Repository navigation
v3.22.1
What's new
Bug Fixes
The workflow guard can now snapshot larger repositories without becoming unavailable on the first shell command: local limits rise to 128 MiB of file content, 20,000 files, and 8 MiB of listing output. Remote readbacks retain separate limits of 4,096 items and 1 MiB, so larger local snapshots do not loosen remote bounds. (#1101)
When a hook makes the guard unavailable, status now records a bounded, enum-only cause and the hook site instead of a bare unavailable state. Initialization failures are recorded, protected mode rejects tool calls when no guard can be published, and history confirmation preserves an already-recorded hook failure. Diagnostic causes exclude raw exception messages, including potentially sensitive file names. (#1101)
Continuous Integration
Releases now publish only by merging the gated release pull request, with npm authentication through OIDC trusted publishing. The legacy publish path and RELEASE_MODE switch are removed. Release follow-on workflows rely on a GitHub release authored by the release App as evidence that npm publishing completed, avoiding failures caused by registry visibility delays. The real-host contract check is required on main, and recovery documentation covers both a failed npm upload that leaves a tag and an npm publish whose GitHub release is missing. Release narration also uses the runner's permitted scratch directory. (#1100)
The release pull-request refresh job now runs even when the upstream publish job is skipped, while still requiring a successful render on main. This fixes ordinary merges rendering a release pull request without opening it. (#1103)
Also in this release
- deps: Update web-tree-sitter to v0.27.1. (#1085)
- release: Record the v3.22.1 version bump.