Skip to content

17.3.0

Choose a tag to compare

View all tags
@matze4u matze4u released this 24 Oct 05:30
· 1278 commits to main since this release
17.3.0
b31d120
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release highlights

  • Behaviour changes: none
  • Default changes + migration: carry the default pass's trust classification (4a35ec7); table mapping stops at the class above; the default leaves provider-routed modules (45cfa32); providers, the default pass and the parsed languages (f83b2e8); the default pass leaves a page a provider already drew (ccd3714); a default convention pass for every project (30b1aa5). Breaking, pending in BREAKING_CHANGES.md and shipped by this release: Three fail_closed hook guards run where they were silent. The installed claude hook command now reaches a dispatcher staged under ~/.event4u/agent-config/runtime/ after a project-local install and before PATH (3f8c98e, #2455). On machines installed through npx, or hosts launched with a bare PATH, every hook command used to end in a silent exit 0; there block-no-verify (refuses git … --no-verify and core.hooksPath overrides), block-kernel-rule-writes and block-plumbing-writes (refuse agent writes to this package's kernel rules and hook plumbing) now run and may refuse a tool call for the first time. Classed breaking by the AI council, 2026-10-19 (agents/evidence/council/hook-carrier-release-note-class-20261019.md). uninstall --global --purge stops being a recursive delete of the host anchor. Old scope: fs.rmSync(anchor, { recursive: true }) on whole host configuration roots — ~/.claude/, ~/.codex/, ~/.config/zed/ — so everything under them went, whoever wrote it. New scope: only the anchor-relative paths this package's own deploy inventory recorded writing; the anchor itself is never removed, directories are pruned only when left empty, a recorded symlink is unlinked rather than followed, and a purge with no readable inventory for that anchor exits 1 having deleted nothing. A second change in the same area: a plain uninstall --global now keeps the lockfile while recorded content is still on disk, where it used to delete it.
  • Security and correctness: resolve imports against tsconfig baseUrl, never as reads (6f07aba); route a Flask blueprint imported from another module (81c752b); an unreadable live row cannot stay green forever (2034929); make the install pointer true for every plugin that ships it (54c771b); move zod to 4 to clear GHSA-mrhx-c7xc-m3w5 (6a488a2); emit a server.json the official registry accepts (3f53b83); +22 more.
  • Honest nulls: none
  • Known limitations: route a Flask blueprint imported from another module (src/scripts/code_graph/providers/catalog.ts declares a residual) (81c752b); move zod to 4 to clear GHSA-mrhx-c7xc-m3w5 (src/scripts/install.ts declares a residual) (6a488a2); catalog rows for spring and go-http (src/scripts/code_graph/providers/catalog.ts declares a residual) (72ff3e6); coverage catalog; the map and MCP name the active providers (src/scripts/code_graph/providers/catalog.ts declares a residual) (296691e).

Governance mix: governance-only 34 vs consumer-only 11 (mixed 59, maintenance 11; taxonomy 1.1.0; range 4502d32..b28ca06).

Features

  • code-graph: show the map as a turnable 3D orb (79a5676)
  • distribution: watch every submission until it is live (3124668)
  • distribution: listing manifests a release keeps current (c45b0bc)
  • code-graph: the aspnetcore convention provider (7fb5937)
  • code-graph: the typeorm provider (fc32cdc)
  • code-graph: the sqlalchemy provider (dcadc0b)
  • code-graph: the django provider (bab64c2)
  • code-graph: the flask provider (e610957)
  • code-graph: the fastapi provider (0eb6b26)
  • code-graph: python source helpers and per-file template folders for providers (723c84b)
  • code-graph: the sveltekit provider (e7eedf7)
  • code-graph: the nuxt provider (2c45ab3)
  • code-graph: the vue-router provider (27a2165)
  • code-graph: C# in the native engine (9777865)
  • code-graph: the angular provider (a77a5a1)
  • code-graph: catalog rows for spring and go-http (72ff3e6)
  • code-graph: the wordpress provider (664ad36)
  • code-graph: the symfony provider and a shared PHP name resolver (7988b71)
  • code-graph: the nestjs provider (0a51cf7)
  • code-graph: add Go HTTP router convention provider (c93a3bc)
  • code-graph: add Spring Boot convention provider (8584101)
  • code-graph: the nextjs provider (e407eb8)
  • code-graph: coverage catalog; the map and MCP name the active providers (296691e)
  • code-graph: shared JS provider helpers; the react-router provider (b02702f)
  • code-graph: shared provider kit and extractors; the express provider (0581df8)
  • hooks: refresh a consumer's code graph at session start (f5f573c)
  • code-graph: single-flight refresh that also redraws the map (725e9df)
  • code-graph: a default convention pass for every project (30b1aa5)
  • code-graph: schema 6 — generic names, provider ids, trust allowlist, per-handler request paths (3890a2b)
  • code-graph: ordered pass list and a convention-provider registry (fdd1f69)

