promptmend 0.19.0__tar.gz

promptmend-0.19.0/.env.example

@@ -0,0 +1,118 @@
+# Copy to .env and fill in. The CLI loads this file without overriding real env.
+# Never commit the real .env. It is gitignored. Keep it outside the repository: put it in
+# ~/.config/promptmend/.env ($XDG_CONFIG_HOME/promptmend/.env when XDG_CONFIG_HOME is
+# set; %APPDATA%\promptmend\.env on Windows), or set
+# PROMPTMEND_ENV=/path/to/.env in the real environment (not in a .env file). The CLI also
+# reads the .env in this repository (editable install), but an API key there sits in the
+# working tree. Once config.toml exists in the config folder above, no .env is read (unless
+# PROMPTMEND_ENV names one). Save it as UTF-8. An unquoted value ends at " #" (a
+# comment): quote a value that contains " #", such as a regex or a persona.
+#
+# Only the key and the persona are set below. Every other line shows its default, commented
+# out: uncomment a line only to change it, so later default changes still reach you.
+
+# PROMPT_PROVIDER=openrouter
+# PROMPT_PROFILE=default
+# Your role, stated in the first person. Opens the CONTEXT section of the `default`
+# profile's rewrite and the `-p-` snippet. Leave empty for no fixed persona.
+PROMPT_PERSONA=
+# PROMPT_PERSONA="I am working as a Head of Data at Example Corp."
+# paste (the rewrite replaces the trigger) or clipboard (the trigger vanishes and the rewrite
+# is on the clipboard; error markers still paste). improve --output overrides it per call.
+# PROMPT_OUTPUT=paste
+# PROMPT_TIMEOUT_SECONDS=30
+# Timeout for the pro tier (-ip-), which runs a slower reasoning model.
+# PROMPT_PRO_TIMEOUT_SECONDS=60
+# Profile for the pro tier (-ip-, and -if- when it runs OPENROUTER_PRO_MODEL); empty uses
+# PROMPT_PROFILE, so both tiers send the same prompt.
+# PROMPT_PRO_PROFILE=
+# Your own profiles are <name>.md files in ~/.config/promptmend/profiles/
+# (%APPDATA%\promptmend\profiles\ on Windows). One named like a built-in (default,
+# general) is ignored unless that built-in is listed here, comma-separated.
+# PROMPT_PROFILE_OVERRIDES=
+# Empty (PROMPT_TEMPERATURE=) sends no temperature, for models that reject the field;
+# leaving it unset keeps 0.2.
+# PROMPT_TEMPERATURE=0.2
+
+# Local providers are ungated only on localhost. Pointed at another machine, or with an
+# Ollama cloud model (a :cloud or -cloud tag, any case), the draft leaves this one, so the
+# data-protection gate applies as it does to the cloud providers. Unlike the cloud providers
+# they accept http:// for another machine, which sends the draft in clear text over the
+# network: use https:// (or an SSH tunnel to localhost) there.
+
+# Ollama
+# OLLAMA_BASE_URL=http://localhost:11434
+# OLLAMA_MODEL=qwen3:8b
+# OLLAMA_THINK=false
+
+# LM Studio (OpenAI-compatible, local, no key needed)
+# LMSTUDIO_BASE_URL=http://localhost:1234/v1
+# LMSTUDIO_MODEL=local-model
+
+# OpenRouter (cloud, default provider). Leave key empty if company policy
+# does not permit sending drafts off-machine; the data-protection gate blocks
+# sensitive content regardless. For local-only use set PROMPT_LOCAL_ONLY=true below:
+# the cloud triggers name their provider, so PROMPT_PROVIDER does not change them.
+OPENROUTER_API_KEY=
+# OPENROUTER_MODEL=google/gemini-3.5-flash-lite
+# OPENROUTER_BASE_URL=https://openrouter.ai/api/v1
+# OPENROUTER_MAX_TOKENS=2400
+# Pin one serving endpoint. OpenRouter routes a model across many hosts that differ in
