@altimateai/altimate-code 0.12.0 → 0.12.2-beta.1

package/CHANGELOG.md

@@ -5,6 +5,46 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.12.2-beta.1] - 2026-09-22
+
+> **Beta channel release.** Publishes to the npm `beta` dist-tag; `latest` (0.12.1) is unaffected. Install: `npm i -g @altimateai/altimate-code@beta`.
+
+Six bug fixes from the first headless triage of the workspace pilot and from the documented-configuration audit that followed it. No new features; nothing here is behind a flag except where noted. Each fix went through three bot reviewers, a Codex review and an end-to-end run against a live tenant before merging.
+
+### Fixed
+
+- **Every documented `ALTIMATE_CLI_*` environment variable is now read** — not only `YOLO` and `DISABLE_AUTOUPDATE`. `docs/docs/usage/cli.md` documents the flags under `ALTIMATE_CLI_*`, but most of the table (external-skill scanning, autocompact, default plugins, LSP download, models fetch, project config, prune, terminal title, Exa, the `EXPERIMENTAL*` family, `CONFIG`, `CONFIG_CONTENT`, `CONFIG_DIR`, `GIT_BASH_PATH`, `PERMISSION`, `SERVER_USERNAME`/`SERVER_PASSWORD`) was read under the `OPENCODE_*` spelling only, so the documented name silently did nothing. One rule now applies on every read path — the two flag modules, the Effect-config services skill discovery and server auth actually read, and the direct reads in config loading, `run --attach`, the legacy database path, the updater and the feature census. The documented name wins when both are set; an empty documented value counts as unset; the `OPENCODE_*` spellings keep working. (#1341, closes #1329)
+- **`/skills` opens the Altimate skills browser, and its actions work.** `/skills` used to open the plain core skill selector (two `/skills` rows in autocomplete; Enter took the wrong one), where ctrl+a did nothing because the plugin's global keybind was outranked by the open dialog. The browser's Actions / New / Install are dialog-level actions now — bound inside the dialog to ctrl+a / ctrl+e / ctrl+g, and rendered as footer buttons reachable with Tab, so no chord is required. Install moved off ctrl+i, which most terminals send as Tab. New and Install work with the list filtered to nothing (the create-from-filter flow), and the palette's "Skills" row and a configured `prompt_skills` keybind both open the browser. (#1342, closes #1328)
+- **`altimate_core_validate` no longer reports a correct query as `ColumnNotFound` against Snowflake metadata.** Warehouse metadata comes back uppercase; the engine compares unquoted identifiers in lowercase and quoted ones exactly. Metadata names are now folded to the engine's form, and quoted all-uppercase references in the SQL (dbt `quote_columns` style) are folded to meet them — only for names the schema actually holds, so a `"SHIPPED"` string literal is untouched. The same preparation applies to every operation that matches SQL against a schema (lint, explain, check, fix, rewrite, equivalence, lineage, and the `sql.*` handlers), generated SQL comes back in the caller's spelling, and a schema file in JSON/YAML is treated like an inline context. Without a schema — or with one that defines no tables — existence checks are skipped as the tool promises, instead of reporting every table missing or failing the call. Known limitation: the fold is dialect-blind; on a lowercase-folding warehouse an all-uppercase quoted-created identifier would be treated as unquoted. (#1343, closes #1333)
+- **"Remember this for the team" lands where teammates read it, and a one-shot `run` no longer loses the upload.** In a linked project the model reached for the engine's `datamate_*` memory store, which linked checkouts never read; the `## Altimate Workspace` section now names `altimate_memory_write` as the team's store once the workspace's memory is confirmed enabled (and not while the link is only "last known"), and the tool description says the same. `run` waits — bounded — for pending memory mirrors and archives before exiting, on a normal exit and, briefly, on Ctrl-C. Pilot only (`ALTIMATE_WORKSPACE=1`). (#1344, closes #1332)
+- **A headless `run` always ends with an answer.** When a tool call failed or was auto-rejected (nobody can approve in headless use) and the model stopped without text — or streamed a "Let me check…" preamble, called a tool, and then stopped — the process printed nothing and exited 0. `run` now asks for a reply once, naming the failed tool; if the model still says nothing, a synthesised line says so on stdout, in `--output` and as a `silent_turn` event in `--format json`, and the run exits 1. Tool diagnostics are not repeated into the follow-up prompt or the answer file. A follow-up that dies in transport reports the error instead of only an exit code. (#1345, closes #1334)
+- **FinOps tools in a linked project point at the workspace engine instead of failing bare.** `finops_warehouse_advice`, `finops_analyze_credits`, `finops_query_history`, `finops_expensive_queries` and the role tools resolve only local connections; in a project whose Snowflake connection lives in the workspace they failed four times before the model thought of the engine. The failure now says why and names the engine tool with the tables the operation reads (region-qualified for BigQuery), re-validated against the current link; in the end-to-end run the model pivoted after one failure. When the routing decision is unknown the failure says that too. Running the FinOps SQL through the engine itself is not in this release. (#1346, closes #1336)
+
+## [0.12.1] - 2026-09-21
+
+Two workspace-pilot additions that landed right after 0.12.0, plus the fixes their joint review turned up. Numbered as a patch because everything under **Added** is behind `ALTIMATE_WORKSPACE=1`; the only changes that reach every user are two reworded strings under **Changed**. **Heads-up for support (pilot):** a session launched from the VS Code / Cursor extension now follows the workspace picked in the extension's panel for skills and memory — but warehouse tool routing still follows the project's own link (#1337), and the agent says so when asked.
+
+### Added
+
+- **The agent states which Altimate Workspace the project is linked to, every turn.** Not only when it is routing warehouse tools: an unlinked project, a link that cannot be verified right now, and a freshly created workspace each get a definite answer ("linked to … id N", "none is linked — here is how to link one", "could not be confirmed"). When the link is served from cache because the server could not be asked, the agent says "last known", and a "none is linked" answered from the five-minute cache says "as of the last check". The instruction is scoped to a genuine identity question ("this/current/active workspace") so an unrelated Databricks conversation gets no linking pitch, and the model is told not to confuse the Altimate Workspace with a Databricks workspace or an IDE workspace folder in either direction. The workspace name is presented as a label chosen by the workspace owner, not an instruction (#1335 tracks structural isolation). Resolved at most once per 30 s per account and project, with a 1.5 s deadline so a slow server never stalls a turn. (#1330, closes #1331)
+- **The IDE extension's workspace selection governs the session it launches.** `altimate-code serve` started by the VS Code / Cursor extension reads `ALTIMATE_PINNED_WORKSPACE_{ID,NAME,ROOT}`; a valid pin outranks the project's stored binding for skills and memory, is validated against the workspaces the signed-in account can see (it selects among them, it grants nothing), is scoped to the folder it was launched for, and is never written to disk. A partial or malformed pin, or one naming a workspace the account cannot see, fails closed rather than falling back to the project's link. A pin is fixed for the life of the process; the extension relaunches `serve` when the selection changes. (#1320)
+
+### Fixed
+
+- **Routing and identity can no longer contradict each other about the link.** The routing section used to say "this project is bound to workspace X" from a snapshot taken at tool resolution; it now says which workspace *serves* the tools, and only the identity section states the link. (#1330)
+- **A pinned session is described as pinned, with the routing caveat**, and a pin served from the offline grace window is marked "last known" like a cached link. Identity's per-turn memo is keyed on the credential, not only the tenant, so two accounts on one tenant never share that memo; the resolver's own five-minute caches underneath it are still keyed by tenant and host, so a same-tenant account switch can still be answered from the previous account's cached link for up to five minutes (#1339, deferred). Under a pin the deadline fallback never reaches for the project's own cached link. Found in this release's review.
+- **The persistent `shell` tool strips the same host markers as `bash`** (`ALTIMATE_CODE_SERVE`, the pin variables, headless and non-interactive), so a nested `altimate-code serve` started from it cannot inherit a pin it was never given. Found in this release's review.
+- **Pin ids are decimal digits only** — `Number()` also accepted `1e3` and `0x10` — and the identity section's size cap now fits its longest shape with a maximum-length name instead of dropping the name. Found by this release's adversarial tests.
+
+### Changed
+
+- **Two strings no longer use "workspace" for something other than the Altimate Workspace** (for every user, not only the pilot): the Databricks credential prompt says `<databricks-workspace-host>`, and the dbt nothing-built validator says "this project is configured to require artifacts". (#1330)
+
+### Known limitations (pilot)
+
+- Warehouse tool routing does not yet honour the IDE pin (#1337); skills, memory and the identity line do.
+- Switching the pinned workspace does not pull that workspace's skills and memory until the next sync cycle (#1320 notes).
+
 ## [0.12.0] - 2026-09-18
 