Bug Fixes

  • distribution: state the blocker swap plainly and the image contents truly (70797c0)
  • docker: ship the whole build output in the stdio MCP server image (e324128)
  • ci: classify the listing files, tighten the size baseline, drop two emails (c835083)
  • code-graph: resolve imports against tsconfig baseUrl, never as reads (6f07aba)
  • code-graph: route a Flask blueprint imported from another module (81c752b)
  • distribution: an unreadable live row cannot stay green forever (2034929)
  • distribution: make the install pointer true for every plugin that ships it (54c771b)
  • deps: move zod to 4 to clear GHSA-mrhx-c7xc-m3w5 (6a488a2)
  • mcp: emit a server.json the official registry accepts (3f53b83)
  • code-graph: judge an owner record without a host by age alone (4a3fa82)
  • code-graph: restore the ratified lock rules over the review follow-up (1fb0854)
  • code-graph: validate an edge's provider_id as a string (3b15b60)
  • code-graph: buildMap enforces a single writer itself (345787b)
  • egress,code-graph: keep the shell name==value form; pin the map swap contract (2b51b78)
  • deps: lift body-parser and its siblings past GHSA-27r3-jxmh-p828 (31cc425)
  • code-graph: one generation for graph and map; working-tree changes discard a build (5133163)
  • code-graph: refresh only with a capable CLI, record every outcome, harden the lock (74531d4)
  • hooks: install the development hooks only into this package's checkout (7e3c185)
  • code-graph: publish agents/map/ as one generation (7b23eb4)
  • egress: a comparison or an arrow is never a credential assignment (c915ed8)
  • code-graph: drop a duplicated set in the docs pass (336857d)
  • code-graph: one lock protocol, with a reclaim that cannot hit a successor (0c39b05)
  • code-graph: review findings — per-root Laravel, deepest root, indexed lookups, identity, comments (3c4e39d)
  • code-graph: reclaim a refresh lock only on positive evidence (d4857e4)
  • hooks: an uninspectable inner .git ends the repository search (366c1a8)
  • code-graph: walk the canonical root when deciding "not a repository" (4d36a87)
  • code-graph: a failing git probe can never pass the HEAD guard (3a9ad97)
  • code-graph: restore the fsRoutes guard a probe restore overwrote (62e00b7)
  • code-graph: table mapping stops at the class above; the default leaves provider-routed modules (45cfa32)
  • code-graph: make the session refresh opt-in and repository-proof (061bd6f)
  • code-graph: the default pass leaves a page a provider already drew (ccd3714)
  • hooks: refresh the code graph after merge and rebase too (02bd720)

