TalkPipe 1.0.2b2__tar.gz → 1.1.0__tar.gz

{talkpipe-1.0.2b2 → talkpipe-1.1.0}/.github/CICD.md

@@ -27,7 +27,7 @@ Actions-compatible runner; jobs that need github.com are guarded with
 | `security-scan` | everywhere; needs `test`, `lint` | Bandit (`-c pyproject.toml`, the `[tool.bandit]` table) and Safety. Uses the commercial database when `SAFETY_API_KEY` is set and falls back to the free `safety check` database when it is not (secrets are not passed to pull-request runs); both fail the build on a known vulnerability. |
 | `build-container` | github.com only | Docker image build and Trivy scan on every run; pushes to ghcr.io **on releases only** (`latest` for stable releases, `experimental` for pre-releases); multi-architecture (linux/amd64, linux/arm64) on release only. |
 | `codeql-analysis` | github.com only | GitHub's semantic code analysis. |
-| `publish-package` | on a published release; needs `test`, `lint`, `package`, `security-scan` | `python -m build`, `twine check`, upload to PyPI. Does not depend on the container job, so publishing is not blocked where that job is skipped. |
+| `publish-package` | github.com only, on a published release; needs `test`, `lint`, `package`, `security-scan`, `build-container` | `python -m build`, `twine check`, upload to PyPI. Depends on the container job so the package is never published without its images; off github.com that job is skipped and so is this one. |
 
 ### Configuration Files
 
@@ -117,8 +117,11 @@ bandit -c pyproject.toml -r src/
 export SAFETY_API_KEY=your-key   # optional; links results to Safety Platform
 safety scan
 
-# Build container (matches CI)
-docker build -t talkpipe:local .
+# Build container (matches CI). `.dockerignore` excludes `.git`, so the
+# version cannot be derived inside the build; CI computes it with
+# setuptools_scm and passes it as a build argument. Without the argument
+# the image reports version 0.1.0.
+docker build --build-arg TALKPIPE_VERSION=X.Y.Z -t talkpipe:local .
 
 # Run container security scan
 docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \

{talkpipe-1.0.2b2 → talkpipe-1.1.0}/.github/ISSUE_TEMPLATE/release-checklist.md

@@ -13,7 +13,8 @@ assignees: ''
 - [ ] Merge into master
 - [ ] Run bandit and safety
 - [ ] Build docker images and make sure runnable unit tests pass
-        - podman build . -t talkpipe:experimental
+        - podman build --build-arg TALKPIPE_VERSION=X.Y.Z . -t talkpipe:experimental
+          (without the build argument the image reports version 0.1.0)
 - [ ] Tag repository
 - [ ] Build whl files
 - [ ] Install whl file in new environment and test a script in chatterlang_workbench

{talkpipe-1.0.2b2 → talkpipe-1.1.0}/.github/dependabot.yml

@@ -3,6 +3,7 @@ updates:
   # Enable version updates for Python dependencies
   - package-ecosystem: "pip"
     directory: "/"
+    target-branch: "main"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -18,6 +19,7 @@ updates:
   # Enable version updates for GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
+    target-branch: "main"
     schedule:
       interval: "weekly"
       day: "monday"
@@ -33,6 +35,7 @@ updates:
   # Enable version updates for Docker
   - package-ecosystem: "docker"
     directory: "/"
+    target-branch: "main"
     schedule:
       interval: "weekly"
       day: "monday" 

{talkpipe-1.0.2b2 → talkpipe-1.1.0}/.github/workflows/ci-cd.yml

@@ -52,10 +52,12 @@ jobs:
         # --cov-report=term makes the [tool.coverage.report] fail_under floor
         # in pyproject.toml fail this step; xml/html are for Codecov and
         # local inspection.
-        pytest --cov=src --cov=appcenter --cov-report=term --cov-report=xml --cov-report=html
+        pytest --cov=src --cov-report=term --cov-report=xml --cov-report=html
     
     - name: Upload coverage to Codecov
-      if: matrix.python-version == '3.11'
+      # the action uploads to codecov.io on behalf of a GitHub repo; there is
+      # no equivalent when this runs on Gitea
+      if: matrix.python-version == '3.11' && github.server_url == 'https://github.com'
       uses: codecov/codecov-action@v7
       with:
         files: ./coverage.xml
@@ -152,17 +154,6 @@ jobs:
         print("all entry points resolve")
         PY
 
