Skip to content

Kai v2.3.2

Choose a tag to compare

View all tags
@gertybot gertybot released this 29 Sep 09:22
· 22 commits to main since this release
v2.3.2
58d0b0a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Bug fix release: downloading a Garmin activity as a FIT file now gives you a real FIT file, and SECURITY.md becomes a real vulnerability-reporting policy. Nothing to change when upgrading from v2.3.1 unless you copied this workspace into your own agent (see the CREDENTIALS.md note below).

Fixed

  • garmin_activity_files.py download --format fit saved a ZIP archive under a .fit name (#15). Garmin sends the original file zipped, so parse, query and analyze failed with Invalid .FIT File Header. The file is now unpacked on download, and parse/query/analyze also accept a ZIP-wrapped FIT, so files an earlier version left on disk work without downloading them again.
  • download failed when --output-dir didn't exist. It is now created (mode 700).
  • .FIT in capitals (what devices and Garmin Express write) was rejected as an unsupported file type.
  • A FIT file the parser can't decode now says so plainly instead of Invalid struct format: <0f.

Changed

  • Downloaded activity files are now saved owner-only (600) and are never written through a symlink at the destination. They contain GPS tracks, and the default folder, /tmp, is shared. If you relied on other users being able to read them, adjust the permissions yourself.
  • SECURITY.md renamed to CREDENTIALS.md, and a real SECURITY.md added (#24). Kai's own rules on handling your credentials lived in SECURITY.md, but GitHub treats that filename as a repository's vulnerability-reporting policy (shown on the Security tab, offered to anyone reporting a bug). The agent rules are now CREDENTIALS.md, and SECURITY.md says which versions are supported, what's in scope and how to report a problem privately (with a reminder not to attach real tokens or personal data). AGENTS.md's session routine reads CREDENTIALS.md, and a new test checks that every file the routine names exists.
    If you copied this workspace into your own agent rather than tracking main: copy CREDENTIALS.md in and change SECURITY.md to CREDENTIALS.md in the "Every Session" section of your AGENTS.md. Your old file still has the same rules, so nothing breaks in the meantime. Details in docs/upgrading.md.

How it was checked

27 new offline tests (26 for the FIT fix, 1 for the session routine), including a FIT file built inside the test so the whole path (unzip, parse, analyze) runs end to end; deliberately breaking the fix in nine ways each fails a test. Against a real Garmin account, every activity recorded on a watch in a 14-activity sample downloaded and analyzed correctly.

Known issues

  • FIT files from indoor rides uploaded by third-party apps (seen with TrainingPeaks Virtual) can't be decoded by the FIT parser, and parse can't read the TCX export that does carry their data (#36). In the sample, all 5 such rides failed.
  • The Hermes Agent and Codex setups are still untested against live installs.

Full changelog: v2.3.1...v2.3.2

Assets 2
Loading