Skip to content

GEODE v1.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Jul 07:01
v1.0.0
edc0c4d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First stable GEODE release, adding self-managed Google Workspace OAuth and
hardening stable distribution verification.

Added

  • Native Google Workspace OAuth and tools. /login google now imports a
    user-owned Google Desktop OAuth client, uses a system-browser loopback
    Authorization Code flow with PKCE and state, and supports multiple accounts,
    scope bundles, status, switching, reauthorization, and revocation. Refresh
    tokens, client secrets, and private account labels live in the OS keyring;
    the versioned JSON registry contains metadata only and access tokens remain
    in memory. Eleven Gmail, Drive, Docs, Sheets, Tasks, and Contacts tools join
    the existing Calendar surface. Personal-data reads require an affirmative
    confirmation for every invocation, including Workspace mutations; cached
    write approvals, HITL 0, and skip-permissions cannot bypass it. Raw Calendar
    MCP tools remain adapter-only, every personal Workspace capability fails
    closed in headless and sub-agent sessions, and raw tool inputs/results are
    marker-redacted from durable transcripts, checkpoints, SQLite, and offload
    storage. Personal API errors are omitted from durable telemetry, while
    rotating runtime logs remain under normal operational retention and may carry
    bounded Google error diagnostics. Personal-tool batches skip secondary
    reflection. The metadata
    registry uses a cross-process lock, monotonic revision, and stale-refresh-safe
    field patches; --new-account separates account scope selection from
    active-account reauthorization.

Fixed

  • Stable releases tolerate split PyPI index convergence. Post-publish
    verification keeps the bounded exact-version uvx install loop, then delegates
    JSON metadata and SHA-256 parity to the reusable full-snapshot verifier that
    already retries GitHub and PyPI together. The redundant one-shot PyPI JSON
    lookup is removed, so a successful upload cannot be reported as failed merely
    because the exact-version JSON endpoint briefly lags the simple index. The
    read-only smoke job also disables its unused uv cache instead of warning about
    a checkout-free cache key.
Assets 5
Loading