1.27.0

🌟 Karpathy LLM Wiki v1.27.0

Highlights

MINOR that adds one new auth path on Bedrock, one new conversion backend (MinerU), and closes the frontmatter-parity chain. 36 merge commits / 181 files / +11197 / −3158 / 3677 tests passing. No breaking changes, no new required settings, no migration.

• AWS Bedrock — three auth modes (Issue #425, PR #540). API key (existing), SSO via hand-rolled IAM Identity Center OIDC, IAM-key. Zero AWS SDK, ≈+10–15 KB. Stage 1 bedrockRegion forwarding bug (every call fell on us-east-1 regardless of the user's region setting) rides along as commit 0. PR #540 awaits an account-holding E2E of three isolated constants before full activation.
• MinerU multi-format ingest (Issue #404, PR #404). PDF / images / Office docs via online Precise parser; new markdownConversionBackend setting. Local native path unchanged.
• Source-page verbatim quotes (Issue #496, PR #546). Captured quotes route into sources/<slug>.md. [MENTIONS-CAPTURE] injection + maxChars: 2000 per page (mutation-verified).
• Fix Dead Links leave_it outcome (Issue #485, PR #545). Default ON; opt-out via fixDeadLinksCreateStub. Unresolvable refs no longer spawn empty stubs.
• Per-step taskPolicies UI (Issue #525, PR #525). task=mode[:thinking] parsing; text-mode extract baseline wired. Codex outputModeOverride honoured (PR #539).
• Composite-key probe caches (Issue #551, PRs #552/#553). TokenKeyProber / ReasoningStripProber key on (baseURL, model) — fixes the cache-suppression bug across distinct models under the same provider.
• npm audit HIGH → 0 (Issue #501). Top-level overrides pins brace-expansion 5.0.9 and fast-uri 3.1.5; lockfiles regenerated per pre-release-gate §2f.2.

What's in this release

Added

• src/llm-sdk/bedrock-sso/ — hand-rolled AWS SSO + SigV4 for Bedrock (PR #540, Issue #425). bedrockAuthMethod setting: 'api-key' | 'sso' | 'iam', default 'api-key'. SSO flow: registerClient → startDeviceAuthorization → completeDeviceAuthorization (polling with slow_down+5s, deadline, AbortSignal). BedrockAuthManager caches credentials with expiry − 2min skew, single-flight on expiry, no silent retry storm. Sign-out overwrites SecretStorage + clears in-memory cache (mirrors Codex discipline). Three auth secrets: karpathywiki-bedrock-sso, karpathywiki-bedrock-iam, karpathywiki-bedrock-apikey.
• Mineru PDF / image / Office backend (PR #404, Issue #404). New markdownConversionBackend (native | mineru); MinerU path accepts PDF / PNG / JPG / DOCX / PPTX / XLSX. 11 locale READMEs synced.
• Source-page verbatim quotes (PR #546, Issue #496). buildSourceAnalysis populates top-level mentionsCaptured; [MENTIONS-CAPTURE] token injected into per-task prompt; maxChars: 2000 per page.
• leave_it outcome for Fix Dead Links (PR #545, Issue #485). FixDeadLinksOutcome enum now create_stub | leave_it; default leave_it.
• Opt-in skipMentionOnlyCandidates ingest gate (PR #521, Issue #514). Skips mention-only candidates from dedup prompt; default OFF.
• One ranked candidate window for dedup + dead-link (PR #520, Issue #519). Replaces full-list fallback (recall nominal 0/18, cost real — ~40K tokens × 61% candidates). Gate-4-accepted: ~2KB text/page (~5.6MB peak @ 2.8K pages).
• Per-step taskPolicies UI (PR #525, Issue #525). task=mode[:thinking] parsing; resolveTaskPolicy(map, task) returns {outputMode, thinking}.
• minAliasLength setting (PR #532). Settings → Advanced, default 2, range 2..6.
• Composite-key probe caches (PRs #552/#553, Issue #551). Per (baseURL, model) instead of baseURL alone.
• CLI → tools/dev-instrument/ migration (PR #511, Issue #507). Replaces tools/llm-wiki-cli/ with UPSTREAM DEV-ONLY INSTRUMENT; eliminates 49 of ~52 Obsidian Bot errors. Legacy snapshot at tools/legacy/cli-v1.26.4-snapshot. Dev-instrument exit codes 0/1/2 (PR #526).
• Schema three-layer delivery (PR #546, Issue #491). Five default-schema sections reach their owning tasks; per-task whitelist fixed; summary task writes to sources/<slug>.md.