 The workspace pilot grows a management surface: the agent knows which workspace it is linked to, the sidebar shows what has and has not synced, a `/workspace` menu handles refresh/sync/unlink, and a locally written skill can be published to the workspace. Everything under **Added** is pilot-only (`ALTIMATE_WORKSPACE=1`); nothing changes for other users. **Heads-up for support:** `upgrade` and `uninstall` now refuse when they cannot tell how the binary was installed, instead of guessing — see the first entry under **Fixed**.

package/package.json

@@ -7,20 +7,20 @@
   "scripts": {
     "postinstall": "bun ./postinstall.mjs || node ./postinstall.mjs"
   },
-  "version": "0.12.0",
+  "version": "0.12.2-beta.1",
   "license": "MIT",
   "dependencies": {
     "@altimateai/altimate-core": "0.7.0"
   },
   "optionalDependencies": {
-    "@altimateai/altimate-code-darwin-x64-baseline": "0.12.0",
-    "@altimateai/altimate-code-linux-x64-baseline": "0.12.0",
-    "@altimateai/altimate-code-linux-arm64": "0.12.0",
-    "@altimateai/altimate-code-windows-x64-baseline": "0.12.0",
-    "@altimateai/altimate-code-darwin-arm64": "0.12.0",
-    "@altimateai/altimate-code-darwin-x64": "0.12.0",
-    "@altimateai/altimate-code-windows-x64": "0.12.0",
-    "@altimateai/altimate-code-linux-x64": "0.12.0"
+    "@altimateai/altimate-code-darwin-x64-baseline": "0.12.2-beta.1",
+    "@altimateai/altimate-code-linux-x64-baseline": "0.12.2-beta.1",
+    "@altimateai/altimate-code-linux-arm64": "0.12.2-beta.1",
+    "@altimateai/altimate-code-windows-x64-baseline": "0.12.2-beta.1",
+    "@altimateai/altimate-code-darwin-arm64": "0.12.2-beta.1",
+    "@altimateai/altimate-code-darwin-x64": "0.12.2-beta.1",
+    "@altimateai/altimate-code-windows-x64": "0.12.2-beta.1",
+    "@altimateai/altimate-code-linux-x64": "0.12.2-beta.1"
   },
   "peerDependencies": {
     "pg": ">=8",