rockycode 0.1.0__tar.gz → 0.1.2__tar.gz

{rockycode-0.1.0 → rockycode-0.1.2}/.github/workflows/ci.yml

@@ -23,5 +23,8 @@ jobs:
       - name: Sync deps from the lockfile
         run: uv sync --frozen
 
+      - name: Ruff (conservative correctness gate)
+        run: uv run ruff check .
+
       - name: Smoke tests (the CORE gate)
         run: uv run python tests/run_all.py

rockycode-0.1.2/.github/workflows/release.yml

@@ -0,0 +1,27 @@
+name: Release
+
+# One job: build sdist+wheel on ubuntu, publish to PyPI via Trusted Publishing.
+# The old macos-13 matrix (built a cbor2 x86_64-mac wheel for the release page)
+# is gone: the runner label was retired, so it never actually ran — 0.1.0 and
+# 0.1.1 both sat in its queue until cancelled and shipped fine without it — and
+# cbor2 still publishes no x86_64-mac wheel to attach anyway (arm64 only; an
+# Intel-Mac install builds it from source via Rust, PyPI-side, as it always
+# has). GitHub releases are created by hand: gh release create --notes-file.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+jobs:
+  pypi:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write            # OIDC — this is what Trusted Publishing uses
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v5
+      - name: Build rockycode (sdist + wheel — only our project lands in dist/)
+        run: uv build
+      - name: Publish to PyPI (Trusted Publishing, no token)
+        uses: pypa/gh-action-pypi-publish@release/v1

rockycode-0.1.2/CHANGELOG.md

@@ -0,0 +1,61 @@
+# Changelog
+
+All notable changes to rockycode are recorded here. The format follows
+[Keep a Changelog](https://keepachangelog.com/), and the project follows
+[Semantic Versioning](https://semver.org/) — pre-1.0, so the surface may still
+change between minor versions.
+
+## [Unreleased]
+
+_Nothing yet._
+
+## [0.1.2] — `--version` flag, GA price tables
+
+### Added
+- `rockycode --version` / `-V` prints the installed version. One version
+  source: package metadata (pyproject) — the serve handshake reports the same
+  value instead of a hardcoded string.
+
+### Changed
+- DeepSeek price tables refreshed to the GA snapshots (V4-Flash-0731 /
+  V4-Pro-0813), both USD and CNY, verified 2026-08-20 at the source;
+  peak-valley billing confirmed live (2× in the published UTC windows).
+- README results updated: `deepseek-v4-flash` GA carries three clean full-500
+  SWE-bench Verified rounds (88.8% average, 95.4% pass@3); the
+  `deepseek-v4-pro` column is explicitly marked preview (pre-0813).
+
+### CI
+- Release workflow reduced to the single ubuntu PyPI Trusted-Publishing job;
+  the dead macos-13 matrix (retired runner, never ran) is gone.
+
+## [0.1.1] — session artifacts, images in chat, real sandbox cancel
+
+### Added
+- Images in chat: paste (`ctrl+v` / `/paste`) or drag an image in. Vision models
+  see it raw; no-vision models route through a provider sidecar, your own image
+  CLI, or a `view_image` tool — picked once, remembered. Known CLIs set up with
+  one word (`/config image_cli mmx` — rocky knows the invocation).
+- Session artifact inventory: `/artifact list · open <n> · stop · live on|off`,
+  a footer badge with open-tab counts, and an Artifacts tree in the VS Code
+  extension fed live by `rockycode serve`.
+- Bare `/model` opens a live provider + model picker.
+
+### Fixed
+- Live artifacts no longer drop and reconnect every 30 s; the artifact server
+  stops/restarts cleanly and rebinds saved live pages to the new port.
+- Sandbox cancel/timeout kills the in-container process group, not just the
+  host-side docker client; images without `python3` fall back to plain `bash -c`.
+- Resume self-heals after a hard kill; closing the doc dock no longer wedges the TUI.
+
+### Internal
+- CI: conservative ruff correctness gate (pinned `0.16.1`) ahead of the smoke suite.
+
+## [0.1.0] — first public release
+
+Initial public release. One repo, one engine, three ways to use it — interactive
+`chat`, autonomous `goal`, and the `bench` measurement rig — running on DeepSeek
+or any OpenAI-compatible model.
+
+Some capabilities ship as **experimental and default-off** (self-improvement,
+`prove` / `lean-prover`, `explore`, and providers other than DeepSeek); see the
+README's Experimental section for what they are and how to enable them.

