or release containing the change, every flag, code, limit and string not listed above, and no duplicates.

[AbhishekDoshi26]

Round 2 (two fresh reviewers): 12 findings. All round-1 fixes landed. Fixing these now.

CLI

1. patch-dex-diff-details.md docLink target: the troubleshooting section and the patch options table never mention the new DEX detail or the public --show-dex-diff flag (patch_command.dart at v1.6.130). Add a paragraph and an options row.
2. patch-dex-diff-details.md: the patch isn't blocked (in a terminal it asks Continue anyway?, --allow-native-diffs publishes), and the names come from each method's differing instructions only.
3. cli-fixes-1-6-129.md: missing #4067. SHOREBIRD_PATCH_DD_MAX_BYTES stopped working in 1.6.129 (replaced by --dd-max-bytes), and cli-fixes-1-6-128.md tells readers it's honored.
4. cli-fixes-1-6-129.md: the refresh bullet leaves out that a network or server error now keeps the login and exits 75 instead of 70 (auth.dart).
5. cli-fixes-1-6-129.md (nit): "On every platform" should be every platform that has a minimum; Android and AAR patchers have none.
6. cli-fixes-1-6-129.md (nit): a non-numeric --org-id now lists your organizations and their ids (organization_id.dart).
7. release-patch-confirm-removed.md (nit): shorebird patch still asks Continue anyway? for native and asset changes; what's gone is the Would you like to continue? prompt --confirm turned on.
8. delete-confirm-yes.md (nit): each delete now says what it removes before deleting (#4098).

Console, API and docs pages

9. enterprise/saml.mdx Troubleshooting: two "or"s in the list, and nothing supports SHA-1 being one of the "most common causes". State it separately.
10. delete-tracks-hide-rolled-back.md: only the Console lacks a delete button for deactivated. The server refuses only stable, beta and staging (default_channel_names.dart), so the CLI and API can delete it.
11. api-plan-limits.md (nit): the title still says "plan limits", but the blank-name bullet is validation.
12. patch-cache-cleared-on-delete.md (nit): the docLink goes to rollback, but the entry is about deletes. Link Delete a track.

Note: one reviewer said invitations-commands.md is dated 2026-10-16. It's 2026-10-17 on main, so no change.

Verified correct: every date against the first prod deploy or release containing it, every remaining string, code, limit, label and plan gate, the removed screenshots have no references, no duplicates.

[AbhishekDoshi26]

Round 3 (two fresh reviewers): 11 findings. All round-2 fixes landed. Fixing these now.

CLI and the pages it touches

1. code-push/release.mdx (5 samples) and code-push/patch.mdx (1): sample output still shows Would you like to continue? (y/N) Yes, the prompt release-patch-confirm-removed.md says is gone (removed in 1.6.130, #4107). The summary above it still prints and ends with a blank line, so only that line goes.
2. releases-delete.md (nit): --platform also removes the patch files built for that platform (releases_delete_command.dart, release.mdx).
3. cli-fixes-1-6-129.md (nit): a non-numeric --org-id still fails; the error's hint now lists your organizations.
4. patch-dex-diff-details.md (nit): each instruction is also cut (defaultTokenLimit), so switch tables and array data are truncated.
5. metrics-commands.md (nit): --granularity and --group-by break results down rather than narrow them, and the options vary by metric.

Console, API and docs pages

6. saml-sha1-refused.md, enterprise/saml.mdx: #3502 also refuses an RSA-SHA256 signature over a SHA-1 digest, so the fix must also say to digest with SHA-256.
7. patch-cache-cleared-on-delete.md: round 1's wording was wrong. Per #3570 the platform delete already removed the patch files; it left the patch artifact rows, so devices were still offered patches that failed to download. The fix removes the rows.
8. api-plan-limits.md (nit): the summary still says "plan limits".
9. org-switcher.md (nit): #3558 only removed the header toggle; Appearance already existed.
10. account/orgs.mdx Member roles intro (nit): roles depend on the organization's plan (its owner's), not "the plan that you have", matching the entries that link here.

Verified correct: every date and version, all remaining strings, codes, limits, labels and plan gates, docLinks, no duplicates, no stale "bottom left" or "My Organization" text.

