altimate-code 0.5.5 → 0.5.7

package/CHANGELOG.md

@@ -5,6 +5,54 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.7] - 2026-03-22
+
+### Added
+
+- **Impact analysis tool** — analyze downstream blast radius of dbt model/column changes across the DAG with severity classification (SAFE/LOW/MEDIUM/HIGH) and actionable recommendations (#350)
+- **Training import tool** — bulk import training entries from markdown style guides, glossaries, and playbooks with dry-run preview and capacity management (#350)
+- **CI check command** — `/ci-check` template for pre-merge SQL validation that analyzes changed files, checks dbt integrity, and generates CI-friendly reports (#350)
+- **`--max-turns` budget limit** — CLI option to cap agent steps for CI/enterprise governance (#350)
+- **LM Studio provider** — local Qwen model support via LM Studio (#340)
+- **Improved onboarding** — first-time user hints on home screen, beginner-focused tips, practical quickstart examples (#350)
+- **Expanded `/discover`** — detects additional cloud warehouse credentials (Snowflake, BigQuery, PostgreSQL, Databricks, Redshift) (#350)
+- **Automated test discovery** — `/test-discovery` command for hourly test generation with critic validation (#364, #365, #366, #367)
+
+### Fixed
+
+- Yolo mode now respects explicit deny rules from session config instead of auto-approving everything (#350)
+- Training limits increased from 20→50 entries per kind and 16KB→48KB budget for enterprise teams (#350)
+
+### Testing
+
+- E2E tests for trace viewer with adversarial cases (#353)
+- Bash tool PATH injection tests (#366)
+- `fn()` wrapper and `skillSource` trust classification tests (#367)
+- `AsyncQueue`/`work()` utility and `State.invalidate` coverage (#364)
+
+## [0.5.6] - 2026-03-22
+
+### Added
+
+- **Skill CLI command** — new top-level `altimate-code skill` with `list`, `create`, `test`, `show`, `install`, `remove` subcommands for managing AI agent skills and paired CLI tools (#342)
+- **`.opencode/tools/` auto-discovery** — executables in `.opencode/tools/` (project) and `~/.config/altimate-code/tools/` (global) are automatically prepended to PATH in BashTool and PTY sessions (#342)
+- **TUI skill management** — `/skills` dialog with domain-grouped skill browser, `ctrl+a` action picker (show, edit, test, remove), `ctrl+n` create, `ctrl+i` install from GitHub (#342)
+- **Skill install from GitHub** — `altimate-code skill install owner/repo` clones and installs skills; supports GitHub web URLs, shorthand, local paths, and `--global` flag (#342)
+- **Skill cache invalidation** — `State.invalidate()` and `Skill.invalidate()` with `GET /skill?reload=true` endpoint for cross-thread cache clearing (#342)
+- **Snowflake Cortex AI provider** — use Snowflake Cortex as an AI provider for LLM completions (#349)
+- **Telemetry for skill operations** — `skill_created`, `skill_installed`, `skill_removed` events (#342)
+- **E2E smoke tests** — committed tests for skill lifecycle, git-tracked protection, symlink safety, GitHub URL normalization (#363)
+
+### Fixed
+
+- Symlink traversal protection during skill install — uses `fs.lstat` to skip symlinks and prevent file disclosure from malicious repos (#342)
+- Git-tracked skills cannot be removed via `skill remove` or TUI — prevents accidental deletion of repo-managed skills (#342)
+- GitHub web URLs (e.g., `https://github.com/owner/repo/tree/main/path`) correctly normalized to clonable repo URLs (#342)
+- `.git` suffix stripped from install source to prevent double-append (#342)
+- TUI skill operations use `sdk.directory` + `gitRoot()` instead of `Instance`/`Global` which only exist in the worker thread (#342)
+- TUI install uses async `Bun.spawn` instead of blocking `Bun.spawnSync` to keep UI responsive (#342)
+- Missing `altimate_change` markers in `dialog-skill.tsx` and `skill.ts` (#341, #344)
+
 ## [0.5.5] - 2026-03-20
 
 ### Added

package/package.json

@@ -14,24 +14,24 @@
   "scripts": {
     "postinstall": "bun ./postinstall.mjs || node ./postinstall.mjs"
   },
-  "version": "0.5.5",
+  "version": "0.5.7",
   "license": "MIT",
   "dependencies": {
     "@altimateai/altimate-core": "^0.2.5"
   },
   "optionalDependencies": {
-    "@altimateai/altimate-code-linux-x64": "0.5.5",
-    "@altimateai/altimate-code-windows-arm64": "0.5.5",
-    "@altimateai/altimate-code-linux-arm64-musl": "0.5.5",
-    "@altimateai/altimate-code-darwin-x64": "0.5.5",
-    "@altimateai/altimate-code-windows-x64": "0.5.5",
-    "@altimateai/altimate-code-linux-x64-musl": "0.5.5",
-    "@altimateai/altimate-code-darwin-x64-baseline": "0.5.5",
-    "@altimateai/altimate-code-linux-x64-baseline-musl": "0.5.5",
-    "@altimateai/altimate-code-linux-x64-baseline": "0.5.5",
-    "@altimateai/altimate-code-linux-arm64": "0.5.5",
-    "@altimateai/altimate-code-darwin-arm64": "0.5.5",
-    "@altimateai/altimate-code-windows-x64-baseline": "0.5.5"
+    "@altimateai/altimate-code-linux-x64": "0.5.7",
+    "@altimateai/altimate-code-windows-arm64": "0.5.7",
+    "@altimateai/altimate-code-linux-arm64-musl": "0.5.7",
+    "@altimateai/altimate-code-darwin-x64": "0.5.7",
+    "@altimateai/altimate-code-windows-x64": "0.5.7",
+    "@altimateai/altimate-code-linux-x64-musl": "0.5.7",
+    "@altimateai/altimate-code-darwin-x64-baseline": "0.5.7",
+    "@altimateai/altimate-code-linux-x64-baseline-musl": "0.5.7",
+    "@altimateai/altimate-code-linux-x64-baseline": "0.5.7",
+    "@altimateai/altimate-code-linux-arm64": "0.5.7",
+    "@altimateai/altimate-code-darwin-arm64": "0.5.7",
+    "@altimateai/altimate-code-windows-x64-baseline": "0.5.7"
   },
   "peerDependencies": {
     "pg": ">=8",