Skip to content

v0.9.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Jul 00:24
v0.9.1
9e1dc7e

What's Changed

Features

  • Merge pull request #964 from AltimateAI/upstream/merge-v1.17.9 (f9c3034)
  • feat: add source field to session_start telemetry (#968) (f376fef)
  • feat: add /release-beta skill — cut a beta to the npm beta channel (latest users untouched) (3b16acc)
  • feat: [release] enable safe beta releases (channel-from-tag + prerelease ordering) (b7f5a61)
  • feat: restore three fork behaviors deferred during the v1.17.9 re-home (audit findings) (ae16338)
  • feat: [v1.17.9] fully restore prompt-enhance via api.prompt.active() extension (checkpoint 13) (1b691bd)
  • feat: [v1.17.9] port 4 fork TUI features to host-registered plugins (checkpoint 12) (74f73fa)
  • feat: [v1.17.9] fork TUI features as host-registered plugins — ADR + scaffold (checkpoint 11) (1b8fd97)

Bug Fixes

  • fix: [release] scope MCP annotation-hint classifier to the path array (acda69c)
  • fix: [merge] tighten MCP annotation-hint error classifier (codex review) (dcea826)
  • fix: [merge] fold MCP Fabric tolerance into catalog's gated listTools (5abec22)
  • fix: [#791][#792] support bearer-auth remote MCP servers (Microsoft Fabric, etc.) (#793) (986641e)
  • fix: [release] pre-publish smoke test also targets altimate-code (d009fd9)
  • fix: [release] smoke-test the shipped binary (altimate-code) after de-dupe (bcb0f8a)
  • fix: [release] de-dupe platform binary (npm E413) + restore pre-release alias (37e6fd0)
  • fix: [release] unblock release workflow — full-typecheck deps + Verdaccio .dockerignore (37864cd)
  • fix: [merge] upstream_fix: don't blank unresolved ${VAR} — fixes bedrock region (6765d87)
  • fix: [merge] round-4 regression review — complete jsonc support + lock reviewer safety (a26f586)
  • fix: [merge] round-3 findings — env-flag regressions + cli debug/import (round 3) (5e287ce)
  • fix: [merge] bot-review findings — config jsonc/cache, tui server-config, ci filter (3d48a58)
  • fix: [security] MCP tools were executing with NO permission check (e7ec6a9)
  • fix: [merge] 8 shipped-path bugs from proactive codex review (round 2, tui+server) (def7a55)
  • fix: [merge] 15 shipped-path bugs from proactive codex review (round 1) (383eaf1)
  • fix: [merge] 4 shipped-path bugs from PR review (fresh-install, data-loss, +2) (b57aa69)
  • fix: [release] derive release version from the fork package, not upstream opencode-ai (c357612)
  • fix: [merge] preserve provider-executed flag on tool part metadata (14a72bc)
  • fix: [security] make the #209 sensitive-write guard actually fire (8c74589)
  • fix: [merge] restore 5 dropped upstream fixes + 3 unwired auth plugins (release board) (b0ade91)
  • fix: [release] bump release.yml Bun 1.3.10 -> 1.3.14 (was release-blocking) (386e653)
  • fix: [merge] restore fork-wanted refinements + branding (audit judgment calls) (7232b34)
  • fix: [merge] restore dropped upstream behavioral refinements (audit findings) (00dde08)
  • fix: [upgrade] make migration-journal marking idempotent (stop per-launch row growth) (27c4905)
  • fix: close unclosed marker in db.ts + update reviewer pin tests to the #978 ask design (01833e8)
  • fix: restore codesearch for explore agent + gather prompt.skills keybind (merge drops) (98933b3)