+# latency, price and output quality; see the benchmark section in README.md. List the tags
+# with GET https://openrouter.ai/api/v1/models/<author>/<slug>/endpoints. Leave empty for
+# OpenRouter's own blended routing.
+# OPENROUTER_PROVIDER=google-ai-studio/flex
+# true keeps the pin a preference, so a dead endpoint falls back instead of erroring.
+# false pins hard: predictable cost and latency, but outages become visible failures.
+# OPENROUTER_ALLOW_FALLBACKS=true
+# Data policy for every OpenRouter call (both tiers): deny routes only to endpoints that
+# do not store or train on requests (fewer endpoints; a pin that does not qualify falls
+# back, or fails with ALLOW_FALLBACKS=false), allow permits them. Empty sends nothing, so
+# your OpenRouter account setting applies.
+# OPENROUTER_DATA_COLLECTION=
+# Reasoning effort (none/minimal/low/medium/high). Leave empty for models without a
+# reasoning control. Gemini 3.x cannot turn thinking off; minimal keeps it fast.
+# OPENROUTER_REASONING_EFFORT=minimal
+# Pro tier (-ip- / --tier pro): a reasoning model for hard, multi-part drafts.
+# OPENROUTER_PRO_MODEL=openai/gpt-6-luna
+# OPENROUTER_PRO_PROVIDER=openai
+# OPENROUTER_PRO_REASONING_EFFORT=low
+# Output cap for the pro tier only (its reasoning counts against it). Empty uses
+# OPENROUTER_MAX_TOKENS for both tiers.
+# OPENROUTER_PRO_MAX_TOKENS=
+
+# Anthropic / Claude (cloud). Leave key empty unless policy permits cloud use.
+# ANTHROPIC_API_KEY=
+# ANTHROPIC_MODEL=claude-sonnet-5
+# ANTHROPIC_BASE_URL=https://api.anthropic.com
+# ANTHROPIC_MAX_TOKENS=2400
+
+# Set true only to allow cloud calls on every flagged draft, permanently. To send one draft
+# whose findings are only labels, IDs, emails or IBANs, use the -iok- trigger instead.
+# ALLOW_CLOUD_OVERRIDE=false
+# Set true to refuse every provider that can send the draft off this machine (-i-, -ip-, -if-,
+# -iok-, -ic-, and local providers pointed elsewhere); -il- and -ilm- on localhost keep working.
+# PROMPT_LOCAL_ONLY=false
+# Set true when your localhost Ollama / LM Studio is a relay to a cloud API (LiteLLM, an SSH
+# tunnel), or when OLLAMA_MODEL is a local alias of a cloud model (made with ollama cp, so its
+# name has no cloud tag and counts as local): -il- and -ilm- then
+# run the gate too. PROMPT_LOCAL_ONLY still allows them.
+# PROMPT_GATE_LOCAL=false
+# Your own ;-separated, case-insensitive regexes the gate also blocks on, e.g. project code
+# names or customer-ID formats. Write a literal ; as \x3b. An invalid regex is rejected when
+# settings load. Each pattern runs on every draft and on every value written to the usage
+# history: avoid nested quantifiers such as (\w+\s?)+, which can take exponential time and
+# stall the trigger; use a literal, a fixed count (\d{6}) or a bounded repeat (\w{1,20}).
+# PROMPT_EXTRA_PATTERNS=
+# PROMPT_EXTRA_PATTERNS="project[- ]falcon;CUST-\d{6}"
+
+# Local usage history: metadata only (trigger, model, tokens, reported cost, latency), never
+# your draft, rewrite, persona or keys; kept on this device in ~/.local/share/promptmend
+# (%LOCALAPPDATA%\promptmend on Windows). false keeps no history.
+# PROMPT_HISTORY=true
+# Days a history record is kept (1 to 36500); each recorded run prunes older ones.
+# PROMPT_HISTORY_RETENTION_DAYS=365
+
+# The full-screen interface (`promptmend ui`) opens with a short intro; false skips it
+# (as `promptmend ui --no-intro` does). The triggers never read this.
+# PROMPT_UI_INTRO=true