-    - name: Run the TalkPipe App Center the way users do
-      run: |
-        # appcenter/talkpipe_appcenter.py is a single file users run with `uv run`; it
-        # must work from a plain interpreter that has only its one declared
-        # dependency, from any directory, without the talkpipe package.
-        python -m venv .appcenter
-        .appcenter/bin/pip install "textual>=8,<9"
-        cp appcenter/talkpipe_appcenter.py /tmp/talkpipe_appcenter.py
-        (cd /tmp && TALKPIPE_APPCENTER_OFFLINE=1 UV=/bin/true "$GITHUB_WORKSPACE/.appcenter/bin/python" talkpipe_appcenter.py list)
-        .appcenter/bin/python /tmp/talkpipe_appcenter.py --version
-
   lockfile-check:
     # uv.lock is a development convenience only -- CI installs with pip on
     # purpose (see README, "Development environment"). This job installs
@@ -207,20 +198,23 @@ jobs:
         # unrelated to anything this project declares or installs.
         .venv/bin/python -m pip install --upgrade pip setuptools
         .venv/bin/pip install -e ".[dev,all]"
-        # safety shares this venv with the project, and the project's `all`
-        # extra pulls in httpx2 (openai 3.x and anthropic 1.x depend on it).
-        # authlib 1.8.0 (safety's OAuth client) switches its httpx integration
-        # to httpx2 whenever httpx2 is importable, but safety 3.8.1 still
-        # builds httpx-0.28 Timeout objects for it, so every `safety` command
-        # crashes during auth setup with "'Timeout' object cannot be
-        # interpreted as an integer". Hold authlib below 1.8 until a safety
-        # release supports it. This is a CI tool pin, not a project floor.
-        .venv/bin/pip install bandit safety "authlib<1.8"
+        # The scanners get a venv of their own, outside the workspace, so the
+        # scan covers what the project installs and not the scanners' own
+        # dependencies (safety brings in nltk, which nothing here depends on).
+        # It also keeps safety away from the httpx2 that the `all` extra
+        # installs (openai 3.x and anthropic 1.x depend on it): with httpx2
+        # importable, authlib 1.8 hands it to safety 3.8.1, which then crashes
+        # during auth setup with "'Timeout' object cannot be interpreted as an
+        # integer".
+        python -m venv "$RUNNER_TEMP/scan-tools"
+        echo "$RUNNER_TEMP/scan-tools/bin" >> "$GITHUB_PATH"
+        "$RUNNER_TEMP/scan-tools/bin/python" -m pip install --upgrade pip
+        "$RUNNER_TEMP/scan-tools/bin/pip" install bandit safety
 
     - name: Run Bandit security scan
       run: |
-        bandit -c pyproject.toml -r src/ appcenter/talkpipe_appcenter.py -f json -o bandit-report.json
-        bandit -c pyproject.toml -r src/ appcenter/talkpipe_appcenter.py -f txt
+        bandit -c pyproject.toml -r src/ -f json -o bandit-report.json
+        bandit -c pyproject.toml -r src/ -f txt
 
     - name: Run Safety dependency scan
       run: |
@@ -239,10 +233,12 @@ jobs:
           # `check` is the legacy command and the only one that runs without an
           # account. It rejects .safety-policy.yml because that file is v3.0 and
           # only `scan` parses v3, so run it from a directory holding no policy
-          # file; it scans the installed environment either way.
+          # file. Left to itself it scans the venv it runs from, so hand it
+          # the project venv's packages instead.
           report="$PWD/safety-report.json"
           workdir="$(mktemp -d)"
-          (cd "$workdir" && safety check --save-json "$report")
+          .venv/bin/python -m pip freeze --exclude-editable > "$workdir/installed.txt"
+          (cd "$workdir" && safety check --stdin --save-json "$report" < installed.txt)
         fi
     