  • fix: [#976] clicking a truncated URL now opens the full URL (1794048)
  • fix: [#971][#972][#974] dedupe /mcps autocomplete, surface MCP auth command, calm /feedback (c4a474f)
  • fix: [#973][#975] restore Ctrl+A/Ctrl+E in prompt + history recall from a non-empty prompt (a30e477)
  • fix: [#978] make reviewer mode usable — external reads prompt, bash asks, webfetch allowed (ab83ed5)
  • fix: [merge] route /experimental/workspace to the HttpApi (was 500 via proxy) (555ac7f)
  • fix: [merge] restore config env-interpolation telemetry (c75f793)
  • fix: [merge] restore file diffs in shared sessions (c7c7f5e)
  • fix: [merge] idempotent DB migration adopt — stop "duplicate column" startup crash (cf62f1f)
  • fix: [merge] restore ACP altimate-backend default-model preference (89eaf01)
  • fix: [merge] MCP hardening — stderr-drain hang, OAuth-state leak, silent failures (ded1893)
  • fix: [merge] restore read-only guard on db <query> (was able to DELETE/DROP user data) (c87d59d)
  • fix: [merge] restore session-level diff so the modified-files sidebar works again (b5715e7)
  • fix: [merge] CRITICAL — skill remove customize-opencode could rm -rf the cwd (2df6c8f)
  • fix: [merge] default thinking to hidden for upgraders too (not just fresh installs) (e695b53)
  • fix: [merge] stop models echoing the date — carry it in , not the user turn (ea55ba9)
  • fix: [merge] load project tools from .altimate-code/tools, not only .opencode/tools (c224354)
  • fix: [merge] prevent fff SIGTRAP crash when TUI is launched from ~ or / (e29c065)
  • fix: [merge] address two shipped-path review findings from the v1.17.9 PR (c44e0a9)
  • fix: [storage] adopt core-owned schema on fresh installs (fresh-DB ship-blocker) (57584ed)
  • fix(test): mcp-add asserts the altimate-code global config dir (34a11d7)
  • fix: restore fork behaviors silently dropped by the v1.17.9 overlay merge (732a20d)
  • fix(test): use ripgrep (OPENCODE_DISABLE_FFF) in subprocess tests — real linux-CI root cause (1db1181)
  • fix(test): disable embedded web UI in subprocess test env (real root cause of linux CI red) (59b27ad)
  • fix(ci): run subprocess tests via bun run src (not the binary) in the bounded pass (89ded86)
  • fix(ci): run subprocess tests in a dedicated bounded pass (kill load-variance flakes) (e256ddf)
  • fix(mcp): restore dropped MCP.remove + bunRun harness opt for error-path subprocess tests (7d664a7)
  • fix: skip background @opencode-ai/plugin install under OPENCODE_PURE (CI subprocess hang) (3501636)
  • fix: restore dropped --trace fork-fix + revert prebuilt-binary test de-flake (fe9f996)
  • fix: load builtin DE skills into the live registry (merge dropped them) — shipped regression #3 (6e33598)
  • fix: restore #209 sensitive-write guard dropped by the merge (shipped security regression #2) (baa8ca9)
  • fix: restore symlink-aware project boundary the v1.17.9 merge dropped (shipped security regression) (65344da)
  • fix: revert the v2-httpapi upgrade guard (broke its happy-path test; tree is unused) (b821039)
  • fix: CI de-flake — OPENCODE_TEST_CLI must be absolute (CI passed relative); grep TOCTOU hardening (9fbe4d0)
  • fix: address codex pass-2 findings (grep symlink-FILE bypass + publishable-channel allowlist) (b63660f)