promptmend-0.19.0/.gitattributes

@@ -0,0 +1,3 @@
+# LF everywhere, on every OS: a CRLF install_macos.sh fails in bash, and the match files
+# and prompts are deployed byte for byte. PowerShell 5.1 and Espanso both read LF.
+* text=auto eol=lf

promptmend-0.19.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,51 @@
+name: Bug report
+description: Something does not work as documented
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please do not paste API keys, customer data or confidential drafts. Replace them with fake
+        values. Security problems belong in a private report (see SECURITY.md).
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: "Include the exact `[promptmend: …]` message if you got one."
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What you expected
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Trigger or CLI command, provider, profile, and a fake draft that shows the problem.
+      placeholder: |
+        1. echo "…" | promptmend improve --provider openrouter --source stdin
+        2. …
+    validations:
+      required: true
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options: [macOS, Windows, Linux]
+    validations:
+      required: true
+  - type: dropdown
+    id: provider
+    attributes:
+      label: Provider
+      options: [openrouter, anthropic, ollama, lmstudio, not provider related]
+    validations:
+      required: true
+  - type: input
+    id: versions
+    attributes:
+      label: Versions
+      description: "Output of `uv tool list | grep promptmend` and `espanso --version`, plus the model if relevant."

promptmend-0.19.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/vlastimilbures/promptmend/security/advisories/new
+    about: Gate bypasses, key exposure and other vulnerabilities. Please report privately.

promptmend-0.19.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,21 @@
+name: Feature request
+description: Suggest a trigger, profile, provider or improvement
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What are you trying to do, and what gets in the way today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered

promptmend-0.19.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,17 @@
+## What and why
+
+<!-- What does this change, and what problem does it solve? Link the issue if there is one. -->
+
+## How it was tested
+
+<!-- Commands you ran. For prompt or provider changes, include `pytest -m live` and benchmark
+     before/after pass rates. -->
+
+## Checklist
+
+- [ ] `uv run pytest`, `uv run ruff check .`, `uv run ruff format --check .` and `uv run mypy` pass
+- [ ] Tests added or updated for the behaviour change
+- [ ] Cloud providers are built only through `factory.make_provider()` (gate intact)
+- [ ] CLI output keeps the Espanso contract: no trailing newline, errors as `[promptmend: …]`
+- [ ] CHANGELOG.md updated under *Unreleased* if users would notice
+- [ ] No real keys, customer data or confidential text anywhere in the diff

promptmend-0.19.0/.github/copilot-instructions.md

@@ -0,0 +1,23 @@
+# Repository instructions
+
+`CLAUDE.md` at the repository root is the source of truth for this repository's architecture,
+commands and rules; read it before changing code. `CONTRIBUTING.md` has the checks and ground
+rules. The invariants below must never be broken:
+
+- The CLI prints only through `cli._emit()` (no trailing newline); every failure is a
+  `[promptmend: ...]` marker on stdout with exit code 0, never a traceback.
+- Build every provider with `factory.make_provider()`, which wraps any call that can leave the
+  machine in the data-protection gate. The only overrides are `ALLOW_CLOUD_OVERRIDE=true` and
+  `--allow-flagged` (one call, soft findings only); never add a code path around the gate.
+- Every Espanso match that runs the CLI sets `force_mode: clipboard`, and every match sets
+  `left_word: true`.
+- Match commands start with the quoted `"__PROMPT_WORKFLOW__"` placeholder and quote nothing
+  else; nothing is ever deployed to Espanso's `config/` folder.
+- Keep existing triggers working and every feature cross-platform (macOS and Windows); a
+  renamed or removed trigger needs a migration note and a test.
+- Never put API keys, customer data, credentials or confidential prompts in source, tests,
+  logs or commits.
+- Tests stay offline: never call external APIs from unit tests; mock the HTTP client.
+- Update README.md and the CHANGELOG `## Unreleased` section with every user-visible change.
+- Do not run the paid bench (`scripts/bench_models.py`), `pytest -m live`, the installers or
+  `espanso` commands unless asked.