     - name: Upload security scan results
@@ -268,7 +264,22 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v7
-    
+      with:
+        fetch-depth: 0   # setuptools_scm derives the version from tags
+
+    # .dockerignore excludes .git, so the Dockerfile cannot derive the version
+    # itself; compute it here exactly as the sdist/wheel build does and pass
+    # it in. Not docker/metadata-action's `version` output: that is a branch
+    # or PR name on non-release events, not a PEP 440 version.
+    - name: Determine package version
+      id: version
+      run: |
+        python3 -m venv "$RUNNER_TEMP/scm"
+        "$RUNNER_TEMP/scm/bin/pip" install --quiet setuptools_scm
+        version=$("$RUNNER_TEMP/scm/bin/python" -m setuptools_scm)
+        test -n "$version"
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+
     - name: Log in to Container Registry
       uses: docker/login-action@v4
       with:
@@ -308,6 +319,8 @@ jobs:
         load: ${{ github.event_name != 'release' }}
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}
+        build-args: |
+          TALKPIPE_VERSION=${{ steps.version.outputs.version }}
         cache-from: type=gha
         cache-to: type=gha,mode=max
     
@@ -360,14 +373,17 @@ jobs:
 
   publish-package:
     runs-on: ubuntu-latest
-    # build-container is GitHub-only; listing it here would leave publishing
-    # blocked behind a skipped job everywhere else. The container image is
-    # published independently by that job on github.com.
-    needs: [test, lint, package, security-scan]
-    # Version tags only. The rolling `experimental` release is a container for
-    # assets, not a version: publishing from it would upload a distribution
-    # whose setuptools_scm version came from a tag that is not one.
-    if: github.event_name == 'release' && github.event.action == 'published' && startsWith(github.event.release.tag_name, 'v')
+    # build-container is GitHub-only and skipped elsewhere, which skips this
+    # job too, by design: PyPI is published only from github.com, and only
+    # when both release images (linux/amd64, linux/arm64) were built and
+    # pushed to ghcr.io, so a PyPI release never lacks its container image.
+    needs: [test, lint, package, security-scan, build-container]
+    # Version tags only: publishing a release under any other tag would upload
+    # a distribution whose setuptools_scm version came from a tag that is not
+    # one.
+    # publishes to PyPI with a token that only exists on GitHub; a release
+    # cut on Gitea must not try to upload
+    if: github.server_url == 'https://github.com' && github.event_name == 'release' && github.event.action == 'published' && startsWith(github.event.release.tag_name, 'v')
 
     steps:
     - uses: actions/checkout@v7
@@ -395,70 +411,3 @@ jobs:
         TWINE_USERNAME: __token__
         TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
       run: twine upload dist/*
-
-  release-assets:
-    # The TalkPipe App Center is one file users run with `uv run <url>`; each
-    # release attaches it, stamped with the tag so a copy can report which
-    # release it came from, plus the two bootstrap scripts. GitHub only: the
-    # upload uses the GitHub token and the releases/latest/download URL.
-    runs-on: ubuntu-latest
-    needs: [test, lint, package, security-scan]
-    # Version tags only, so a re-publish of the rolling `experimental` release
-    # cannot stamp its own tag name into the file it then re-attaches.
-    if: github.event_name == 'release' && github.event.action == 'published' && github.server_url == 'https://github.com' && startsWith(github.event.release.tag_name, 'v')
-    permissions:
-      contents: write
-
-    steps:
-    - uses: actions/checkout@v7
-
-    - name: Set up Python
-      uses: actions/setup-python@v7
-      with:
-        python-version: '3.11'
-
-    - name: Stamp the release version into the App Center file
-      run: |
-        tag="${{ github.event.release.tag_name }}"
-        version="${tag#v}"
-        sed -i "s/^STAMPED_VERSION = \"0.0.0+unknown\"$/STAMPED_VERSION = \"${version}\"/" appcenter/talkpipe_appcenter.py
-        grep -q "^STAMPED_VERSION = \"${version}\"$" appcenter/talkpipe_appcenter.py
-        python -m venv .appcenter
-        .appcenter/bin/pip install "textual>=8,<9"
-        reported="$(.appcenter/bin/python appcenter/talkpipe_appcenter.py --version)"
-        test "$reported" = "talkpipe-appcenter ${version}"
-
-    - name: Attach the App Center and its bootstrap scripts to the release
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        gh release upload "${{ github.event.release.tag_name }}" \
-          appcenter/talkpipe_appcenter.py appcenter/install.sh appcenter/install.ps1 --clobber
-
-    - name: Refresh the rolling experimental channel
-      # `releases/latest/download/` resolves to the newest release GitHub does
-      # not consider a pre-release, so it cannot serve a beta at all. The
-      # `experimental` release is a fixed anchor that always holds the assets of
-      # the newest release of either kind -- deliberately unlike the container
-      # `experimental` tag above, which pre-releases only, so that a beta is not
-      # served forever after a full release supersedes it.
-      #
-      # Assets move; the tag does not. `upload --clobber` replaces the files
-      # without touching the commit the release points at, so nobody's fetched
-      # tags are ever rewritten. That commit is therefore meaningless, which is
-      # what the notes below exist to say.
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        tag="${{ github.event.release.tag_name }}"
-        notes="Rolling channel: these assets are from ${tag}."
-        notes="${notes} The \`experimental\` tag itself is a fixed anchor and does not track that release's commit."
-        notes="${notes} See RELEASING.md."
-        gh release view experimental >/dev/null 2>&1 || \
-          gh release create experimental --prerelease \
-            --title "Experimental (rolling)" --notes "${notes}"
-        gh release upload experimental \
-          appcenter/talkpipe_appcenter.py appcenter/install.sh appcenter/install.ps1 --clobber
-        gh release edit experimental --prerelease --notes "${notes}"
-        reported="$(.appcenter/bin/python appcenter/talkpipe_appcenter.py --version)"
-        echo "experimental channel now serves ${reported}"