  • fix: de-flake CI subprocess tests via prebuilt test CLI + larger spawn timeout (056d375)
  • fix: address codex deep-review findings (grep containment robustness, upgrade guards, prune isFile) (f6e79a4)
  • fix: revert TUI wordmark to the clean uppercase ALTIMATE CODE block font (70436fc)
  • fix: worker console guard also intercepts console.* (Bun bypasses process.stdout.write) (c60eb12)
  • fix: prune trace files by mtime, not filename — TUI session traces were deleted on write (d524947)
  • fix: systemic TUI log-hygiene guard so logging stops regressing on upstream merges (0ae4c7a)
  • fix: three TUI/runtime issues from the Altimate Code Issues report (f647f6e)
  • fix: address Kilo review findings on PR #964 (v2-core security + migration soundness + sync-trace exporters) (4c46533)
  • fix: [v1.17.9] finalizeSync applies maxFiles pruning on the sync shutdown path (Kilo review) (f5ecdd8)
  • test: [v1.17.9] de-flake M2 trace rename-race test (fixed-wait → poll under CI load) (a43d9a5)
  • fix: [v1.17.9] lowercase TUI wordmark ("altimate code", not "ALTIMATE CODE") (630a4b2)
  • fix: [v1.17.9] restore TUI session tracing — sync finalize on the quiet worker thread (50b295d)
  • fix: [v1.17.9] stop log shim from flooding the TUI (quiet by default, lazy --print-logs) (ad005a7)
  • fix: [v1.17.9] address codex PR #964 review comments (active-path subset) (d074d0f)
  • fix: [v1.17.9] name WorkspaceContext ALS "workspace" not "instance" (55b23f1)
  • fix: [v1.17.9] root-fix InstanceRef ALS split — bootstrap provides on canonical Instance context (591e711)
  • fix: [v1.17.9] align server auth default username to "opencode" (codex PR review P1) (a3dc9f0)
  • fix: [v1.17.9] restore skill list (read via server) + tracing/skill regression tests (14143ab)
  • fix: [v1.17.9] restore session tracing — read tracing config via server client (761a660)
  • fix: [v1.17.9] lazy-load playwright-core so trace-viewer e2e skips cleanly in CI (c2a7fa5)
  • fix: rebrand residual OpenCode leaks surfaced by TUI visual inspection (95ab133)
  • fix: [v1.17.9] eliminate test-suite DB migration race (table project already exists) (86be045)
  • fix: bump CI bun-version 1.3.10 -> 1.3.14 to match merged runtime requirement (117b6b0)
  • fix: [v1.17.9] TUI /api routing flood + branding 198->0 + require-markers config (CI green) (2c3d2ed)
  • fix: [v1.17.9] build.ts stale TUI worker entry path (cli/cmd/tui -> cli/tui) (2999398)
  • fix: [v1.17.9] audit follow-ups — partial branding (215->198) + TaskTool permission wiring (6beae93)
  • fix: [v1.17.9] restore 8 dropped v1.17.9 session behaviors (autonomous panel consensus) (95d1680)
  • fix: [v1.17.9] fix-everything batch 1 — server v2-location, Account dedup, formatValidationError, +1 session (ckpt47) (01d0aac)
  • fix+test: [v1.17.9] DB split-brain fix + wave-2 triage; revert ec36 config regression (ckpt38) (cdfe5e0)
  • fix: [v1.17.9] resolve bootstrap deadlock — agent runs end-to-end (checkpoint 36) (9e5d731)
  • fix: [v1.17.9] resolve runtime circular-init via lazy LayerNode deps (checkpoint 34) (45b2262)
  • fix: [v1.17.9] Env wrappers must be synchronous (checkpoint 16) (a1085ba)
  • wip: v1.17.9 reconciliation — §4 re-home TUI customizations into packages/tui (checkpoint 5) (2a22e6b)

