altimate-code 0.8.1 → 0.8.3

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.8.3] - 2026-06-04
+
+A plan-mode reliability patch for the hosted gateway and other non-Anthropic models. Ask the `plan` agent to plan something benign — *"plan a feature to add a verify-output button"* — on `altimate-backend/altimate-default` (GPT-5.x) and it could refuse outright with *"I'm sorry, but I cannot assist with that request."* This release fixes the refusal at its source, hardens the fix against prompt-injection, and rewrites a warning that was misdiagnosing the symptom.
+
+### Fixed
+
+- **Plan mode no longer refuses benign requests on `altimate-default` and other non-Anthropic models.** The root cause was *how* altimate-code delivers its own plan instructions: a `<system-reminder>`-wrapped block attached as user-role text. Claude is trained to read that tag as authoritative system guidance, but GPT-5.x, Gemini, and other non-Anthropic models pattern-matched the same block — carrying `STRICTLY FORBIDDEN` / `ZERO exceptions` / `MUST` language — as a **prompt-injection attempt** and declined, returning *"I'm sorry, but I cannot assist with that request."* for ordinary developer tasks. altimate-code now **hoists those self-injected reminders into proper `role:"system"` messages** for non-Anthropic models, so they arrive as instructions rather than suspect user input; Anthropic models are unchanged. The hoist is scoped by **provenance** to altimate-code's own reminder parts — user-supplied files, MCP-resource bodies, and `data:`-URL content can never gain system-role priority, even when they begin with `<system-reminder>`. Gateway models are routed by `model.family` (via a shared `familyVendor` classifier) so a Claude- or Gemini-backed gateway model lands on the right base prompt instead of an Anthropic-style fallback. (#887, #888)
+- **The "plan agent used no tools" warning is accurate — and no longer false-fires.** Previously the warning blamed the model's *tool-use capability* (misleading — these models are fully tool-capable) and could fire on the final text-only step of a **successful** multi-step plan session, making a working session look broken. The trip-wire now scans the conversation history for prior tool calls, so a session that already explored the codebase isn't flagged. When it does fire, the copy describes the observed symptom only ("stopped without calling any tools"), lists the likely causes, and offers concrete recoveries — ask it to investigate first, rephrase, or, if it keeps refusing, `/model` to a tier more eager to explore. The plan agent is also now instructed to **read or search the codebase before drafting** any plan, with an explicit escape hatch for trivial, fully-specified changes. See [Plan mode](https://docs.altimate.sh/data-engineering/agent-modes/#plan) and [Troubleshooting](https://docs.altimate.sh/reference/troubleshooting/). (#888)
+
+## [0.8.2] - 2026-06-03
+
+A small correctness patch. The dbt PR reviewer's deterministic engine never required an altimate API key — but two tool descriptions said it did, which could push the reviewer into lint-only mode and send users chasing a key they don't need. This release corrects that and documents what "lint-only" actually means.
+
+### Fixed
+
+- **`dbt_pr_review` no longer implies it needs an altimate API key.** The native `altimate-core` engine behind the reviewer (column-lineage blast radius, query equivalence, PII classification, A–F grade) runs **fully offline** via the bundled napi binary — there is no `altimate_core.init` and no API-key gate in that path. Two tool descriptions (`altimate_core_column_lineage`, `altimate_core_track_lineage`) still carried a stale Python-bridge-era line claiming *"Requires `altimate_core.init()` with API key"*, so a stuck **lint-only** run was mis-diagnosed as missing auth. The descriptions now state the tools run offline with no key. **Lint-only actually means the dbt `manifest.json` didn't resolve** (wrong path, stale manifest, or wrong working directory) — the [dbt PR Review docs](https://docs.altimate.sh/usage/dbt-pr-review/) now spell out how to fix it. The only thing that ever needs a key is the optional advisory LLM lane, which can never block a verdict. (#882)
+
 ## [0.8.1] - 2026-06-02
 
 A reliability + correctness patch on top of 0.8.0. Highlights: **8 new Snowflake Cortex models** (with a config escape-hatch so you never wait for a release again), a **trace-corruption fix** for long-running sessions, and a **behavior change to the dbt PR reviewer** — it now always posts a GitHub *comment* and never a formal *approval*.

package/package.json

@@ -14,20 +14,20 @@
   "scripts": {
     "postinstall": "bun ./postinstall.mjs || node ./postinstall.mjs"
   },
-  "version": "0.8.1",
+  "version": "0.8.3",
   "license": "MIT",
   "dependencies": {
     "@altimateai/altimate-core": "0.4.0"
   },
   "optionalDependencies": {
-    "@altimateai/altimate-code-linux-arm64": "0.8.1",
-    "@altimateai/altimate-code-darwin-arm64": "0.8.1",
-    "@altimateai/altimate-code-linux-x64-baseline": "0.8.1",
-    "@altimateai/altimate-code-darwin-x64-baseline": "0.8.1",
-    "@altimateai/altimate-code-windows-x64-baseline": "0.8.1",
-    "@altimateai/altimate-code-darwin-x64": "0.8.1",
-    "@altimateai/altimate-code-windows-x64": "0.8.1",
-    "@altimateai/altimate-code-linux-x64": "0.8.1"
+    "@altimateai/altimate-code-linux-arm64": "0.8.3",
+    "@altimateai/altimate-code-darwin-arm64": "0.8.3",
+    "@altimateai/altimate-code-linux-x64-baseline": "0.8.3",
+    "@altimateai/altimate-code-darwin-x64-baseline": "0.8.3",
+    "@altimateai/altimate-code-windows-x64-baseline": "0.8.3",
+    "@altimateai/altimate-code-darwin-x64": "0.8.3",
+    "@altimateai/altimate-code-windows-x64": "0.8.3",
+    "@altimateai/altimate-code-linux-x64": "0.8.3"
   },
   "peerDependencies": {
     "pg": ">=8",