[AbhishekDoshi26]

Round 4 (two fresh reviewers): CLI half no findings; Console/API half 2 findings. All round-3 fixes landed. Fixing these now.

1. code-push/rollback.mdx (the rollback screenshot intro and the Roll Forward steps): since #3813 (prod 2026-10-18) the release page hides rolled-back and deactivated patches unless Show rolled back and deactivated is on (isWithdrawn in utils/patches.ts). The steps send readers to a row they can't see. Say to turn the switch on.
2. patch-check-publish-race.md (nit): per #3767 the racing check still returns its pre-publish answer; it's just no longer cached, so the next check sees the patch.

Verified correct: every date and version, every string, code, limit and label, the sample outputs against v1.6.130, plan gating, docLinks, no duplicates, no agent-facing text describing Console roll forward.

[AbhishekDoshi26]

Round 5 (two fresh reviewers): 2 findings, both nits. All round-4 fixes landed. Fixing these now.

1. cli-fixes-1-6-129.md: missing #4071. RELEASE_NOTES 1.6.129 lists "shorebird account orgs --help lists every role", which now includes none for an organization where you only collaborate on apps.
2. audit-log-actor-details.md: the trust-rule sign-in event (#3579) is already in github-actions-oidc.md on main, same date. Keep only app creation and patch note edits.

Verified correct: every date and version, every string, code, limit, label and plan gate, sample outputs against v1.6.130, all docs page edits, no other docs page or agent file contradicted by an entry, no other duplicates, Prettier and style.

[AbhishekDoshi26]

Round 6 (two fresh reviewers): 4 findings. All round-5 fixes landed. Fixing these now.

1. api-command.md (nit): --jq filters only a successful response (if (succeeded && jq != null)), as account/api.mdx and agent-instructions.txt say. The summary overstates it.
2. patch-cache-cleared-on-delete.md (nit): the title and summary don't cover the rollback and roll forward bullet (#3571).
3. console-fixes-2026-10-18.md: #3811 also changed the API. DELETE /api/v1/users/me now answers 202 with remaining_app_count while apps remain and must be repeated until 204 (DeleteUserInProgressResponse in openapi.yaml). Raw API callers see this.
4. code-push/faq.mdx "Can you use Shorebird with your team?": "Hobby only supports a single developer" now reads against the Member roles table (Developer on every plan). What actually limits Free is that personal organizations can't take invitations (invitations/index.dart) and creating a team organization needs a paid plan (can-create-organization.ts, the collaboration guard). Paid plans have no team size cap (maxTeamSize is null with collaboration).

Verified correct: every date and version, every string, code, limit, label and plan gate, all docs page edits, no other docs page or agent file contradicted, no duplicates, Prettier and style. Two 1.6.129 release-note items without entries (#4079, #4099) are internal.

[AbhishekDoshi26]

Round 7 (two fresh reviewers): Console, API and Code Push half, plus all docs page edits: no findings. CLI half: 1 nit. All round-6 fixes landed.

1. api-method-and-paginate.md (nit): the summary covers only the method and --paginate, not the three bullets this PR adds (--jq slices #4104, repeated /api/v1 #4109, the 405 hint). Fixing now.

Verified correct: every date and version, every string, code, limit, label and API shape (including the 202 remaining_app_count account delete), plan gating (planOffersRole, canCreateOrganization, maxTeamSize, Auditor), all docs page edits including the FAQ team answer, sample outputs against v1.6.130, no other docs page or agent file contradicted, no duplicates, Prettier and style.

[AbhishekDoshi26]

Round 8: no findings.

CLI half at 7cfba5a, plus the CLI docs pages. Round 7's nit landed: the api-method-and-paginate.md summary now covers --jq slices, the repeated /api/v1 handling and the 405 hint, all first shipped in 1.6.130 (api_command.dart at v1.6.130, absent at v1.6.129). git diff deab947 7cfba5a touches only that summary, so round 7's clean Console, API and Code Push half still holds. Spot checks against v1.6.128 to v1.6.130 (whoami, metrics subcommands, .dart_tool, --confirm, User-Agent), the six sample outputs, --show-dex-diff in patch.mdx and troubleshooting.mdx, Prettier and style all pass.