Documentation

  • evidence: close both batch-review findings and re-bind the round (cb3fdac)
  • evidence: completion review of the Tier B batch PR (933859b)
  • distribution: record awesome-mcp-servers attempt 1c and the Tier B go (7c2dcb0)
  • roadmaps: bring carried step 2.4 under the 150-word step cap (c246574)
  • roadmaps: carry the default pass's trust classification (4a35ec7)
  • roadmaps: fold the last review findings into the carried Phase 2 (aa3087b)
  • evidence: re-bind the completion review after merging main (409cfec)
  • evidence: re-bind the completion review after the CI fixes (bd0a59f)
  • roadmaps: give every command-leading verify clause a prose lead (53551c7)
  • roadmaps: re-review the carried plan's risks after Phase 2 (153315b)
  • evidence: re-bind the completion review after the parity declaration (004444e)
  • roadmaps: carry the remaining PR #2603 review residue (ef41128)
  • evidence: close both completion-review findings and re-bind the round (703940a)
  • evidence: completion review of listings-a-release-keeps-current (493cce0)
  • settings-api: the schema comes from z.toJSONSchema now (f50548b)
  • distribution: describe denylisted list names instead of naming them (e99d6bb)
  • roadmaps: point the archived and parked listings roadmaps at each other (3bbc2f2)
  • roadmaps: archive listings-a-release-keeps-current (1eb156d)
  • roadmaps: listings a release keeps current, and what the owner submits (6f1354b)
  • distribution: planned targets, owner packets, the watcher (f15e8c2)
  • roadmaps: give the follow-up roadmap's verify clauses an expectation (c7c47d5)
  • evidence: ratification rounds 14-16 — ratified 2/2 (2ec253a)
  • evidence: ratification rounds 9-13 — ratified 2/2 against PR #2603's branch (e5f8107)
  • roadmaps: archive road-to-code-graph-refresh-follow-ups — all steps done (79f5ad1)
  • roadmaps: the three follow-ups of the code-graph auto-refresh ratification (4f2dd8a)
  • code-graph: name auto-refresh in the agents-layout map row, not the skill (23480c8)
  • adr: ADR-298 discloses its evidence (2c06e78)
  • evidence: ratification record for the code-graph auto-refresh (8bdd7bb)
  • roadmap: close phases 6-7 and the acceptance criteria; record the Ruby payload decision (578778f)
  • code-intelligence: providers, the default pass and the parsed languages (f83b2e8)
  • adr: ADR-298 framework-neutral graph core; record the provider baseline (5aefb74)
  • roadmap: road-to-graph-providers-for-every-stack from inbox-2026-10-ac (a67cd07)

Refactoring

  • code-graph: call the lock owner's random value a nonce (c5cf577)
  • code-graph: trust lists as type-checked word strings (cfeaeae)

Tests

  • mcp: drop an unused os import the changed-file lint now sees (bdb512c)
  • code-graph: render-check the orb, opened and half-turned (580dbfc)
  • code-graph: move HEAD deterministically in the refresh HEAD-guard tests (060e673)
  • code-graph: exercise inspection errors without skips or chmod (49de553)
  • hooks: a slow, failing refresh never holds up a git operation (3ab56a5)

CI

  • parity: declare adoption_status as a CI-only network gate (6aae044)
  • release: publish the official MCP Registry entry on release (1ea5175)

Chores

  • deps: bump the site group in /site with 2 updates (e024969)
  • deps-dev: bump @cloudflare/workers-types (ffbbb68)
  • config: lower the source-size baseline to 17,333 (7563292)
  • dist: rebuild the install bundle on zod 4 (00fb46c)
  • roadmaps: regenerate the owned digest (ece8127)
  • visibility: add the gemini-cli-extension topic (1f4b199)
  • dist: project the check_memory template's assignment head (af7a6a1)
  • regenerate the MCP inventory; lift body-parser past GHSA-27r3-jxmh-p828 (1148d56)
  • roadmap: regenerate the owned digest (5552793)
  • budget: re-anchor the built pack figure for the C# grammar (11f745d)
  • hooks: record the admission of the code-graph-refresh concern (74376a4)
  • roadmaps: claim the one-concern estate growth of the code-graph auto-refresh (1794c48)
  • adr: regenerate the evidence census after the ADR-298 edit (e523a65)
  • roadmap: carry Ruby and Rails, archive the provider roadmap; fix the CI reds (d4ac6be)

Tests: 32651 (+354 since 17.2.1)

MCP Worker deployed: v17.3.0-b31d120 · signature 69bcae7fa616

Assets 308
Loading