{rockycode-0.1.0 → rockycode-0.1.2}/CONTRIBUTING.md

@@ -40,7 +40,7 @@ rockycode goal "…"             # autonomous run (sandboxed worktree copy)
 ## Before you open a PR
 
 1. **Run the test suite** — `python tests/run_all.py`. It should be green.
-2. **Lint** — `ruff check .` (config is in `pyproject.toml`).
+2. **Lint** — `uv run ruff check .` (pinned version and conservative rules are in `pyproject.toml`).
 3. **Match the surrounding code.** Read the file you're editing and mirror its
    naming, comment density, and idioms. New code should be indistinguishable in
    style from what's around it.

{rockycode-0.1.0 → rockycode-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: rockycode
-Version: 0.1.0
+Version: 0.1.2
 Summary: A coding agent harness, benchmarked on SWE-bench Verified. amaze!
 Author: rockycode contributors
 License: MIT
@@ -42,7 +42,8 @@ Built for the DeepSeek V4 series, with a unique research mode, bench-tested, and
 
 [English](README.md) · [简体中文](README.zh-CN.md)
 
-![SWE-bench Verified](https://img.shields.io/badge/SWE--bench_Verified-~80%25_100--task_slice-7d5cc6)
+![SWE-bench Verified](https://img.shields.io/badge/SWE--bench_Verified-88.8%25_V4--flash_GA-7d5cc6)
+![V4-pro preview](https://img.shields.io/badge/V4--pro_preview-74.9%25-8d6cd0)
 ![Python](https://img.shields.io/badge/Python-3.11%2B-9d7cd8)
 ![License](https://img.shields.io/badge/License-MIT-a9b1d6)
 
@@ -76,17 +77,36 @@ against it.
 
 ## Results — SWE-bench Verified
 
-On SWE-bench Verified, a **randomly-chosen 100-task slice** (resources are
-limited — no repeated runs averaged over the full 500):
-
-**Result: ≈80% on a 100-task SWE-bench Verified slice** with `deepseek-v4-pro`,
-no tuning against those tasks — the mean of a four-arm configuration sweep.
-
-Read it with its limits. It's a representative **random 100-task slice**, not
-the official 500-task Verified set: its harder 20-task core scored 60–70% while
-the other 80 scored >80%. Treat it as an honest internal measurement, not a
-leaderboard entry; for the full breakdown, follow our X
-([@rockycode_ai](https://x.com/rockycode_ai)).
+Full-set numbers: **independent full-500 runs**, three rounds per model, same
+harness and config for all (100-step cap, 32,768 max output tokens, reasoning
+effort `max`, thinking on), scored with the official SWE-bench harness. No
+tuning against the tasks. Mind the versions: the `deepseek-v4-flash` column is
+the **GA release** (V4-Flash-0731), while the `deepseek-v4-pro` rounds ran
+before the GA V4-Pro-0813 shipped — that column is the **preview** pro, so the
+flash/pro gap reflects a version difference, not a same-vintage comparison.
+
+| run | `deepseek-v4-flash` (GA) | `deepseek-v4-pro` (preview) | `minimax-m3` |
+|---|---|---|---|
+| round 1 | 90.0% (450/500) | 75.6% (378/500) | 72.8% (364/500) |
+| round 2 | 88.6% (443/500) | 74.8% (374/500) | 71.2% (356/500) |
+| round 3 | 87.8% (439/500) | 74.4% (372/500) | 70.0% (350/500) |
+| **average** | **88.8%** | **74.9%** | **71.3%** |
+| union of runs (pass@3) | 95.4% (477/500) | 81.8% (409/500) | 83.6% (418/500) |
+
+Read the two summary rows differently. The **average** is the
+leaderboard-comparable number — each round is an independent single-pass run
+over the full 500. The **union** is pass@3: tasks solved by at least one
+round. The gap between them (~7 points for both DeepSeek models, ~12 for
+MiniMax) is run-to-run variance, not capability — the models already reach
+these tasks under this harness, they just don't hold them every run. Closing
+that gap (verify-before-finish gating and run selection, not more prompting)
+is the current line of work. For reference, DeepSeek reported 80.6% for V4
+Pro (Preview) with its own scaffold. Per-round breakdowns:
+[@rockycode_ai](https://x.com/rockycode_ai).
+
+Two earlier flash rounds (79.8% — previously listed here — and 81.2%) hit
+local network outages mid-run, visible as contiguous blocks of empty-patch
+tasks; they were replaced by clean re-runs rather than averaged in.
 