Other Changes

  • release: v0.9.1 (9e1dc7e)
  • docs: [release] document headersCommand + fix release-notes prev-tag selection (4baf41b)
  • ci: add aireceipts auto-attach hook (two-file kit) (#994) (ddc8864)
  • merge: bring origin/main into upstream/merge-v1.17.9 (65c2a41)
  • ci: add aireceipts pr-check (notice-only cost receipt) (#992) (a7fb223)
  • docs: correct REVIEW.md inaccuracies flagged by automated review (#984) (bf90e18)
  • docs: add REVIEW.md for KiloCode automated review guidance (#983) (6b1dd22)
  • docs: [release-beta] add the local pre-tag gates the skill was missing (932d002)
  • docs: [board] record E integration-seam findings + final disposition (e3a160a)
  • test: add real-binary TUI journey suite (opt-in gate for interaction regressions) (972df32)
  • chore: extend altimate_change marker to cover move() signature (marker guard) (acb7a59)
  • test: [merge] make MCP discover/lifecycle tests hermetic (isolate home dir) (6b11abd)
  • test: [merge] re-enable 137 fork security/behavior tests disabled by the merge (fbf3976)
  • docs: [merge] document .altimate-code/tools as the preferred custom-tool location (2f12ae3)
  • docs: [merge] correct global config dir + complete the MCP CLI reference (284ff0f)
  • chore: [release] remove internal merge/night-run scratch from the PR (8235149)
  • test: guard MCP.remove presence + datamate wiring (regression for the merge-dropped teardown) (1b98aca)
  • chore: TEMP diagnostics — ubuntu-CI provider registration + acp cause (7c0d7e2)
  • chore(acp): TEMP diagnostic — surface the cause behind the -32603 "directory" error (09b068b)
  • test+docs: restore dropped path-traversal security tests + release-confidence audit (ab7c8f5)
  • test: [v1.17.9] de-flake TraceConsumer session.deleted re-create test (CI load race) (34a7b9b)
  • docs: [v1.17.9] ship-readiness E2E + TUI-inspection playbook (the /goal loop) (7a911be)
  • docs: [v1.17.9] tracing RCA — rule out flushSync, point at Bun-worker async-fs stall (f513e9d)
  • test+docs: [v1.17.9] artifact-level detection for the missed-bug class + retrospective (aa22364)
  • test: [v1.17.9] derive resetDatabase tables from live schema + record consensus dispositions (87af8b3)
  • test+fix: [v1.17.9] migration schema-fingerprint drift guard + close adoption TOCTOU (1ab8421)
  • docs: [v1.17.9] PR body — add CLI instance-context (tracing + skill list) fixes (c905d0f)
  • docs: [v1.17.9] mark skill-list FIXED + record dispositions for remaining followups (cb9529a)
  • docs: [v1.17.9] mark tracing FIXED in secondary-findings; skill-list still open (af23602)
  • docs: [v1.17.9] WS4 command + WS5 trace verification reports + secondary findings (b3bee8c)
  • test: [v1.17.9] isolate Google Vertex ADC in preload (deterministic httpapi-sdk) (3a583c3)
  • docs: [v1.17.9] night-2 validation artifacts (DB-race fix, TUI visual inspection, gpt-5.5 e2e) (600bf8b)
  • docs: [v1.17.9] overnight TUI inspection mandate plan (e92adcf)
  • docs: [v1.17.9] codex audit results + refreshed PR body (pre-PR) (bdb3cef)
  • docs: [v1.17.9] plan to cover the 46 remaining session todos (injectable-Service refactor + feature ports) (b80f2cb)
  • chore+docs: [v1.17.9] marker hygiene (25 files) + autonomous accept-vs-restore panel consensus (1f83919)
  • docs: [v1.17.9] differential confidence audit (carry-forward / upstream-completeness / regression) (22e7513)
  • docs: [v1.17.9] FINAL — suite 868->1, fix-everything complete (ckpt49) (00a7035)
  • docs: [v1.17.9] fix-everything outcome — server/account/bug fixed, sdk+session documented (ckpt48) (243ee69)
  • docs: [v1.17.9] finalize — session review + 132-run e2e (89%, ~95% true) (ckpt46 FINAL-v2) (699a369)
  • docs+test: [v1.17.9] per-case session-delta review (ckpt45) (70decf7)