promptmend-0.19.0/.github/dependabot.yml

@@ -0,0 +1,32 @@
+# Actions and pre-commit hooks are pinned to commit SHAs; Dependabot keeps those pins and
+# uv.lock current. The cooldown skips releases younger than a week, the window in which a
+# hijacked package is usually caught and yanked; security updates are not delayed by it.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      python:
+        patterns: ["*"]
+  - package-ecosystem: pre-commit
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      pre-commit:
+        patterns: ["*"]

promptmend-0.19.0/.github/workflows/release.yml

@@ -0,0 +1,287 @@
+name: release
+# Builds the sdist, the wheel and constraints.txt (the runtime pins from uv.lock), installs the
+# wheel with those pins into a clean venv on every OS, then attests the files and creates the
+# annotated tag v<version> and a GitHub Release with that version's CHANGELOG notes. While the
+# repository variable PYPI_PUBLISH is "true", the same sdist and wheel then go to PyPI through
+# trusted publishing (the pypi job, in the GitHub environment "pypi").
+#
+# A release happens only for the current head of main, when its pyproject version has no
+# published Release yet:
+# - manual dispatch with dry-run unticked (dry-run is the default: it builds and tests, nothing more);
+# - a push to main, only while the repository variable RELEASE_ON_PUSH is "true", so merging
+#   a branch never releases by surprise.
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: "Build and test the artifacts only: no attestation, tag or Release"
+        type: boolean
+        default: true
+permissions: {}
+jobs:
+  plan:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      version: ${{ steps.plan.outputs.version }}
+      build: ${{ steps.plan.outputs.build }}
+      release: ${{ steps.plan.outputs.release }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Decide whether to release
+        id: plan
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT: ${{ github.event_name }}
+          DRY_RUN: ${{ inputs.dry-run }}
+          RELEASE_ON_PUSH: ${{ vars.RELEASE_ON_PUSH }}
+        run: |
+          # Fails unless the newest CHANGELOG section is the pyproject version, dated.
+          version=$(python3 scripts/release_notes.py version)
+          tag="v$version"
+          # A draft is invisible to this read-only token; the release job picks it up again.
+          if published=$(gh release view "$tag" --repo "$GITHUB_REPOSITORY" --json isDraft \
+              --jq '.isDraft | not' 2> "$RUNNER_TEMP/err"); then :
+          elif grep -q "release not found" "$RUNNER_TEMP/err"; then published=false
+          else cat "$RUNNER_TEMP/err" >&2; exit 1
+          fi
+          head=$(gh api "repos/$GITHUB_REPOSITORY/commits/main" --jq .sha)
+          build=false
+          release=false
+          if [ "$EVENT" = workflow_dispatch ]; then build=true; fi
+          if [ "$published" = true ]; then
+            echo "::notice::$tag is already released; nothing to release."
+          elif [ "$GITHUB_REF" != refs/heads/main ] || [ "$GITHUB_SHA" != "$head" ]; then
+            echo "::notice::$tag is released only from the head of main ($head), not $GITHUB_REF at $GITHUB_SHA."
+          elif [ "$EVENT" = workflow_dispatch ] && [ "$DRY_RUN" = true ]; then
+            echo "::notice::Dry run: $tag is built and tested, not released."
+          elif [ "$EVENT" = workflow_dispatch ]; then
+            release=true
+          elif [ "$EVENT" = push ] && [ "$RELEASE_ON_PUSH" = true ]; then
+            build=true
+            release=true
+          else
+            echo "::notice::$tag is not released yet: run the release workflow with dry-run unticked."
+          fi
+          {
+            echo "version=$version"
+            echo "build=$build"
+            echo "release=$release"
+          } >> "$GITHUB_OUTPUT"
+
+  build:
+    needs: plan
+    if: needs.plan.outputs.build == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      # No cache in a workflow that publishes: a poisoned cache could reach the artifacts.
+      - name: Set up uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        with:
+          python-version: "3.12"
+          enable-cache: false
+      - name: Build sdist, wheel and constraints
+        run: |
+          uv build --out-dir dist
+          uv export --frozen --no-dev --no-emit-project --no-hashes --output-file dist/constraints.txt
+      - name: Upload the artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  # The wheel goes into a clean venv outside the checkout, pinned by the constraints.txt being
+  # released, so the check covers what a user installs (see the wheel job in test.yml).
+  test-artifacts:
+    needs: [plan, build]
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: true
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python-version: ["3.12", "3.14"]
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: pwsh
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          enable-cache: false
+      - name: Download the artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: dist
+          path: ${{ runner.temp }}/dist
+      - name: Install the wheel with the constraints into a clean venv and check it
+        working-directory: ${{ runner.temp }}
+        env:
+          VERSION: ${{ needs.plan.outputs.version }}
+          PYTHON_VERSION: ${{ matrix.python-version }}
+        run: |
+          $PSNativeCommandUseErrorActionPreference = $true
+          $dist = Join-Path $env:RUNNER_TEMP "dist"
+          $wheel = (Get-ChildItem "$dist/*.whl" | Select-Object -First 1).FullName
+          $constraints = Join-Path $dist "constraints.txt"
+          $venv = Join-Path $env:RUNNER_TEMP "wheel-venv"
+          uv venv --python $env:PYTHON_VERSION $venv
+          uv pip install --python $venv $wheel -c $constraints
+          $python = if ($IsWindows) { "$venv/Scripts/python.exe" } else { "$venv/bin/python" }
+          $cli = if ($IsWindows) { "$venv/Scripts/promptmend.exe" } else { "$venv/bin/promptmend" }
+          $installed = & $cli --version
+          if ($installed -ne $env:VERSION) { throw "installed $installed, expected $env:VERSION" }
+          & $python "$env:GITHUB_WORKSPACE/scripts/check_wheel.py" --repo $env:GITHUB_WORKSPACE --wheel $wheel --constraints $constraints
+
+  release:
+    needs: [plan, build, test-artifacts]
+    if: needs.plan.outputs.release == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    # One release at a time, never cancelled half way between the tag and the Release.
+    concurrency:
+      group: release
+      cancel-in-progress: false
+    # The only job that can write to the repository: the tag, the Release and the attestations.
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Download the artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: dist
+          path: dist
+      - name: Attest build provenance
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6  # v4.2.2
+        with:
+          subject-path: dist/*
+      # The tag is made through the API, so no git credentials are stored in the checkout.
+      # The Release starts as a draft and is published once every file is attached: with
+      # immutable releases enabled in the repository, publishing is what locks it. A run that
+      # failed half way can be re-run: an annotated tag already on this commit and a draft
+      # Release are reused.
+      - name: Create the annotated tag and the Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.plan.outputs.version }}
+        run: |
+          tag="v$VERSION"
+          repo="$GITHUB_REPOSITORY"
+          head=$(gh api "repos/$repo/commits/main" --jq .sha)
+          if [ "$GITHUB_SHA" != "$head" ]; then
+            echo "::error::main moved on to $head while $GITHUB_SHA was tested; not releasing."
+            exit 1
+          fi
+          python3 scripts/release_notes.py notes > "$RUNNER_TEMP/notes.md"
+
+          ref=$(gh api "repos/$repo/git/matching-refs/tags/$tag" \
+            --jq "map(select(.ref == \"refs/tags/$tag\")) | .[0] // empty | .object.type + \" \" + .object.sha")
+          if [ -z "$ref" ]; then
+            tag_sha=$(gh api "repos/$repo/git/tags" -f tag="$tag" -f message="Release $VERSION" \