 We plan to add **DeepSWE-bench** support as well — currently in progress.
 
@@ -102,10 +122,42 @@ in a container: `goal` (autonomous runs), `exec` (headless delegation),
 run offline in the sandbox by design, so a delegated or unattended task cannot
 touch your host or reach the network.
 
+```bash
+uv tool install rockycode     # recommended — puts the `rockycode` command on your PATH
+rockycode                     # the first run walks you through API-key setup
+```
+
+Already installed and a new release is out? **`uv tool upgrade rockycode`** —
+note that re-running `uv tool install` does NOT upgrade: it sees the existing
+install and quietly keeps the old version.
+
+Don't have uv yet? One command installs it:
+`curl -LsSf https://astral.sh/uv/install.sh | sh` — Windows and other options
+in the [uv install docs](https://docs.astral.sh/uv/getting-started/installation/).
+
+Three ways to install — they look similar but land in different places:
+
+- **`uv tool install rockycode`** (recommended) — gives the CLI its own
+  isolated environment and puts `rockycode` on your PATH; if your system
+  Python is older than 3.11, uv fetches a matching interpreter by itself.
+  The "install it like an app" path.
+- **`uv pip install rockycode`** — installs into the **currently active
+  virtual environment** only: the `rockycode` command exists inside that
+  venv, so a new shell won't find it unless the venv is active (or run it
+  as `uv run rockycode`).
+- **`pip install rockycode`** — same venv caveat as above, and it needs
+  Python 3.11+. On an older Python it fails with the misleading
+  `ERROR: No matching distribution found for rockycode`. Why: pip only
+  offers releases whose `requires-python` matches your interpreter, so on an
+  old Python it sees no installable version at all and reports that as a
+  missing package. If you hit this, don't fight it — use
+  `uv tool install rockycode` above; uv brings its own Python 3.11+.
+
+Or install from source:
+
 ```bash
 git clone https://github.com/cicialgo/rockycode.git && cd rockycode
-uv tool install .      # puts the `rockycode` command on your PATH
-rockycode              # the first run walks you through API-key setup
+uv tool install .
 ```
 
 On first launch you paste your API key once. It is stored in the OS keychain
@@ -157,7 +209,8 @@ clipboard" (or your terminal's equivalent) on the local end.
 | `/permission yolo\|ask\|careful` | Tool-approval strictness for the session |
 | `/sandbox on\|off\|status` | Isolate tool execution in a container |
 | `/lsp` | Language-server status; diagnostics ride along with `read_file` |
-| `/artifact live on\|off` | Auto-refresh HTML artifacts in the browser |
+| `/artifact` | Session artifacts: `list` · `open <n>` · `stop` · `live on\|off` |
+| `/paste` | Attach a clipboard image (or `ctrl+v`); no-vision models pick a route |
 | `/prompt` | Inspect the live system prompt |
 | `/mcp` | Connected MCP servers and their tools |
 | `/skills` | Installed skills |
@@ -191,7 +244,7 @@ OpenAI-compatible API.
 
