Skip to content

v0.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Aug 06:31
· 51 commits to main since this release
v0.3.0
d2cb06a

Changelog

  • d2cb06a Merge origin/main: the vocabulary rides the new command surface
  • 3dd7586 Read credentials through the injected env, so tests can look away
  • e1f9ab7 Write the canon metadata vocabulary, and stamp every artifact
  • 3dbb112 Fix what the review of the workspace feature confirmed
  • 45ee1a5 Show the workspace's title wherever a person chooses one
  • 20bc4a7 Ask which workspace was meant, when there is a person to ask
  • bd37497 Let a repository say which workspace its uploads belong to
  • 0bd0fc4 Rewrite the README for the people it is actually for
  • 84e535c Tell an agent what the browser login really does today
  • eb554b0 Keep the key the registry already handed over, and let CI say who is watching
  • d0e83fa Refuse a login nothing can approve, and stop arguing with a rate limit
  • 40d219f Drop the open questions; they are answered or they are canon's
  • 8d3d96b Record the exit code a refused login page earns
  • d75b682 Write down the one stream that carries two documents
  • 4441c46 Blame the registry only for a question that never got out
  • 93995c7 Cover the two branches nothing was exercising, and one more unheld read
  • d25d4eb Answer for the login it can actually see, on both streams
  • 785097f Read the approval page's record while it is still held
  • aeba1bb Write down the two calls, and say which way in works today
  • 562947d Let a browser mint the key, so a container can log in
  • 4eb664f Say what canon says: references, and slugs a DNS label accepts
  • 5de36d0 Point the link at the card, not at the bytes
  • 512ebad Match the registry's renamed key association
  • a8261c0 Let a re-run of the release finish the release it started
  • bf36744 Ship the npm wrapper under a name npm will accept
  • edc34ce Say artifact for the thing the skill is teaching an agent about
  • e2af277 Hold the installer's platform table to the one that builds the release
  • 3bf4457 Install the release that was already built, rather than building it again
  • cca14e6 Read the command path only as far as the commands go
  • 7dad8eb Keep curl's reason, and curl's exit status, where the failure is reported
  • 83e07a8 Find the SHA-256 tool before there is anything to check
  • 1a607e2 Ask PATH whether the directory is on PATH
  • 1f4c053 Install krowk with one command, and teach an agent to use it
  • 01c733b Read the help the way a person does before checking it
  • 9a269f1 Make every breadcrumb a command that runs where it is read
  • ec35912 Hold a flag's type to the flag set, not to itself
  • c053db2 Stop the catalog being its own evidence
  • d8ce25b Answer what krowk can do in a shape a program can read
  • e13e42c Hand back the next command, arguments and all
  • 0603294 Say which kind of failure it was in the exit code
  • 35fb8e6 Say how a release is cut, and what a human still owes it
  • 472aca4 Cut the release from the tag, and skip npm out loud when it cannot
  • 7c0773e Turn a tag into binaries for five platforms
  • c39b79d Reach npm through the npm registry and nothing else
  • 58fc227 Ask for another upload URL rather than another slug
  • a00de03 Speak the registry's two 404s, and its unreadable body
  • 1d32a06 Name the retry with an Idempotency-Key
  • 583ed08 Tell a person the same thing the JSON does
  • 507289b Hold the run reads to what they claim
  • 8b38636 Check the workspace on a run's artifacts too
  • fd0586d Read runs back
  • 1542095 Pin the order the claim retry depends on
  • 9730bc2 Keep a slug inside its own path segment
  • 4bbb910 Answer 404 for a claim on what was taken down
  • 0aa0288 Take an artifact down from the CLI
  • ce0e051 Require the checksum header the presign hands over
  • d29e857 Wire canon in
  • 061b1de Drop the run slug the MCP withClaimed no longer reads
  • 4f49537 Stop the retry advice contradicting itself about the run
  • dcf05a2 MCP: name a retry the agent can actually make
  • ef8b64b Match the registry that shipped: keyless attach is a 401, not run_needs_key
  • 7149cc7 Address review round 5: human and JSON agree on which run an upload joined
  • 659ca4b Address review round 4: a caller-supplied run reaches the summary too
  • 274a1ab Address review round 3: say that attaching moves an artifact between runs
  • 83f0c45 Address review round 2: the run reaches the summary, not only the human line
  • ab9e1b2 Address review round 1: reflow the prose, pin the finished-run decision
  • 6b81953 Document attaching an upload to a run
  • 85f390c MCP: the agent claiming an upload is the one that knows its run
  • ae36634 krowk uploads attach, and claim --run for the upload that has neither
  • 3f381d0 Let an upload join a run after the fact: PUT /artifacts/:slug/run
  • d9118a6 Match the house signature: authLogin reads f.token and f.quiet
  • 5b8b43a Let auth login answer in JSON, like every other command
  • 199e198 Give the CLI tests a config directory of their own
  • 8554a5e Ask the registry who a key is before storing it, and remember the answer
  • ac5472c Read the key as a resource: GET /v1/key, and no more scopes
  • cb92f20 Say that --session is an override, not a required id
  • d025b6b Merge origin/main: the detected session and commit link ride along