{talkpipe-1.0.2b2 → talkpipe-1.1.0}/AGENTS.md

@@ -52,10 +52,3 @@ TalkPipe is a Python toolkit for creating, testing, and deploying workflows that
 - When creating a new source or segment, add it to the talkpipe.sources or talkpipe.segments entry points in [pyproject.toml](pyproject.toml). Use the update-entry-points skill to generate and apply entry points automatically: `.venv/bin/python .cursor/skills/update-entry-points/scripts/update_entry_points.py`. See [docs/architecture/protocol.md](docs/architecture/protocol.md) for protocol conventions.
 - When writing documentation for segments or sources, do not document the parameters.
 - When writing new sources or segments, use Annotated in the parameter lists to explain the type and purpose of each parameter.
-
-## The TalkPipe App Center (appcenter/)
-- `appcenter/talkpipe_appcenter.py` is a single file users run with `uv run <url>`; it is **not** part of the `talkpipe` package and has one dependency, Textual (dev extra only, capped at its major). Do not split it into a package, add a dependency, or import talkpipe from it.
-- Every external touchpoint (uv, HTTP, the launcher's helper commands, home directory, platform) is injectable; `appcenter/tests/` never runs the real uv or touches the network (see the fake uv in `appcenter/tests/conftest.py`).
-- Applications need no awareness of the App Center; never ask an app to change for the App Center's sake. The catalog (`appcenter/talkpipe.toml`, embedded in the file, a test checks they match) carries only what PyPI cannot supply: launch command, port, health path, icon, data dirs, external services.
-- The file reports the talkpipe release it shipped with: CI stamps the tag into `STAMPED_VERSION` on release; never edit that line by hand. `appcenter/README.md` is its user documentation.
-- Two delivery channels, because `releases/latest` skips pre-releases: the stable assets, and a rolling `experimental` release CI refreshes on every release (a fixed anchor tag — its assets move, its commit does not, and the release jobs ignore any tag not starting with `v`). Which copy you run and which versions it installs are **independent**: the channel for installs comes from `--experimental` / `TALKPIPE_APPCENTER_CHANNEL`, never from this file's own version, and is recorded per application so a later `uv tool install --upgrade` cannot replace a pre-release with the newest release.