 | Provider | Models |
 |---|---|
-| **deepseek** (default) | `deepseek-v4-pro`, `deepseek-v4-flash` |
+| **deepseek** (default) | `deepseek-v4-flash` (default), `deepseek-v4-pro` (preview) |
 | **minimax** | `minimax-m3` |
 | **kimi** | `kimi-k3` |
 | **glm** | `glm-5.2` |
@@ -199,8 +252,9 @@ OpenAI-compatible API.
 Regional endpoints are addressable as `<provider>-<region>` (e.g. `kimi-cn`),
 and custom providers — including local vLLM/SGLang servers — go in
 `~/.rockycode/providers.toml`. The `/model` picker only offers providers whose
-keys are actually configured. Only DeepSeek is verified on the harness; the
-others are [experimental](#experimental).
+keys are actually configured. DeepSeek and MiniMax both carry full-500 bench
+numbers (see [Results](#results--swe-bench-verified)); Kimi and GLM are
+[experimental](#experimental).
 
 The effort dial (`/effort off|high|xhigh|max`) is provider-neutral; each
 provider maps it to its own reasoning tiers at the wire (DeepSeek, for
@@ -294,8 +348,9 @@ change. Anything that could act on its own is **off by default**.
   mechanically-verified report; the search noise never enters your session. It
   also grounds goal mode's branch review and milestone verification.
 - **Providers beyond DeepSeek.** MiniMax, GLM / z.ai, and Kimi are wired as
-  OpenAI-compatible profiles (`/model`), but only DeepSeek is verified on the
-  harness — treat the others as untested until they carry a bench number.
+  OpenAI-compatible profiles (`/model`). DeepSeek and MiniMax carry full
+  bench numbers (see Results); treat GLM and Kimi as untested until they do
+  too.
 
 ## Works with your existing setup
 

{rockycode-0.1.0 → rockycode-0.1.2}/README.md

@@ -9,7 +9,8 @@ Built for the DeepSeek V4 series, with a unique research mode, bench-tested, and
 
 [English](README.md) · [简体中文](README.zh-CN.md)
 
-![SWE-bench Verified](https://img.shields.io/badge/SWE--bench_Verified-~80%25_100--task_slice-7d5cc6)
+![SWE-bench Verified](https://img.shields.io/badge/SWE--bench_Verified-88.8%25_V4--flash_GA-7d5cc6)
+![V4-pro preview](https://img.shields.io/badge/V4--pro_preview-74.9%25-8d6cd0)
 ![Python](https://img.shields.io/badge/Python-3.11%2B-9d7cd8)
 ![License](https://img.shields.io/badge/License-MIT-a9b1d6)
 
@@ -43,17 +44,36 @@ against it.
 