  • ca616e8 The self-check must not prescribe itself
  • 9789e70 Address review round 5: point a rejected key at the self-check, pin the quiet properties
  • 177ee99 Merge origin/main: the real protocol wins, the stack's features ride along
  • bfa938b Merge origin/main into feature/phase1-7-security-hardening
  • 4b74fad Merge origin/main into feature/phase1-6-dev-registry
  • 613511d Merge origin/main into feature/phase1-5-mcp-server
  • 4eddcba Merge origin/main into feature/phase1-4-anonymous-claim
  • c32c5d9 Merge origin/main into feature/phase1-3-key-verification
  • 1cee9fd Fold newlines out of link labels
  • 959dd55 Only claim an image where one renders
  • 121dec5 Escape link labels so titles can't break the embed
  • 714a63a Print both paste forms and say which is which
  • 802df62 Port 0 is a request the banner can now honour
  • b4bc6a2 Merge remote-tracking branch 'origin/feature/phase1-6-dev-registry' into feature/phase1-7-security-hardening
  • fec8255 One origin however its default port is spelled
  • 0b175d0 Merge feature/phase1-6-dev-registry: bind-before-banner meets addr validation
  • 6cf8f12 The comment says where it actually listens
  • a44a8cd One judgement of the API's own origin, and --dev advice that connects
  • 03bf633 Serve on loopback, prove --site reaches the handler, prune the tree
  • 8a117f0 Align the upload leg with the dial, and spell ports the way they bind
  • b07a22c The upgrade hop the redirect permits must also be dialable
  • a5067cd Re-review fixes: judge the dial after resolution, again
  • ea4fc47 A Request without a method is no Request either
  • df6eb66 Re-review fixes: gate finalize like begin, and say who can complete a handshake
  • 9987969 Review fixes: replays keep their rate limit, the spec admits the TTL
  • 0ba35c0 Call valid JSON of the wrong shape what it is
  • 2fc6abc Review fixes: scope the pending finalize, and let completion earn the claim
  • 0d712a6 Report the status the registry actually sent
  • 04140e4 Review fix: activity keeps a handshake alive
  • edd00d7 Announce a URL a client can dial, and gate the limit check on serve
  • 3d6d456 Review fixes: cap Retry-After before it overflows, blame the right host
  • 9a3c45c Address review round 4: pin the attempt cap, expire the bytes too
  • fc5f060 Review fixes: dedup only within an ownership class
  • 771d1b8 Review fixes: refuse redirects, bound pending state
  • aad4919 Address the review: trust the configured host, judge the proxy per request
  • 4e54782 Die on Ctrl-C and cap messages before they are buffered
  • 1364a21 Ignore the agent worktrees that slipped into the index
  • 5a8f692 Address review round 3: cover the retry-success path, pin the storage key
  • 6249cbd Blame the right layer, honour --quiet, cover the untested branches
  • cb94205 Bind before the banner, and reject a negative limit
  • 6e2a23f Address review round 2: test the expiry surface, tighten the stand-in
  • 8c8a696 Address review: a failed push must name its run
  • 23d53f5 Merge feature/phase1-6-dev-registry to pick up the opencode review workflow
  • cb6d24f Merge feature/phase1-5-mcp-server to pick up the opencode review workflow
  • 3f6a593 Merge feature/phase1-4-anonymous-claim to pick up the opencode review workflow
  • 5b5f566 Merge feature/phase1-3-key-verification to pick up the opencode review workflow
  • db996fd Merge feature/phase1-2-paste-ready-output to pick up the opencode review workflow
  • b58177d Merge feature/phase1-1-presigned-handshake to pick up the opencode review workflow
  • 8c3b236 Merge main to pick up the opencode review workflow
  • 1157570 Pin the toolchain that builds this
  • c6ddfb6 Talk to the registry that exists
  • 074c220 Let the review job save its Go build cache
  • d438fb3 Review PRs with opencode on Qwen3.8 Max
  • 828b1de Bound the registry's pending state
  • 78d0898 Close the two residuals the adversarial pass left open
  • 6e13e60 Adversarial review: close four holes, one of them mine
  • ef6d2c0 Separate two comments that ran together in New
  • 73b36b4 Review fix: an --addr with an empty port picks a random one
  • 03f0a03 Review fix: the upload boundary belongs on the connection
  • 5accc58 Fix three findings from the security review
  • 1f76087 Make testing against a local registry first class
  • a2f808d Add an MCP server over the same /v1 API
  • 8cfb017 Review fix: hand the claim URL back exactly once
  • 98ce7f3 Anonymous uploads are ephemeral and claimable
  • 20255cd Self-check the API key and its scopes
  • 393442a Print both paste forms and say which is which
  • 5ced88a Review fixes: the artifact ID must authorise nothing
  • 3be8113 Upload via a presigned three-step handshake
  • b330cad Link the commit, and say when the tree is dirty
  • 3550cae Detect the agent session instead of asking for it
  • 757cc51 Port the CLI from TypeScript to Go
  • 2255e99 init

Install

# npm — the bare `krowk` name is blocked by npm's typosquat filter
npx @krowk/cli push screenshot.png

# Direct download — no runtime, no package manager
curl -sSfL https://github.com/krowkcom/cli/releases/download/v0.3.0/krowk_0.3.0_$(uname -s | tr A-Z a-z)_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz \
  | tar -xz -C /usr/local/bin krowk krowk-mcp

# From source
go install github.com/krowkcom/cli/cmd/krowk@v0.3.0

checksums.txt covers every archive on this release.

Assets 8
Loading