Skip to content

v0.7.3

Choose a tag to compare

View all tags
@knlab knlab released this 03 Oct 14:58
· 4 commits to main since this release
v0.7.3
0cf224c

pb-php shipped a security release (2.1.4) that pins patched Guzzle versions and strips response bodies and credential-bearing query strings from its exception messages. This release adopts it and re-attaches the server's own error explanation on the pb-migrate side, so API failures stay readable. It also lands two sync-safety changes: pull no longer overwrites files edited since the last sync, and push refuses local trees whose files would collide under Pandorabots' flat remote namespace.

Security

  • Require spontena/pb-php ^2.1.4, which in turn requires guzzlehttp/guzzle ^7.15.2 and guzzlehttp/psr7 ^2.12.3. composer audit on the previous lock reported 13 advisories against Guzzle (one high); the updated lock reports none.
  • Action required for existing installs: run composer update — a lock file is not updated by this change alone.

Added

  • pull protects un-pushed local edits. Before writing a file it compares the local SHA-256 with the hash recorded in the cache at the last sync. A mismatch skips the file with a warning and a per-bot summary count. No cache entry (first pull, manually dropped-in file) falls through and writes, preserving first-pull behaviour. pull --force restores the old unconditional overwrite.
  • FileScanner refuses colliding remote names. Local trees where two files map to the same remote name (e.g. ja/greet.aiml and en/greet.aiml both upload as file/greet) now raise a ConfigException listing every colliding path. Same basename across different kinds (foo.set / foo.map) is still fine.
  • Server error detail is shown everywhere an ApiException surfaces. The message field of the API's JSON error body is appended in the REPL error line, batch failure line, test FAIL line, the error block of a direct CLI run (as a trailing Server message: line), and the pull / push skip lines for HTTP 4xx / 412 on system-managed files. Bodies without a usable message render exactly as before.
  • README (English and Japanese): new "Error handling" and "Pull semantics" sections.

Changed

  • composer analyse runs PHPStan with --memory-limit=1G.
  • .gitignore excludes local AI-agent instruction files (CLAUDE.md, AGENTS.md, .claude/, .codex/).

Full changelog: v0.7.2...v0.7.3

Assets 2
Loading