Skip to content

v5.0.0

Choose a tag to compare

View all tags
@rakaarwaky rakaarwaky released this 19 Aug 08:36
· 21 commits to main since this release
v5.0.0
c0731f4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v5.0.0 — AES 0 violations, consumer-first surface fixes, shared prompt-flow refactor

Quality gates (all green)

  • lint-arwaky-cli scan . → 0 violations (was 9: 2× AES305, 5× AES401, 2× AES203)
  • ruff format / ruff check clean · mypy strict clean (62 files) · full pytest passing (3.12 & 3.13) · uv build OK

Architecture (AES)

  • New IPromptFlowAggregate contract + SharedFlowOrchestrator agent — de-duplicates direct/file/attachment orchestrators via contract aggregate + DI (no agent→agent imports)
  • taxonomy_core_constant.py now pure constants (AES401); get_playwright_browsers_path() moved to utility_core_paths.py
  • Unused imports removed (AES203); legacy DEFAULT_TODO deleted

Consumer-first fixes (UI/UX audit)

  • MCP: failed runs return typed error envelopes (AUTH_REQUIRED / EXECUTION_ERROR) instead of success: true; tool schemas documented (descriptions, 100 MB limit, blocked extensions)
  • TUI: red FAILED render on failure, Enter-key misfire fixed, async session badge, Cancel Run + quit guard
  • CLI: working --json output, exit code 2 for AuthRequiredError, --headless removed from login, -v/--verbose flag
  • SKILL.md: .qwen-web/ workspace rule, orphan-process cleanup, no-external-timeout policy

Security (Codacy review)

  • UpdateManager: subprocess hardened against shell metacharacter/path injection + https-only URL scheme + github repo allowlist
  • delete_session path-safety strengthened

Review

  • Codacy findings resolved · cubic SUCCESS · CodeRabbit skipped · PR #143 merged

What's Changed

  • v5.0.0: AES 0 violations, consumer-first surface fixes, shared prompt-flow refactor by @rakaarwaky in #143

Full Changelog: v4.4.0...v5.0.0

Contributors

rakaarwaky
Assets 4
Loading