  • docs: [v1.17.9] finalize ship report + draft PR body (ckpt44 FINAL) (34508c9)
  • test: [v1.17.9] 50 upstream-adversarial tests (UPI risks) + 2 minor bugs documented (ckpt43) (4e8c4e6)
  • test+docs: [v1.17.9] fork carry-forward guards (40 tests, 0 dropped) + e2e results 21/22 (ckpt42) (19c0eb1)
  • docs: [v1.17.9] ship-readiness report (ckpt41) (998bed0)
  • docs+test: [v1.17.9] session behavioral triage + e2e harness (ckpt40) (e3f2514)
  • test: [v1.17.9] triage wave-1 complete — upstream/session/server/small-batch green (ckpt39) (3dd78c5)
  • test: [v1.17.9] triage wave 1 — provider/plugin/install/branding/release green (checkpoint 37) (b2e0ad1)
  • wip: v1.17.9 — broad Layer.suspend sweep (typecheck+TDZ green, KNOWN bootstrap hang) (checkpoint 35) (b23baec)
  • wip: v1.17.9 — start runtime circular-init fix (Layer.suspend) (checkpoint 33) (27fb94c)
  • wip: v1.17.9 reconciliation — opencode TYPECHECK GREEN (0 errors) (checkpoint 32) (641e616)
  • wip: v1.17.9 reconciliation — packages/opencode/src is GREEN (checkpoint 31) (16e6cff)
  • wip: v1.17.9 reconciliation — long-tail survivor batch, src 248->52 (checkpoint 30) (b0e3e66)
  • wip: v1.17.9 reconciliation — Service facades: Provider/Plugin/LLM/ToolRegistry/SessionProcessor (ckpt 29) (8aea81e)
  • wip: v1.17.9 reconciliation — Service facades: Project/ShareNext/SessionPrompt/SessionCompaction (ckpt 28) (205d76c)
  • wip: v1.17.9 reconciliation — server routes + tool/mcp/skill batch (checkpoint 27) (c7b7e23)
  • wip: v1.17.9 reconciliation — 11 survivor files via 5-agent batch (checkpoint 26) (6a8796d)
  • wip: v1.17.9 reconciliation — fix provider/session/server core files (checkpoint 25) (41b969f)
  • wip: v1.17.9 reconciliation — repoint moved .sql table-def imports to core (checkpoint 24) (5c96c2a)
  • wip: v1.17.9 reconciliation — delete stale old-TUI tests (checkpoint 23) (296ed79)
  • wip: v1.17.9 reconciliation — permission/project/filesystem/npm core shims (checkpoint 22) (3a20a97)
  • wip: v1.17.9 reconciliation — util/schema shim + branded-type make() fix (checkpoint 21) (38dd432)
  • wip: v1.17.9 reconciliation — restore bus/index.ts Bus namespace (checkpoint 20) (2f910be)
  • wip: v1.17.9 reconciliation — restore util/{context,abort,lock} + shell shim (ckpt 19) (de952af)
  • wip: v1.17.9 reconciliation — restore util/fn + repoint dropped @opencode-ai/util imports (ckpt 18) (f8cc2f3)
  • wip: v1.17.9 reconciliation — Installation.VERSION re-export shim (checkpoint 17) (8f39fda)
  • wip: v1.17.9 reconciliation — restore Auth/Env Promise wrappers (checkpoint 15) (3dd9e49)
  • wip: v1.17.9 reconciliation — 3 more moved-to-core util shims (checkpoint 14) (2461250)
  • wip: v1.17.9 reconciliation — moved-to-core util re-export shims (checkpoint 10) (99ab746)
  • wip: v1.17.9 reconciliation — restore dropped hono dep (checkpoint 9) (6e6b6d9)
  • wip: v1.17.9 reconciliation — delete dead old-TUI tree (§3.4 part 1) (checkpoint 8) (cc4502f)
  • wip: v1.17.9 reconciliation — §4 app.tsx + UpgradeIndicator port (checkpoint 7) (96f6138)
  • wip: v1.17.9 reconciliation — §4 re-home TUI batch 2 + line-streaming flags (checkpoint 6) (34c1f36)
  • wip: v1.17.9 reconciliation — altimate/ Tool-API surface green (checkpoint 4) (4294cc9)
  • wip: v1.17.9 reconciliation — Effect-API compat wrappers + config-schema re-apply (checkpoint 3) (9e43563)
  • wip: v1.17.9 reconciliation — Log shim, import repoints, impact playbook (checkpoint 2) (eb2b92d)
  • wip: bridge upstream v1.17.9 overlay + install/structure reconciliation (checkpoint) (c985718)

Install

npm install -g @altimateai/altimate-code@0.9.1
# or
brew install AltimateAI/tap/altimate-code

Full Changelog: v0.8.10...v0.9.1

Assets 11
Loading