@lmctl-ai/lmctl 0.2.66 → 0.2.68

package/CHANGELOG.md

@@ -4,6 +4,10 @@ All notable public-preview changes for `@lmctl-ai/lmctl` are recorded here.
 
 ## Unreleased
 
+- **Failure lists name the failure.** `lmctl running` and the activity lines of `lmctl status` showed the constant header `Original provider error:` (or the header and the first warnings) for every provider failure. They now show one line of the provider's own output, taken from its end, where the real error is. Other errors keep their first line as before, `--json` output is unchanged, and control characters from a stored error are no longer printed by `lmctl status`.
+
+- **Ordered LMScript source modules.** Disk and trusted HTTP/HTTPS imports are literal includes with canonical per-run identity; repeats are ignored, cycles rejected. A first package ns; declaration exposes ns.function/ns.variable without aliases. Imports are author-ordered (leaf packages first); duplicate package names, shadowing, unknown members and use before import fail the passive check. Checks fetch source but execute no module code; arbitrary JavaScript module loading is removed.
+
 - **Provider failures show the real error.** lmctl used to keep about the first 500 characters of a provider's stderr, so a wall of warnings could hide the failure behind it. The summary now keeps the end of the output (and a little of the start), collapses repeated lines to one line with a count, keeps both ends of an oversized line, and says what it left out. When something is left out, the complete output is saved to `~/.lmctl/provider-errors/stderr-*.log` (directory 0700, files 0600, at most 50 files and 20 MB, at most 1 MB per file) and the message names the file. Short errors read exactly as before and write no file. Credentials (authorization headers, API keys and tokens, JWTs, cookies, private keys, passwords in URLs, secret-named environment lines) are redacted in the message, the saved file and the debug log, and terminal control sequences are removed.
 
 - **Breaking: explicit properties replace implicit profile globals.** init.toml keeps its name and stores lmctl properties. Provider1..3 become PROPS.Provider1..3.Provider; Model1/2/3 become PROPS.Provider1/2/3.Model1. Directory/NonInteractive remain invocation facts. PROPS is a strict read-only hierarchical map, with dotted-key indexing; get_property/has_property/get_properties/set_property use plain values and run-local copies/overlays. Checks are profile-free with known-key suggestions; reads load the profile lazily. Nested ARGV now contains only the child arguments, matching top-level ARGV (no filename). Bare variables, ARGV, PROPS and env() are separate access forms; f-string expressions stay general.

package/build-info.json

@@ -1 +1 @@
-{"sha": "82ba82714504468de99a02cf4f31516705bbd9e4", "dirty": true, "builtAt": "2026-10-05T09:47:56.000Z"}
+{"sha": "45a66d3a972df46d79fdaaab11924d8724eaa743", "dirty": true, "builtAt": "2026-10-05T10:26:56.000Z"}