{talkpipe-1.0.2b2 → talkpipe-1.1.0}/CHANGELOG.md

@@ -2,62 +2,75 @@
 
 ## Unreleased
 
-- **App Center: a launch opens the page of a released application that does
-  not open its own.** A second newcomer run against the PyPI releases. The
-  catalog's `opens_browser` describes the newest version of an application,
-  and the released writing assistant 1.1.0 has no browser-opening at all, so
-  a launch reported "is running at ..." and nothing appeared. `opens_browser`
-  now also takes a version (`"1.1.1"`): the first one that opens its own tab,
-  with the App Center opening the page for older installed versions; the
-  writing assistant's entry says `"1.1.1"`. Also: an action that fails ends
-  on a `==> Failed:` line, the counterpart of `==> Done:`, and its toast is
-  titled Failed rather than Finished; when all the App Center knows is that
-  something answers on an application's port (no 200 from the health path,
-  and not a process it started), `launch` and `stop` say "something answers
-  on port 8002" instead of stating that the application is running; `l` and
-  `o` on an application that is not installed both say to install it (`o`
-  used to say "launch it first", and `l` then "not installed"); `list` sizes
-  its columns from their content, so `installed (pre-release)` no longer
-  pushes its row out of line; the screen moves the detail pane under the
-  table below 140 columns, where a fixed side pane cut the Running and
-  Launcher columns off at the widths most terminals have; and a Linux
-  launcher for a package that ships no icon names a standard generic one,
-  which the README already promised.
-- **App Center: the release channel launches, and the way back to it
-  works.** Found by a newcomer run against the released applications rather
-  than the checkouts. A catalog `health` path that answers 404 no longer
-  counts as "down": the catalog describes the newest version, and the
-  released vault 1.0.0 and writing assistant 1.1.0 serve their ports without
-  the routes their catalog entries name, so on the default channel every
-  launch was reported as a failure while the app sat open in the browser —
-  and from there `open` refused, a second launch treated the app as "another
-  program" on its port, started a second copy on the next one, overwrote the
-  pid record, and `stop` killed the wrong one. Any HTTP answer on the port
-  now counts as running, and a launch never starts a second copy while the
-  pid file names a live process of the App Center's own. Leaving the
-  experimental channel (`e` again, `--no-experimental`) passes
-  `--reinstall`: `uv tool install --upgrade` never moves a package backwards,
-  so the switch silently kept the beta, reported "already the newest version",
-  forgot the channel record, and left the row offering the release as an
-  "upgrade" that the next `i` could not perform. If a fresh resolution still
-  lands on a pre-release, the App Center says so and keeps the record. A
-  pre-release with no record (installed by hand, or by an earlier copy) now
-  counts as being on the experimental channel, and `(pre-release)` describes
-  the installed version rather than the run's flag. Also: uninstall stops an
-  instance the App Center started before removing its environment; PyPI
-  lookups are no longer capped at 1 MiB, which blanked the latest version and
-  summary of any long-lived package (ruff's record is over 6 MB); `latest`
-  reads `?` rather than `None (<date>)` on the experimental channel; the
-  table's columns grow to fit `installed (pre-release)` instead of clipping
-  it; `c Stop` appears in the footer while the row's app is one the App
-  Center started; the uninstall question wraps; `i`, `l`, `x`, and `o` on the
-  App Center's own row say to move to an application's row instead of doing
-  nothing; the `list` hint no longer names a `talkpipe-appcenter` command
-  that the documented `uv run <url>` never creates; the language-model note
-  mentions an Ollama server on another computer; and the documented uv floor
-  (0.7) is checked, with the version named in the error — only when the
-  version parses, so a stand-in whose `--version` answers with words is not
-  mistaken for an old uv.
+## 1.1.0 (2026-10-12)
+
+- Added `talkpipe.llm.config.resolve_source_and_model(source, model)`: applies
+  the configured default model source and name (`default_model_source` /
+  `default_model_name`, from `TALKPIPE_*` environment variables or
+  `~/.talkpipe.toml`) to a caller's `source` / `model` arguments, using each
+  as passed when given, and raises the usual "Model name and source must be
+  provided" `ValueError` when either is still missing. `llmPrompt` and
+  `llmVisionPrompt` now call it instead of carrying their own copy of the
+  fallback; their behaviour and error messages are unchanged. Code built on
+  TalkPipe that takes its own `model` / `source` arguments can call it rather
+  than re-implementing the rule. The helper does not check that the source
+  is registered; callers keep their own `getPromptSources()` check.
+- **Container images report the released version.** The `Dockerfile` pinned
+  the package version to `0.1.0` for setuptools_scm because `.dockerignore`
+  excludes `.git`, so every published image, `v1.0.1` and `v1.0.2`
+  included, reported `talkpipe.__version__` as `0.1.0`. The pin is now a
+  build argument with that default (`--build-arg TALKPIPE_VERSION=X.Y.Z`),
+  and the CI container job computes the version with setuptools_scm from
+  the checked-out tag and passes it in. A plain `podman build .` still
+  succeeds and still reports `0.1.0`.
+- CI: the security scanners run from a virtual environment of their own, and
+  the dependency scan is given the packages installed in the project's
+  environment. The scan used to cover the environment that also held the
+  scanners, so an advisory against one of their dependencies (`nltk`, which
+  `safety` requires and talkpipe does not) failed the build with nothing in
+  the project to fix. The scan still fails on any finding in what the project
+  installs.
+- CI: `publish-package` depends on `build-container` again, so a release
+  reaches PyPI only after both container images (`linux/amd64`,
+  `linux/arm64`) were built and pushed. A failed container build used to
+  leave a PyPI release with no matching image. Publishing to PyPI happens
+  only from a GitHub release; a release created elsewhere does not upload.
+- **Security: raised dependency floors.** `pymongo>=4.18.2` (GridFS delete
+  file-ID matching, connection-string host injection, client-side field
+  level encryption KMS endpoint, BSON encoding overflow) and, in the `pypdf`
+  extra, `pypdf>=6.19.0` (runtime and memory exhaustion on crafted PDFs).
+  `uv.lock` also moves `urllib3` to 2.8.0 and `virtualenv` (dev only) to
+  21.14.5 to clear their advisories.
+- CI: Dependabot version-update PRs target `main` instead of the default
+  branch `stable`, which only ever points at a release. Security alerts
+  still come from `stable`, so they reflect what is released.
+
+## 1.0.2 (2026-09-25)
+
+- **`max_tokens` caps the length of an LLM response.** `llmPrompt` and the