 ## Results — SWE-bench Verified
 
-On SWE-bench Verified, a **randomly-chosen 100-task slice** (resources are
-limited — no repeated runs averaged over the full 500):
-
-**Result: ≈80% on a 100-task SWE-bench Verified slice** with `deepseek-v4-pro`,
-no tuning against those tasks — the mean of a four-arm configuration sweep.
-
-Read it with its limits. It's a representative **random 100-task slice**, not
-the official 500-task Verified set: its harder 20-task core scored 60–70% while
-the other 80 scored >80%. Treat it as an honest internal measurement, not a
-leaderboard entry; for the full breakdown, follow our X
-([@rockycode_ai](https://x.com/rockycode_ai)).
+Full-set numbers: **independent full-500 runs**, three rounds per model, same
+harness and config for all (100-step cap, 32,768 max output tokens, reasoning
+effort `max`, thinking on), scored with the official SWE-bench harness. No
+tuning against the tasks. Mind the versions: the `deepseek-v4-flash` column is
+the **GA release** (V4-Flash-0731), while the `deepseek-v4-pro` rounds ran
+before the GA V4-Pro-0813 shipped — that column is the **preview** pro, so the
+flash/pro gap reflects a version difference, not a same-vintage comparison.
+
+| run | `deepseek-v4-flash` (GA) | `deepseek-v4-pro` (preview) | `minimax-m3` |
+|---|---|---|---|
+| round 1 | 90.0% (450/500) | 75.6% (378/500) | 72.8% (364/500) |
+| round 2 | 88.6% (443/500) | 74.8% (374/500) | 71.2% (356/500) |
+| round 3 | 87.8% (439/500) | 74.4% (372/500) | 70.0% (350/500) |
+| **average** | **88.8%** | **74.9%** | **71.3%** |
+| union of runs (pass@3) | 95.4% (477/500) | 81.8% (409/500) | 83.6% (418/500) |
+
+Read the two summary rows differently. The **average** is the
+leaderboard-comparable number — each round is an independent single-pass run
+over the full 500. The **union** is pass@3: tasks solved by at least one
+round. The gap between them (~7 points for both DeepSeek models, ~12 for
+MiniMax) is run-to-run variance, not capability — the models already reach
+these tasks under this harness, they just don't hold them every run. Closing
+that gap (verify-before-finish gating and run selection, not more prompting)
+is the current line of work. For reference, DeepSeek reported 80.6% for V4
+Pro (Preview) with its own scaffold. Per-round breakdowns:
+[@rockycode_ai](https://x.com/rockycode_ai).
+
+Two earlier flash rounds (79.8% — previously listed here — and 81.2%) hit
+local network outages mid-run, visible as contiguous blocks of empty-patch
+tasks; they were replaced by clean re-runs rather than averaged in.
 
 We plan to add **DeepSWE-bench** support as well — currently in progress.
 
@@ -69,10 +89,42 @@ in a container: `goal` (autonomous runs), `exec` (headless delegation),
 run offline in the sandbox by design, so a delegated or unattended task cannot
 touch your host or reach the network.
 
+```bash
+uv tool install rockycode     # recommended — puts the `rockycode` command on your PATH
+rockycode                     # the first run walks you through API-key setup
+```
+
+Already installed and a new release is out? **`uv tool upgrade rockycode`** —
+note that re-running `uv tool install` does NOT upgrade: it sees the existing
+install and quietly keeps the old version.
+
+Don't have uv yet? One command installs it:
+`curl -LsSf https://astral.sh/uv/install.sh | sh` — Windows and other options
+in the [uv install docs](https://docs.astral.sh/uv/getting-started/installation/).
+
+Three ways to install — they look similar but land in different places:
+
+- **`uv tool install rockycode`** (recommended) — gives the CLI its own
+  isolated environment and puts `rockycode` on your PATH; if your system
+  Python is older than 3.11, uv fetches a matching interpreter by itself.
+  The "install it like an app" path.
+- **`uv pip install rockycode`** — installs into the **currently active
+  virtual environment** only: the `rockycode` command exists inside that
+  venv, so a new shell won't find it unless the venv is active (or run it
+  as `uv run rockycode`).
+- **`pip install rockycode`** — same venv caveat as above, and it needs
+  Python 3.11+. On an older Python it fails with the misleading
+  `ERROR: No matching distribution found for rockycode`. Why: pip only
+  offers releases whose `requires-python` matches your interpreter, so on an
+  old Python it sees no installable version at all and reports that as a
+  missing package. If you hit this, don't fight it — use
+  `uv tool install rockycode` above; uv brings its own Python 3.11+.
+
+Or install from source:
+
 ```bash
 git clone https://github.com/cicialgo/rockycode.git && cd rockycode
-uv tool install .      # puts the `rockycode` command on your PATH
-rockycode              # the first run walks you through API-key setup
+uv tool install .
 ```
 
