v0.8.0

[0.8.0] - 2026-05-03

Added

• gost-report: project-paths convention. New _paths.py module ships ProjectPaths (frozen dataclass: root, docs, figures, tables, out, tex) and paths(start=None) → ProjectPaths helper. Project root auto-detected by walking up from the caller's __file__ (or CWD fallback) and matching the first marker among .git/ → Makefile → pyproject.toml → .claude/. "Contains marker, not is marker" rule means a script in <project>/.claude/gost-report/build.py walks past .claude/ and lands at <project>/. Both names re-exported from gost_report for from gost_report import paths.
• Report auto-resolves figure and save paths. Report.figure(path, caption) resolves relative paths against <project>/docs/figures/; absolute paths pass through. Report.save(path=None) defaults to <project>/docs/report.docx, treats relative paths as relative to <project>/docs/, and creates parent directories with mkdir parents=True exist_ok=True. save() now returns Path (was str). New keyword-only constructor parameter Report(..., project_root=None) lets callers override auto-detection. Result: agent-generated scripts drop the 5-line Path(__file__).parent / "figures" boilerplate and the build script can live anywhere — recommended location <project>/.claude/gost-report/build.py so it doesn't pollute the artefact directory.
• references/templates/build.py — copy-paste scaffold for a fresh project (see SKILL.md "Project layout" section for the full convention).

Changed

• BC NOTE: r.figure("foo.png", ...) with a relative path previously resolved against os.getcwd(). It now resolves against <project>/docs/figures/. Real consumer scripts always built absolute paths via Path(__file__).parent / "figures", so the in-the-wild break is near zero. If you hit this, either pass an absolute path (unchanged behavior) or accept the new convention. FileNotFoundError raised on miss now includes both input and resolved paths.
• Report.save() return type widened from str to Path. print(f"Wrote {out}") style still works.
• SKILL.md gains a "Project layout" section showing the recommended <project>/.claude/gost-report/build.py location and the auto-resolve rules. API table updated to reflect the new figure/save semantics and adds the paths() row.

[0.7.1] - 2026-05-02

Fixed

• includeCoAuthoredBy is deprecated by Claude Code. v0.7.0 wrote only the legacy key; the modern key is attribution: { commit: "", pr: "" }, which takes precedence. The installer now writes both — attribution for current Claude Code, includeCoAuthoredBy for backward compat with older versions. Verified against official settings docs.
• Hook regex was too narrow. v0.7.0 stripped only Co-Authored-By: Claude <noreply@anthropic.com>. Modern Claude Code emits model-named variants like Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> (and presumably future model names). Regex broadened to Claude[^<]*<noreply@anthropic\.com> so any model-name variant is caught.

Added

• Safe-defaults layer (default-on for --target claude, opt-out via --no-config-defaults / -NoConfigDefaults). Two universal defaults merged into ~/.claude/settings.json:
  • $schema: https://json.schemastore.org/claude-code-settings.json — enables JSON autocomplete and inline validation in VS Code, Cursor, and other editors.
  • permissions.deny — set-union (preserves user entries) of universally-unsafe file-read patterns: Read(./.env), Read(./.env.*), Read(./**/secrets/**), Read(./**/*.pem), Read(./**/*.key). We deliberately do not ship a permissions.allow list — it's stack-specific; use Claude Code's fewer-permission-prompts skill instead.
• scripts/json-merge.py: --list-union <dotted.path> repeatable flag. For the named JSON path, lists merge via set-union (overlay-first order, dedupe) instead of overwrite. Used to merge permissions.deny without clobbering user entries. Backward-compatible with v0.7.0 invocations (no flag → existing scalar/array overwrite behavior).
• scripts/agentpipe.env.example — curated reference for opt-in shell env vars (CLAUDE_CODE_EFFORT_LEVEL, CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC) with caveats: explicitly not auto-installed and not auto-sourced. Annotated trade-offs: EFFORT_LEVEL=max removes per-turn token cap (paid-plan quota burns faster), DISABLE_ADAPTIVE_THINKING is a no-op on Opus 4.7, DISABLE_NONESSENTIAL_TRAFFIC bundles autoupdater + telemetry + error-reporting + feedback-command.
• docs/installation.md: "After Install: Terminal & Keybindings" section — pointer to /terminal-setup, newline fallbacks (Ctrl+J), and a keybindings table covering Esc Esc rewind, image paste, permission-mode cycling, transcript toggle. Plus an "Optional Shell Environment Variables" section explaining how to use agentpipe.env.example.