+  guided-generation segments built on it (`llmScore`, `llmExtractTerms`,
+  `llmBinaryAnswer`) accept `max_tokens`, as do the Ollama/OpenAI/Anthropic
+  prompt adapters: the most tokens the model may generate per response
+  (output only; prompt tokens do not count). The Ollama adapter's chat path
+  sent only `temperature`, so a model that never emitted a stop token
+  generated until its context window filled; `timeout` fails the pipeline
+  in that case, while `max_tokens` bounds the item. It maps to `num_predict`
+  on Ollama, `max_output_tokens` on the OpenAI Responses API, and
+  `max_tokens` on Anthropic, where it replaces the adapter's 4096 (still the
+  value when unset). The default is `None`, which leaves every request
+  exactly as it was; there is no global config key, the option is
+  per-segment. On reasoning/thinking models the thinking tokens count
+  against the cap, and a truncated response from a guided-generation segment
+  fails schema validation rather than returning a partial result. Prompt
+  adapters that take no `max_tokens` (such as `eliza`, or third-party
+  adapters that predate it) keep working and ignore it.
+- **Removed: the TalkPipe App Center.** The single-file installer previewed in
+  the 1.0.2 betas (`appcenter/`, its release assets, and the rolling
+  `experimental` GitHub release that served them) is gone; it never shipped in
+  a full release. The TalkPipe applications install directly with
+  `uv tool install` — the README lists them with the commands. Textual and
+  pytest-asyncio left the `dev` extra. The `experimental` *container* image
+  tag for pre-releases is unaffected.
 - **Deprecated: omitting the `|` between an input source and the first
   segment.** `INPUT FROM echo[data="1,2"] print` has always parsed as though
   the pipe were there — an accident of the grammar, and an inconsistent one,
@@ -71,76 +84,6 @@
   input source of its own — a fork branch, a fork consumer
   (`fork_name -> print`), or a fragment such as `| print` — still begins with
   a bare segment, and spellings that were errors before are still errors.
-- **An experimental channel for the App Center, so pre-releases are reachable
-  at all.** `releases/latest/download/` resolves to the newest release GitHub
-  does not consider a pre-release, so a beta was not merely hard to get — the
-  documented one-liner returned "Not Found", which uv then ran as Python and
-  reported as `SyntaxError`. Release assets are now also attached to a rolling
-  `experimental` release, refreshed on every release, giving a stable URL that
-  serves the newest one of either kind:
-  `releases/download/experimental/talkpipe_appcenter.py`. The bootstrap scripts
-  take the channel by name — `install.sh --experimental`, or
-  `TALKPIPE_APPCENTER_CHANNEL=experimental` for both scripts, the only
-  mechanism Windows has since a piped `irm | iex` cannot receive arguments.
-  That variable chooses only which copy of the App Center runs; the App
-  Center itself does not read it.
-
-  **Any one copy of the App Center installs either the release or the
-  pre-release of each application**, so a released App Center can install
-  betas and a beta one installs releases unless told otherwise. On the
-  screen the choice is a `Channel` column and two keys: `e` on an
-  application's row toggles its channel between `stable` and `pre-release`
-  and installs nothing, and `i` installs (or switches, or upgrades) from
-  whichever channel the row shows — choosing and acting are separate keys,
-  because one key that changed what you were looking at and installed it in
-  the same stroke proved confusing. The Status column says where the two
-  disagree (`installed (pre-release)`, `release available`), and the detail
-  pane repeats the channel. On the command line, `--experimental` (or
-  `--pre`), before or after the subcommand, chooses and installs in one.
-  Both pass `--prerelease allow` to uv — which covers the application and
-  its dependencies, since a pre-release application may require a
-  pre-release library. The choice is recorded per application beside the
-  saved catalogs, because uv replays its own recorded settings for `uv tool
-  upgrade` but not for the `uv tool install --upgrade` the App Center runs;
-  without the record, a later upgrade would quietly reinstall the newest
-  release over a pre-release. Installing the release again (`e` then `i`, or
-  `--no-experimental`) forgets the record. On the pre-release channel the
-  App Center no longer claims to know the latest version, since PyPI's is
-  the newest *release* and not an upgrade target for a pre-release: the row
-  reads `installed (pre-release)`.
-
-- **Fixed: the App Center never said an install had finished.** uv's output
-  scrolled through the log for minutes and then simply stopped, and its own
-  last lines start with "Installed", so the App Center's summary of what had
-  happened was one indistinguishable line in the middle of it — leaving
-  "is it still working?" unanswered. Every action now ends with a line marked
-  `==> Done:` that says what it did (`==> Done: Installed talkpipe-vault
-  1.0.0.`), placed last, after any notes about what the application still
-  needs. On the screen a notification carries the same news over the top of
-  the log, so an install walked away from still reports itself — including
-  when it failed, which the screen also never used to say out loud.
-
-- **Fixed: the App Center left a launch that hit a busy port to time out.** An
-  application whose port is already held by another program — a second copy of
-  it, or an unrelated server — either failed to bind or quietly relocated to a
-  port the App Center was not watching; both ended the same way, in a
-  thirty-second wait and "did not answer on port 8001". A web app's port is now
-  checked before it is started: when something else holds it, the App Center
-  finds the next free port above it and starts the app there, announcing the
-  move, and records that port so status, the browser, and `open` all follow the
-  app to where it actually runs. Doing so needs the new catalog key
-  `port_option` — the option the app takes a port on, `--port` for all three
-  bundled applications; without it the conflict is reported immediately rather
-  than launched into. A server that dies at startup for any other reason is
-  also reported as soon as it exits, with the last lines of its log, instead of
-  being waited out.
-
-- **Fixed: `appcenter/install.sh` exited with status 2 instead of starting the
-  App Center** whenever the process had no controlling terminal — a CI runner, a
-  cron job, a detached session. `/dev/tty` exists and passes a readability test
-  in those cases, so the redirect that reattaches the keyboard for `curl | sh`
-  has to be guarded by actually opening it.
-
 - **Documentation: TalkPipe is provider-neutral, and the docs now say so.**
   Several places read as though Ollama were required — prerequisite lists that
   named only Ollama, a quickstart whose LLM section began "requires
@@ -158,29 +101,6 @@
   `makevectordatabase` / `chatterlang_workbench` help text, and the workbench's
   example scripts name the alternatives too.
 
