@altimateai/altimate-code 0.5.18 → 0.5.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +20 -1
- package/package.json +13 -13
package/CHANGELOG.md
CHANGED
|
@@ -5,12 +5,31 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [0.5.19] - 2026-04-04
|
|
9
|
+
|
|
10
|
+
### Added
|
|
11
|
+
|
|
12
|
+
- **`${VAR}` environment variable interpolation in configs** — use shell/dotenv-style `${DB_PASSWORD}`, `${MODE:-production}` (with defaults), or `$${VAR}` (literal escape) anywhere in `altimate.json` and MCP server configs. Values are JSON-escape-safe so passwords containing quotes or backslashes can't corrupt your config structure. The existing `{env:VAR}` syntax continues to work for raw text injection. (#655, closes #635)
|
|
13
|
+
|
|
14
|
+
### Fixed
|
|
15
|
+
|
|
16
|
+
- **Plan agent warns when the model refuses to tool-call** — if the plan agent's model returns text without invoking any tools, altimate-code now surfaces a one-shot TUI warning suggesting you switch models via `/model` instead of silently hanging. Telemetry event `plan_no_tool_generation` emitted for session-level diagnosis. (#653)
|
|
17
|
+
- **GitLab MR review: large-diff guard & prompt-injection hardening** — MRs exceeding 50 files or 200 KB of diff text are truncated upfront with a user-visible warning, and the review prompt explicitly frames MR content as untrusted input. (#648)
|
|
18
|
+
- **Atomic trace file writes** — `FileExporter` now writes to a temp file and renames, preventing partial/corrupt trace JSON on crash or SIGKILL. Stale `.tmp.*` artifacts older than 1 hour are swept during prune. (#646)
|
|
19
|
+
- **15s timeout on credential validation** — `AltimateApi.validateCredentials()` no longer hangs indefinitely if the auth endpoint stalls. (#648)
|
|
20
|
+
- **Shadow-mode SQL pre-validation telemetry** — measures catch-rate for structural errors (missing columns, tables) against cached schema before enabling user-visible blocking in a future release. Fire-and-forget, zero impact on the `sql_execute` hot path. No raw SQL, schema identifiers, or validator error text transmitted. (#643, #651)
|
|
21
|
+
- **GitLab docs rewrite** — replaced "work in progress" warning with a complete guide: quick-start, authentication, self-hosted instances, model selection, CI example. (#648)
|
|
22
|
+
|
|
23
|
+
### Testing
|
|
24
|
+
|
|
25
|
+
- 25 new adversarial tests covering env-var interpolation (JSON-escape safety, single-pass substitution, ReDoS, escape hatch, defaults), atomic write hygiene (race conditions, tmp sweep, sessionId sanitization), and telemetry identifier-leak guards. New ClickHouse finops/profiles/registry coverage. (#624)
|
|
26
|
+
|
|
8
27
|
## [0.5.18] - 2026-04-04
|
|
9
28
|
|
|
10
29
|
### Added
|
|
11
30
|
|
|
12
31
|
- **Native GitLab MR review** — review merge requests directly from your terminal with `altimate gitlab review <MR_URL>`. Supports self-hosted GitLab instances, nested group paths, and comment deduplication (updates existing review instead of posting duplicates). Requires `GITLAB_PERSONAL_ACCESS_TOKEN` or `GITLAB_TOKEN` env var. (#622)
|
|
13
|
-
- **Altimate LLM Gateway provider** — connect to Altimate's managed model gateway via the TUI provider dialog (
|
|
32
|
+
- **Altimate LLM Gateway provider** — connect to Altimate's managed model gateway via the TUI provider dialog (select a provider → "Altimate"). Credentials validated before save, stored at `~/.altimate/altimate.json` with `0600` permissions. (#606)
|
|
14
33
|
|
|
15
34
|
### Fixed
|
|
16
35
|
|
package/package.json
CHANGED
|
@@ -7,24 +7,24 @@
|
|
|
7
7
|
"scripts": {
|
|
8
8
|
"postinstall": "bun ./postinstall.mjs || node ./postinstall.mjs"
|
|
9
9
|
},
|
|
10
|
-
"version": "0.5.
|
|
10
|
+
"version": "0.5.19",
|
|
11
11
|
"license": "MIT",
|
|
12
12
|
"dependencies": {
|
|
13
13
|
"@altimateai/altimate-core": "0.2.6"
|
|
14
14
|
},
|
|
15
15
|
"optionalDependencies": {
|
|
16
|
-
"@altimateai/altimate-code-linux-arm64": "0.5.
|
|
17
|
-
"@altimateai/altimate-code-windows-x64": "0.5.
|
|
18
|
-
"@altimateai/altimate-code-windows-x64-baseline": "0.5.
|
|
19
|
-
"@altimateai/altimate-code-darwin-x64": "0.5.
|
|
20
|
-
"@altimateai/altimate-code-windows-arm64": "0.5.
|
|
21
|
-
"@altimateai/altimate-code-linux-x64-baseline": "0.5.
|
|
22
|
-
"@altimateai/altimate-code-linux-arm64-musl": "0.5.
|
|
23
|
-
"@altimateai/altimate-code-linux-x64-musl": "0.5.
|
|
24
|
-
"@altimateai/altimate-code-linux-x64": "0.5.
|
|
25
|
-
"@altimateai/altimate-code-darwin-x64-baseline": "0.5.
|
|
26
|
-
"@altimateai/altimate-code-linux-x64-baseline-musl": "0.5.
|
|
27
|
-
"@altimateai/altimate-code-darwin-arm64": "0.5.
|
|
16
|
+
"@altimateai/altimate-code-linux-arm64": "0.5.19",
|
|
17
|
+
"@altimateai/altimate-code-windows-x64": "0.5.19",
|
|
18
|
+
"@altimateai/altimate-code-windows-x64-baseline": "0.5.19",
|
|
19
|
+
"@altimateai/altimate-code-darwin-x64": "0.5.19",
|
|
20
|
+
"@altimateai/altimate-code-windows-arm64": "0.5.19",
|
|
21
|
+
"@altimateai/altimate-code-linux-x64-baseline": "0.5.19",
|
|
22
|
+
"@altimateai/altimate-code-linux-arm64-musl": "0.5.19",
|
|
23
|
+
"@altimateai/altimate-code-linux-x64-musl": "0.5.19",
|
|
24
|
+
"@altimateai/altimate-code-linux-x64": "0.5.19",
|
|
25
|
+
"@altimateai/altimate-code-darwin-x64-baseline": "0.5.19",
|
|
26
|
+
"@altimateai/altimate-code-linux-x64-baseline-musl": "0.5.19",
|
|
27
|
+
"@altimateai/altimate-code-darwin-arm64": "0.5.19"
|
|
28
28
|
},
|
|
29
29
|
"peerDependencies": {
|
|
30
30
|
"pg": ">=8",
|