Notes

• --uninstall does not auto-remove the new $schema / permissions.deny keys (same precedent as includeCoAuthoredBy in v0.7.0): we don't track which keys we added, and removing user state on uninstall is not symmetric with adding by deep-merge. Edit ~/.claude/settings.json manually to revert.
• The agentpipe.env.example file is shipped only in the repo — the installer does not copy it anywhere. Users who want it explicitly copy it to ~/.claude/agentpipe.env and add a single source-line to their shell rc. This is intentional: shell rc is the user's territory.

[0.7.0] - 2026-05-02

Added

• Installer suppresses Claude Code commit-message attribution by default (--target claude). Two layers, both idempotent and reversible:
  1. Settings flag. ~/.claude/settings.json gets includeCoAuthoredBy: false deep-merged in (existing keys preserved). Atomic write via temp file + rename through scripts/json-merge.py (Python 3 stdlib only); on parse error of the existing file, the original is left untouched. PowerShell uses native ConvertFrom-Json / ConvertTo-Json and skips the Python dependency.
  2. Global commit-msg hook. scripts/git-hooks/commit-msg is copied into ~/.git-templates/hooks/, and git config --global init.templateDir is pointed at ~/.git-templates (only if currently unset or already ours — never overrides a user-set path). The hook strips 🤖 Generated with [Claude Code] and Co-Authored-By: Claude <noreply@anthropic.com> lines plus trailing blank lines via portable BSD/GNU sed.
• --no-attribution-fix (Bash) / -NoAttributionFix (PowerShell) opt-out flag. Skips both layers. Always implicitly off for --target codex.
• --uninstall reverses the layer: removes our hook (only if byte-identical to ours), unsets init.templateDir (only if it points to our path). settings.json/includeCoAuthoredBy is left as-is — uninstall scope stays narrow; the installer prints a one-line reminder so users can revert manually.
• New files: scripts/git-hooks/commit-msg, scripts/json-merge.py. Existing user hooks are backed up to commit-msg.agentpipe.bak.<epoch> before overwrite, with a loud warning.

Changed

• install.sh and install.ps1 gain three internal helpers (do_attribution_fix / do_attribution_unfix / do_attribution_dry) wired into install, uninstall, dry, and diff flows. Codex target unchanged.
• docs/installation.md adds a "Removing Claude Attribution from Commits" section with troubleshooting (existing template dir conflict, existing hook backup) and a git filter-repo --message-callback recipe for cleaning already-committed trailers (with explicit force-push warning — destructive, not automated).
• README "Customization" mentions the new default and how to opt out.

Notes

• Existing repos are not retroactively modified — git init only seeds hooks at repo creation. To apply the hook to an existing repo, run git init inside it (no-op except for hooks; safe) or copy the hook into .git/hooks/ manually. The installer surfaces this as a one-line note on every install.
• History rewrites for already-pushed commits with the trailers are documented but explicitly not automated by the installer (force-push hazard — must be coordinated with collaborators).

[0.6.4] - 2026-05-02

Fixed

• gost-report: consumer scripts no longer need sys.path.insert(...) boilerplate before from gost_report import .... Previously every agent-generated script (e.g. lab build_report.py) had to start with sys.path.insert(0, "/Users/.../skills/gost-report/scripts") to make the import resolve, baking a hardcoded absolute path into every output and burning tokens on identical preamble each regeneration. scripts/ensure_env.py now writes a gost_report.pth file into the venv's site-packages during bootstrap (purelib path queried from the venv's own sysconfig, not hardcoded — works on macOS, Linux, Windows, conda). The .pth is rewritten if missing on every main() call (self-heal for venvs predating this feature or for users who manually deleted it). As belt-and-suspenders, ensure_env.py also prepends <skill_dir>/scripts/ to PYTHONPATH before os.execv / Windows subprocess.run of the user script. Result: agents/users write from gost_report import Report, TitleConfig directly. SKILL.md Dependencies section documents the mechanism in one paragraph.