-- **The TalkPipe App Center** (`appcenter/talkpipe_appcenter.py`), the part
-  of TalkPipe that installs applications: one file, run with
-  `uv run https://github.com/sandialabs/talkpipe/releases/latest/download/talkpipe_appcenter.py`,
-  that installs, upgrades, launches, and uninstalls applications with
-  `uv tool install`, each into its own environment, and adds desktop
-  launchers on Linux, macOS, and Windows. It is designed to make the
-  TalkPipe-based applications (TalkPipe Vault, the TalkPipe Writing
-  Assistant, the ChatterLang Workbench) easy to install and ships with a
-  catalog of them, but any pip-installable Python application with a
-  console script can be listed in a catalog of one's own: `--catalog`
-  (before or after the subcommand) uses one for a run, `--remember` or
-  `catalog add` saves it so every later run loads it (`catalog list`,
-  `catalog remove`). An app-store-like terminal screen
-  plus equivalent subcommands (`list`, `info`, `install`, `upgrade`,
-  `uninstall`, `launch`, `stop`, `open`, `shortcut`). Driven by a TOML
-  catalog (`appcenter/talkpipe.toml`, embedded; `--catalog` overlays or
-  replaces it) whose entries name only what PyPI cannot supply; summaries,
-  publishers, homepages, and latest versions come from PyPI at run time.
-  `appcenter/install.sh` and `appcenter/install.ps1` install uv when it is missing
-  and hand over to the App Center. Each GitHub release attaches the file, stamped
-  with the release version, and the two scripts. The library gained no
-  runtime dependency; Textual and pytest-asyncio joined the `dev` extra.
-
 - **`serverag` no longer fails silently.** With no embedding or completion
   model configured — the state a first-time user is in — it exited 1 with
   nothing on stdout or stderr, in both web and `--interactive` mode. The
@@ -224,10 +144,6 @@
     the snippet actually passes, the Python-API example passes the model it
     precaches, and the offline section warns that a model missing from the
     cache fails under `HF_HUB_OFFLINE=1` with an error that does not name it.
-  - The App Center's `uv run <release asset>` commands are documented as
-    needing a release that post-dates the App Center, with the checkout
-    invocation as the alternative; against an older release the URL 404s and
-    uv reports it as a `SyntaxError`.
   - The reference-browser walkthrough showed invented transcripts —
     `filterEmails`, `extractAttachments`, `mongoConnect`, `mongoQuery`,
     `parseEmailHeaders`, and a `readEmail` parameter list the source never
@@ -247,8 +163,6 @@
     `pip install "talkpipe[...]"` extras so they work in zsh, and pointed the
     Python prerequisite at the versions CI actually tests.
 