 On first launch you paste your API key once. It is stored in the OS keychain
@@ -124,7 +176,8 @@ clipboard" (or your terminal's equivalent) on the local end.
 | `/permission yolo\|ask\|careful` | Tool-approval strictness for the session |
 | `/sandbox on\|off\|status` | Isolate tool execution in a container |
 | `/lsp` | Language-server status; diagnostics ride along with `read_file` |
-| `/artifact live on\|off` | Auto-refresh HTML artifacts in the browser |
+| `/artifact` | Session artifacts: `list` · `open <n>` · `stop` · `live on\|off` |
+| `/paste` | Attach a clipboard image (or `ctrl+v`); no-vision models pick a route |
 | `/prompt` | Inspect the live system prompt |
 | `/mcp` | Connected MCP servers and their tools |
 | `/skills` | Installed skills |
@@ -158,7 +211,7 @@ OpenAI-compatible API.
 
 | Provider | Models |
 |---|---|
-| **deepseek** (default) | `deepseek-v4-pro`, `deepseek-v4-flash` |
+| **deepseek** (default) | `deepseek-v4-flash` (default), `deepseek-v4-pro` (preview) |
 | **minimax** | `minimax-m3` |
 | **kimi** | `kimi-k3` |
 | **glm** | `glm-5.2` |
@@ -166,8 +219,9 @@ OpenAI-compatible API.
 Regional endpoints are addressable as `<provider>-<region>` (e.g. `kimi-cn`),
 and custom providers — including local vLLM/SGLang servers — go in
 `~/.rockycode/providers.toml`. The `/model` picker only offers providers whose
-keys are actually configured. Only DeepSeek is verified on the harness; the
-others are [experimental](#experimental).
+keys are actually configured. DeepSeek and MiniMax both carry full-500 bench
+numbers (see [Results](#results--swe-bench-verified)); Kimi and GLM are
+[experimental](#experimental).
 
 The effort dial (`/effort off|high|xhigh|max`) is provider-neutral; each
 provider maps it to its own reasoning tiers at the wire (DeepSeek, for
@@ -261,8 +315,9 @@ change. Anything that could act on its own is **off by default**.
   mechanically-verified report; the search noise never enters your session. It
   also grounds goal mode's branch review and milestone verification.
 - **Providers beyond DeepSeek.** MiniMax, GLM / z.ai, and Kimi are wired as
-  OpenAI-compatible profiles (`/model`), but only DeepSeek is verified on the
-  harness — treat the others as untested until they carry a bench number.
+  OpenAI-compatible profiles (`/model`). DeepSeek and MiniMax carry full
+  bench numbers (see Results); treat GLM and Kimi as untested until they do
+  too.
 
 ## Works with your existing setup
 

{rockycode-0.1.0 → rockycode-0.1.2}/README.zh-CN.md

@@ -9,7 +9,8 @@
 
 [English](README.md) · [简体中文](README.zh-CN.md)
 
-![SWE-bench Verified](https://img.shields.io/badge/SWE--bench_Verified-~80%25_100--task_slice-7d5cc6)
+![SWE-bench Verified](https://img.shields.io/badge/SWE--bench_Verified-88.8%25_V4--flash_GA-7d5cc6)
+![V4-pro preview](https://img.shields.io/badge/V4--pro_preview-74.9%25-8d6cd0)
 ![Python](https://img.shields.io/badge/Python-3.11%2B-9d7cd8)
 ![License](https://img.shields.io/badge/License-MIT-a9b1d6)
 
