Skip to content

v1.9.0

Latest
Latest

Choose a tag to compare

View all tags
@akshaykalia akshaykalia released this 25 Sep 13:13
· 10 commits to main since this release
v1.9.0
73de7fe
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • shipyard api: authenticated gh api-style calls to Shipyard's /api/v1 and /api/v2 endpoints. Responses are size-capped and secrets such as bypass_token and kubeconfig credentials are redacted. (#65)
  • shipyard detached deploy <application-build-uuid>: create a detached environment from an existing build, with --name, per-repo --branch repo=branch overrides, and --build-on-commit / --build-on-commit-for. (#56)
  • shipyard get environment <id> --bypass-token: print just the environment's bypass token, for scripts such as SHIPYARD_TOKEN=$(shipyard get environment 12345 --bypass-token) ./check.sh. (#68)
  • A much more capable MCP server (shipyard mcp serve): new typed tools, a working exec_service, and a verify prompt that checks a pushed change against its environment. Details below.

MCP server

New tools

  • get_build_history, get_env_vars, put_env_vars, delete_env_var, restart_service, deploy_detached, update_branches. (#65)
  • exec_service now runs non-interactive commands in a service container and returns stdout, stderr and the exit code. It is off by default because it runs arbitrary commands. Turn it on with mcp.allow_exec: true in ~/.shipyard/config.yaml, or SHIPYARD_MCP_ALLOW_EXEC=true. While it's off, the tool returns the equivalent shipyard exec command instead. (#63)

Protocol

  • Prompts are now implemented (prompts/list, prompts/get) instead of only being advertised. (#59)
  • initialize sends server instructions to the client, so clients get guidance without a separate rules file. (#59)
  • The server negotiates the MCP protocol version with the client. (#59)

verify prompt

The prompt walks an agent through confirming that the environment is serving the pushed commit, then checking the change itself against it.

  • It plans first: before running anything, it proposes a test plan covering the change and its blast radius, and waits for you to approve, edit or reject it. (#68)
  • It checks coverage: it maps each changed behavior in the diff to a test that actually exercises it, and reports gaps instead of calling a green suite "verified". (#67)
  • The acceptance check is optional. Pass acceptance (a command such as npm run test:e2e, or a plain description of the expected behavior), or let the prompt use one the repository documents. With neither, it reports what it confirmed and doesn't stop to ask. (#62)
  • When the token fetch fails, the report names the right fix (upgrade, install, or log in). PowerShell is supported too. (#69)

Fixes

  • Fixed a race in the stdio transport where a request arriving just before EOF could be dropped. (#59, #64)

Security

  • Upgraded Go dependencies to fix 11 HIGH CVEs, including in docker/cli, moby/spdystream, logrus and golang.org/x/net. (#57)
  • Upgraded golang.org/x/net to v0.59.0 for GO-2026-5942, a reachable DNS-parsing panic. (#60)
  • Releases are now blocked if govulncheck finds a vulnerability in the shipped binaries. (#61)
  • CI now scans for secrets with gitleaks. (#58)

Full changelog: v1.8.1...v1.9.0

Assets 9
Loading