-## 1.0.2
-
 - `chatterlang_workbench` now exits within a couple of seconds of Ctrl-C even
   while a request is still running. It used to wait for that request to
   finish — a script started from the editor, or the suggestions sidebar's LLM
@@ -262,7 +176,6 @@
   `TreeObject.insert_child`; the floor is a security minimum, and every
   fresh install already resolved above it.
 
-
 ## 1.0.1
 
 - The Anthropic adapter no longer sends the `temperature` parameter. The

{talkpipe-1.0.2b2 → talkpipe-1.1.0}/Dockerfile

@@ -36,7 +36,12 @@ COPY --chown=builder:builder tests/ tests/
 # Install Python dependencies and build the package
 RUN python3 -m pip install --upgrade pip setuptools wheel build
 RUN python3 -m pip install numpy pandas matplotlib scikit-learn scipy
-ENV SETUPTOOLS_SCM_PRETEND_VERSION_FOR_TALKPIPE=0.1.0
+# .dockerignore excludes .git, so setuptools_scm cannot read the version from
+# the tag inside the build. CI passes the real version as a build argument
+# (`--build-arg TALKPIPE_VERSION=X.Y.Z`); a plain `podman build .` falls back
+# to the placeholder below.
+ARG TALKPIPE_VERSION=0.1.0
+ENV SETUPTOOLS_SCM_PRETEND_VERSION_FOR_TALKPIPE=${TALKPIPE_VERSION}
 RUN python3 -m pip install --user -e .[dev,all]
 RUN python3 -m pytest --log-cli-level=DEBUG
 RUN python3 -m build --wheel