Changed

• extract defaults to text-mode output on LM Studio / Codex (PR #525, Issue #524). json_schema silently degrades on those providers; text-mode baseline now wired. Opt-back via taskPolicies *=json.
• mergeFrontmatter unions incoming tags: (PR #510, Issue #509). Stored tag set no longer depends on source order; incomingTypeTag guards custom vocabulary.
• Alias comparison keys NFC-normalised and Turkish-folded (PRs #530/#531/#537, Issues #366 p2/#484/#536). File-naming untouched; create path drops self-named aliases; typed-list folder map keyed on comparison slug (preserveCase param removed).
• stripUnknownSections applied to generation paths (PR #529). Reviewed pages bypass.
• OpenRouter : variants visible (PR #538, Issue #534). ~79 models including all :free now show in the catalog.
• OpenRouter model-404 no longer a URL fault (PR #535, Issue #533). isUrlError differentiates transport failure (retry) vs 404 on model id (report and stop).
• Test Connection blank-model guard (PR #518, Issue #517). errorNoModel per-task; probe early-returns. Localised in +11 locales.
• OpenRouter Anthropic baseURL fixture fix (PR #516, Issue #515).
• Stream path carries explicit task label (PR #547, Issue #469). Query Wiki now files under query-wiki, not 'untagged'.
• cache_control contract asserted at wire, not at mock (PR #497, Issue #493 partial).
• Type repair at intake (PR #528, Issue #527). repairTypesAgainstVocabulary fold + short repair call.
• NoOutputGeneratedError returns in-scope composite (PR #544, Issue #506). Single bad batch no longer loses the whole run; welcome-translate thinking pinned off.
• Five-Gate order fix in CI (carry-over, PR #487). pnpm build before pnpm test (test reads main.js for bundle shape). Bundle smoke test now in Gate 1.

Fixed

• Duplicate-merge passthrough carries unknown frontmatter fields (PR #513, Issue #512). Closes the last #356 parity gap.
• Constraints pass carries block-form unknown fields (PR #523, Issue #522). Parity chain complete.
• Five default-schema sections reach their owning tasks (PR #546, Issue #491). Previously orphaned summary task now writes to sources/<slug>.md.
• Vault-root picker's exclusion rule applied everywhere (PR #504, Issues #502/#505).
• Codex client honours pinned text mode + spares retry on source-borne loops (PR #539).
• Designator is (letters, type), not the opposite folder (PR #499, Issue #472).
• CHANGELOG records the #504 upgrade note for / entries (PR #508).
• docs(notice) brings DocTpoint attribution up to v1.26.4 (PR #498).
• Docs orthogonalise CLAUDE/ROADMAP/CHANGELOG per one-fact-one-place (PR #500).

Internal

• tools/dev-instrument/run-instrument.mjs:97 closes PR #511's leftover no-unsanitized/method lint gap (PR #550 follow-up). OUT_PATH is a hardcoded local constant; documented eslint-disable per Bot no-restricted-disable allowance. .mjs is out of Bot scan scope by design.
• pnpm and npm lockfiles aligned on brace-expansion 5.0.9 + fast-uri 3.1.5 (Issue #501). Both pin keys live at top level (overrides) and under pnpm.overrides; lockfiles regenerated from local node_modules.

Upgrading from v1.26.4

If you installed via Obsidian's Community plugins flow (the normal case), this release appears as a one-click update in Obsidian Settings → Community plugins. Click Update and you're done — your wiki, settings, and history carry over automatically.