@@ -36,11 +37,19 @@ rockycode 是一个编程智能体 harness，为 DeepSeek V4 系列适配，也
 
 ## 能力量化：SWE bench
 
-在 SWE-bench Verified 上，**随机抽选 100 题**测试（资源所限，没有在完整 500 题上做重复取平均）：
+完整 500 题的成绩：**独立的完整 500 题运行**，每个模型各 3 轮，所有模型使用完全相同的 harness 与配置（步数上限 100、单次最大输出 32,768 token、推理力度 `max`、thinking 开启），由官方 SWE-bench harness 打分，未针对任务做任何调优。注意版本差异：`deepseek-v4-flash` 一列是**正式版（GA，V4-Flash-0731）**；而 `deepseek-v4-pro` 的三轮在 GA 版 V4-Pro-0813 发布之前运行，该列是 **preview 版**成绩 —— flash 与 pro 的差距里含有版本差，不是同代对比。
 
-**结果：在这个 100 题切片上约 80%** —— 用 `deepseek-v4-pro`，未针对这些任务做调优，是一次四臂配置扫描的均值。
+| 轮次 | `deepseek-v4-flash`（GA） | `deepseek-v4-pro`（preview） | `minimax-m3` |
+|---|---|---|---|
+| 第 1 轮 | 90.0%（450/500） | 75.6%（378/500） | 72.8%（364/500） |
+| 第 2 轮 | 88.6%（443/500） | 74.8%（374/500） | 71.2%（356/500） |
+| 第 3 轮 | 87.8%（439/500） | 74.4%（372/500） | 70.0%（350/500） |
+| **平均** | **88.8%** | **74.9%** | **71.3%** |
+| 多轮并集（pass@3） | 95.4%（477/500） | 81.8%（409/500） | 83.6%（418/500） |
 
-请连同它的边界一起看：这是一个**随机抽取的代表性切片**，不是官方 500 题的完整Verified 集；其中较难的 20 题核心得分 60–70%，另外 80 题得分 >80%。请把它当作诚实的内部测量，而非排行榜成绩；完整拆解请关注我们的X账号（@rockycode_ai）。
+两行汇总要分开读。**平均值**是可以与排行榜对比的数字 —— 每一轮都是独立的单次完整 500 题。**并集**是 pass@3：至少被某一轮解出的任务。两者之间的差距（DeepSeek 两个模型各约 7 个点、MiniMax 约 12 个点）是轮次间方差，不是能力上限 —— 模型在这套 harness 下已经"够得着"这些任务，只是无法每一轮都稳住。当前的工作重心就是收掉这个差距：finish 前的验证门控与多轮选择，而不是继续改提示词。作为参照：DeepSeek 用自家 scaffold 报告 V4 Pro (Preview) 为 80.6%。逐轮拆解请关注我们的X账号（@rockycode_ai）。
+
+另有两轮较早的 flash-preview 运行（79.8% —— 即此前列在这里的那一轮 —— 与 81.2%）在运行途中遭遇本地网络中断，表现为连续任务块返回空补丁；这两轮已用干净的重跑替换，未计入平均。
 
 我们计划支持DeepSWE bench，目前还在调试中。
 
@@ -50,10 +59,38 @@ rockycode 是一个编程智能体 harness，为 DeepSeek V4 系列适配，也
 
 **Docker Desktop** 仅在需要容器隔离工具执行的模式下才必需：`goal`（自主运行）、`exec`（自动化委托）、`bench`（SWE-bench 打分），以及 chat 里可选的`/sandbox`。这些模式在沙箱内默认离线运行，被委托或无人值守的任务因此无法触碰你的主机、无法访问网络。
 