+              -f object="$GITHUB_SHA" -f type=commit --jq .sha)
+            gh api "repos/$repo/git/refs" -f ref="refs/tags/$tag" -f sha="$tag_sha" > /dev/null
+          else
+            read -r type sha <<< "$ref"
+            target=""
+            if [ "$type" = tag ]; then target=$(gh api "repos/$repo/git/tags/$sha" --jq .object.sha); fi
+            if [ "$target" != "$GITHUB_SHA" ]; then
+              echo "::error::$tag already exists as a $type ($sha), not an annotated tag of $GITHUB_SHA."
+              exit 1
+            fi
+            echo "::notice::Reusing the annotated tag $tag."
+          fi
+
+          if draft=$(gh release view "$tag" --repo "$repo" --json isDraft --jq .isDraft 2> "$RUNNER_TEMP/err"); then :
+          elif grep -q "release not found" "$RUNNER_TEMP/err"; then draft=none
+          else cat "$RUNNER_TEMP/err" >&2; exit 1
+          fi
+          case "$draft" in
+            none)
+              gh release create "$tag" --repo "$repo" --verify-tag --draft \
+                --title "$tag" --notes-file "$RUNNER_TEMP/notes.md" dist/* ;;
+            true)
+              echo "::notice::Reusing the draft Release $tag."
+              gh release edit "$tag" --repo "$repo" --title "$tag" --notes-file "$RUNNER_TEMP/notes.md"
+              gh release upload "$tag" --repo "$repo" --clobber dist/* ;;
+            *)
+              echo "::error::$tag is already published."
+              exit 1 ;;
+          esac
+
+          # Latest only if no published Release has a higher version.
+          newest=$( { gh release list --repo "$repo" --exclude-drafts --limit 1000 \
+            --json tagName --jq '.[].tagName'; echo "$tag"; } | sort -V | tail -n 1)
+          latest=false
+          if [ "$newest" = "$tag" ]; then latest=true; fi
+          gh release edit "$tag" --repo "$repo" --draft=false --latest="$latest"
+
+  # PyPI, after the Release is published, with the very sdist and wheel the release job attested
+  # (the artifact of this run, never a rebuild). Off until the owner sets PYPI_PUBLISH to "true"
+  # and registers this workflow and the environment "pypi" as a trusted publisher on PyPI, so a
+  # release keeps working before that. It holds no repository permission, only the OIDC token
+  # PyPI exchanges for a short-lived upload token; no API token is stored anywhere. If it fails,
+  # "Re-run failed jobs" uploads the same files again (skip-existing: files PyPI already has
+  # are left alone). A fresh run for a published version stops at plan, so it never re-uploads.
+  pypi:
+    needs: [plan, release]
+    if: needs.plan.outputs.release == 'true' && vars.PYPI_PUBLISH == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    concurrency:
+      group: pypi
+      cancel-in-progress: false
+    environment:
+      name: pypi
+      url: https://pypi.org/project/promptmend/${{ needs.plan.outputs.version }}/
+    permissions:
+      id-token: write
+    steps:
+      - name: Download the artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: dist
+          path: ${{ runner.temp }}/artifacts
+      # Exactly the sdist and the wheel of this version; constraints.txt stays on the Release.
+      - name: Pick the sdist and the wheel
+        env:
+          VERSION: ${{ needs.plan.outputs.version }}
+        run: |
+          mkdir "$RUNNER_TEMP/pypi"
+          for name in "promptmend-$VERSION.tar.gz" \
+              "promptmend-$VERSION-py3-none-any.whl"; do
+            cp "$RUNNER_TEMP/artifacts/$name" "$RUNNER_TEMP/pypi/"
+          done
+          ls -l "$RUNNER_TEMP/pypi"
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
+        with:
+          packages-dir: ${{ runner.temp }}/pypi
+          skip-existing: true

promptmend-0.19.0/.github/workflows/secret-scan.yml

@@ -0,0 +1,25 @@
+name: secret-scan
+on:
+  # Every branch: a secret pushed anywhere is already public.
+  push:
+  pull_request:
+permissions:
+  contents: read
+  # gitleaks-action lists a pull request's commits to scan only those.
+  pull-requests: read
+concurrency:
+  group: secret-scan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e  # v3.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}