New settings (markdownConversionBackend, bedrockAuthMethod, skipMentionOnlyCandidates, minAliasLength, taskPolicies, fixDeadLinksCreateStub) all carry defaults that preserve v1.26.4 behaviour byte-identical. MINOR bump reflects user-visible surface growth (5 new bullets in 11 README Features sections), not breaking changes.

What's accepted (and why)

Local Obsidian Bot pre-review (eslint-plugin-obsidianmd@0.4.2, aligned with latest per CLAUDE.md "Bot alignment (pre-release)" rule) returned 0 errors against the v1.27.0 baseline. 128 warnings are all pre-existing accepted-structural from the v1.26.2 / v1.26.4 baselines: obsidianmd/prefer-create-el × 32, hardcoded-config-path × 25, no-nodejs-modules × 22 (all on tools/ static node:* imports — accepted per eslint.tools-bot.config.mjs), no-global-this × 17 (window / activeWindow shim, partially fixed in PR #550), prefer-window-timers × 5, no-tfile-tfolder-cast × 1. 0 new findings on touched code. The GitHub-hosted Bot pipeline (separate from CI, not a status check) was bypassed this cycle — the local mirror is mature enough to substitute per the v1.26.2 hardening record.

Installation

Install or update via the standard Obsidian plugin flow — your existing wiki is preserved on upgrade.

1. From Obsidian — Settings → Community plugins → Browse → search "Karpathy LLM Wiki" → Install (or Update, if you already have it). Then toggle Enable.
2. From the marketplace — community.obsidian.md/plugins/karpathywiki → Add to Obsidian.
3. Manual — only needed if you want a specific version or are running Obsidian without the in-app marketplace. Download main.js, manifest.json, and styles.css from the release assets below into .obsidian/plugins/karpathywiki/, then enable the plugin in Obsidian Settings → Community plugins.

Tests

3677 tests passing (260 files). Up from v1.26.4's 3434 / 235 — +243 across the 17 feature PRs (#404, #425 × 6 test files, #485, #491+#496, #506, #509+#510+#512+#513+#522+#523, #517, #519, #520, #521, #524, #525, #527, #530+#531+#532+#536+#537, #533+#534, #539, #551).

Contributors

• @green-dalii (Greener-Dalii) — Maintainer and primary author. PRs #500, #511, #540, #541, #544, #545, #546, #547, #549, #550, #554. (Bedrock Stage 2 design + implementation, schema three-layer delivery, CLI → dev-instrument migration, release commit.)
• @DocTpoint — Architect-level contributor. 18 PRs: #498, #499, #504, #508, #510, #513, #521, #523, #525, #526, #528, #529, #530, #531, #532, #537, #539, #552. Continues the v1.25.x → v1.27.0 ingest-reliability record: folder-boundary analysis, source-slug merging, vault-wide link retarget, created: provenance, headless-CLI slow-model path, H1 re-assertion, parse-failure result type, ambiguous-designator resolution, runtime tag-vocabulary deferral, run-scoped extraction catalog, staged extraction payload, per-step output-mode + thinking policy, reasoning-only guard restoration, section-shaped contradiction clamp, frontmatter parity chain, ranked candidate window, opt-in candidate gate, text-mode extract baseline + repetition-loop guard + taskPolicies UI, type repair at intake, dev-instrument exit codes, stripUnknownSections, NFC + Turkish-fold alias comparison, folderBySlug, minAliasLength, drop self-named aliases, OpenRouter 404 fix, OpenRouter : variants, and the #425 Bedrock Stage 2 design record. Per-PR / per-issue index in CHANGELOG.md §1.25.0 → §1.27.0.
• @XEurekaX — MinerU online PDF conversion backend (PR #404).
• @anavalo (Tasos Tsournos) — OpenRouter Anthropic baseURL fixture fix (PR #516, Issue #515) and Test Connection blank-model guard (PR #518, Issue #517).
• @evgenyponomarev — OpenRouter model-404 URL-fault fix (PR #535, Issue #533).
• @pttydou — OpenRouter : variants visible (PR #538, Issue #534).
• @rexplx — Issue reporter on source-page verbatim quotes (Issue #496, fixed in PR #546).

Full Changelog

1.26.4...1.27.0