@altimateai/altimate-code 0.5.18 → 0.5.20

package/CHANGELOG.md

@@ -5,12 +5,47 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.20] - 2026-04-09
+
+### Added
+
+- **Altimate model auto-selection** — when Altimate credentials are configured and no model is explicitly chosen, `altimate-backend/altimate-default` is selected automatically. Respects the `provider` filter in config if set. No manual `/model` selection needed for first-time Altimate users. (#665)
+
+### Fixed
+
+- **Connection string passwords with special characters** — passwords containing `@`, `#`, `:`, `/`, or other URI-reserved characters are now automatically percent-encoded in `connection_string` configs. Previously these caused cryptic authentication failures because the URI parser split on the wrong delimiter. Already-encoded passwords (`%XX`) are left untouched. Affects all URI-based drivers (PostgreSQL, MongoDB, ClickHouse). (#597, closes #589)
+- **`trace list` pagination** — `trace list` now supports `--offset` for navigating large trace histories, displays "Showing X-Y of N" with a next-page hint, and caps the TUI trace dialog at 500 items (up from 50) with an overflow message pointing to the CLI for the full set. (#596, closes #418)
+- **ClickHouse edge-case hardening** — added tests for `LowCardinality(Nullable(...))` nullability detection, `Map`/`Tuple` wrapper handling, undefined type fallback, and SQL comment/string-escape edge cases in the LIMIT injection guard. (#599, closes #592)
+
+### Testing
+
+- 31 new adversarial tests covering connection string sanitization (injection, encoding edge cases, ReDoS, Unicode, null bytes), pagination boundary math (Infinity, NaN, fractional, negative inputs), and `Provider.parseModel` edge cases.
+
+## [0.5.19] - 2026-04-04
+
+### Added
+
+- **`${VAR}` environment variable interpolation in configs** — use shell/dotenv-style `${DB_PASSWORD}`, `${MODE:-production}` (with defaults), or `$${VAR}` (literal escape) anywhere in `altimate.json` and MCP server configs. Values are JSON-escape-safe so passwords containing quotes or backslashes can't corrupt your config structure. The existing `{env:VAR}` syntax continues to work for raw text injection. (#655, closes #635)
+
+### Fixed
+
+- **Plan agent warns when the model refuses to tool-call** — if the plan agent's model returns text without invoking any tools, altimate-code now surfaces a one-shot TUI warning suggesting you switch models via `/model` instead of silently hanging. Telemetry event `plan_no_tool_generation` emitted for session-level diagnosis. (#653)
+- **GitLab MR review: large-diff guard & prompt-injection hardening** — MRs exceeding 50 files or 200 KB of diff text are truncated upfront with a user-visible warning, and the review prompt explicitly frames MR content as untrusted input. (#648)
+- **Atomic trace file writes** — `FileExporter` now writes to a temp file and renames, preventing partial/corrupt trace JSON on crash or SIGKILL. Stale `.tmp.*` artifacts older than 1 hour are swept during prune. (#646)
+- **15s timeout on credential validation** — `AltimateApi.validateCredentials()` no longer hangs indefinitely if the auth endpoint stalls. (#648)
+- **Shadow-mode SQL pre-validation telemetry** — measures catch-rate for structural errors (missing columns, tables) against cached schema before enabling user-visible blocking in a future release. Fire-and-forget, zero impact on the `sql_execute` hot path. No raw SQL, schema identifiers, or validator error text transmitted. (#643, #651)
+- **GitLab docs rewrite** — replaced "work in progress" warning with a complete guide: quick-start, authentication, self-hosted instances, model selection, CI example. (#648)
+
+### Testing
+
+- 25 new adversarial tests covering env-var interpolation (JSON-escape safety, single-pass substitution, ReDoS, escape hatch, defaults), atomic write hygiene (race conditions, tmp sweep, sessionId sanitization), and telemetry identifier-leak guards. New ClickHouse finops/profiles/registry coverage. (#624)
+
 ## [0.5.18] - 2026-04-04
 
 ### Added
 
 - **Native GitLab MR review** — review merge requests directly from your terminal with `altimate gitlab review <MR_URL>`. Supports self-hosted GitLab instances, nested group paths, and comment deduplication (updates existing review instead of posting duplicates). Requires `GITLAB_PERSONAL_ACCESS_TOKEN` or `GITLAB_TOKEN` env var. (#622)
-- **Altimate LLM Gateway provider** — connect to Altimate's managed model gateway via the TUI provider dialog (`/connect` → Altimate). Credentials validated before save, stored at `~/.altimate/altimate.json` with `0600` permissions. (#606)
+- **Altimate LLM Gateway provider** — connect to Altimate's managed model gateway via the TUI provider dialog (select a provider → "Altimate"). Credentials validated before save, stored at `~/.altimate/altimate.json` with `0600` permissions. (#606)
 
 ### Fixed
 

package/package.json

@@ -7,24 +7,24 @@
   "scripts": {
     "postinstall": "bun ./postinstall.mjs || node ./postinstall.mjs"
   },
-  "version": "0.5.18",
+  "version": "0.5.20",
   "license": "MIT",
   "dependencies": {
     "@altimateai/altimate-core": "0.2.6"
   },
   "optionalDependencies": {
-    "@altimateai/altimate-code-linux-arm64": "0.5.18",
-    "@altimateai/altimate-code-windows-x64": "0.5.18",
-    "@altimateai/altimate-code-windows-x64-baseline": "0.5.18",
-    "@altimateai/altimate-code-darwin-x64": "0.5.18",
-    "@altimateai/altimate-code-windows-arm64": "0.5.18",
-    "@altimateai/altimate-code-linux-x64-baseline": "0.5.18",
-    "@altimateai/altimate-code-linux-arm64-musl": "0.5.18",
-    "@altimateai/altimate-code-linux-x64-musl": "0.5.18",
-    "@altimateai/altimate-code-linux-x64": "0.5.18",
-    "@altimateai/altimate-code-darwin-x64-baseline": "0.5.18",
-    "@altimateai/altimate-code-linux-x64-baseline-musl": "0.5.18",
-    "@altimateai/altimate-code-darwin-arm64": "0.5.18"
+    "@altimateai/altimate-code-linux-arm64": "0.5.20",
+    "@altimateai/altimate-code-windows-x64": "0.5.20",
+    "@altimateai/altimate-code-windows-x64-baseline": "0.5.20",
+    "@altimateai/altimate-code-darwin-x64": "0.5.20",
+    "@altimateai/altimate-code-windows-arm64": "0.5.20",
+    "@altimateai/altimate-code-linux-x64-baseline": "0.5.20",
+    "@altimateai/altimate-code-linux-arm64-musl": "0.5.20",
+    "@altimateai/altimate-code-linux-x64-musl": "0.5.20",
+    "@altimateai/altimate-code-linux-x64": "0.5.20",
+    "@altimateai/altimate-code-darwin-x64-baseline": "0.5.20",
+    "@altimateai/altimate-code-linux-x64-baseline-musl": "0.5.20",
+    "@altimateai/altimate-code-darwin-arm64": "0.5.20"
   },
   "peerDependencies": {
     "pg": ">=8",