+```bash
+uv tool install rockycode     # 推荐 —— `rockycode` 命令直接进 PATH
+rockycode                     # 首次运行会引导你完成 API key 设置
+```
+
+已经装过、想升到新版本？用 **`uv tool upgrade rockycode`** ——
+注意重复执行 `uv tool install` 不会升级：它看到已有安装就静默保留旧版本。
+
+还没有 uv？一条命令安装：
+`curl -LsSf https://astral.sh/uv/install.sh | sh`（Windows 及其他方式见
+[uv 安装文档](https://docs.astral.sh/uv/getting-started/installation/)）。
+
+三种装法看着像，落点完全不同：
+
+- **`uv tool install rockycode`**（推荐）—— 给 CLI 一个独立的隔离环境，并把
+  `rockycode` 命令放上 PATH；系统 Python 低于 3.11 时，uv 会自动拉取一个匹配
+  的解释器。想「当应用装」就用它。
+- **`uv pip install rockycode`** —— 只装进**当前激活的虚拟环境**：`rockycode`
+  命令只存在于那个 venv 里，新开一个 shell 会找不到它（要么先激活 venv，
+  要么用 `uv run rockycode` 运行）。
+- **`pip install rockycode`** —— 同样只进当前环境，且要求 Python 3.11+。在更老
+  的 Python 上会报一个很有误导性的
+  `ERROR: No matching distribution found for rockycode`。原因：pip 只会提供
+  `requires-python` 与你解释器匹配的版本，老 Python 下它一个可装的版本都看
+  不到，于是把「版本不满足」报成了「包不存在」。遇到这个错不用纠结 —— 直接用
+  上面的 `uv tool install rockycode`，uv 自带 3.11+ 的 Python。
+
+或从源码安装：
+
 ```bash
 git clone https://github.com/cicialgo/rockycode.git && cd rockycode
-uv tool install .      # 把 `rockycode` 命令装到 PATH
-rockycode              # 首次运行会引导你完成 API key 设置
+uv tool install .
 ```
 
 首次启动只需粘贴一次 API key。它被存入操作系统钥匙串（安装 `[keyring]`扩展时）或 `~/.rockycode/.env` 私有文件（权限 `0600`）—— 不进你的项目或者shell 配置。rockycode 从不读取项目内的 `.env`：克隆来的仓库不应有能力注入 key 或改写 endpoint，因此其中形似凭据的变量只会按名字给出警告，值不会被读取。
@@ -98,7 +135,8 @@ SSH 远程会话下剪贴板走 OSC 52 —— 在本地端开启「允许应用
 | `/permission yolo\|ask\|careful` | 本次会话的工具审批严格度 |
 | `/sandbox on\|off\|status` | 把工具执行隔离进容器 |
 | `/lsp` | 语言服务器状态；诊断信息随 `read_file` 一并返回 |
-| `/artifact live on\|off` | 浏览器中自动刷新 HTML artifact |
+| `/artifact` | 本会话的 artifact：`list` · `open <n>` · `stop` · `live on\|off` |
+| `/paste` | 粘贴剪贴板图片（或 `ctrl+v`）；无视觉模型自选识图路由 |
 | `/prompt` | 查看当前生效的系统提示词 |
 | `/mcp` | 已连接的 MCP 服务及其工具 |
 | `/skills` | 已安装的技能 |
@@ -128,15 +166,15 @@ DeepSeek 是主场模型，但提供商是数据而非代码：每个提供商
 
 | 提供商 | 模型 |
 |---|---|
-| **deepseek**（默认） | `deepseek-v4-pro`、`deepseek-v4-flash` |
+| **deepseek**（默认） | `deepseek-v4-flash`（默认）、`deepseek-v4-pro`（preview） |
 | **minimax** | `minimax-m3` |
 | **kimi** | `kimi-k3` |
 | **glm** | `glm-5.2` |
 
 区域端点写作 `<提供商>-<区域>`（如 `kimi-cn`）；自定义提供商 —— 包括本地
 vLLM/SGLang 服务 —— 写进 `~/.rockycode/providers.toml`。`/model` 选择器
-只展示已配置好 key 的提供商。只有 DeepSeek 在 harness 上验证过，其余为
-[实验性功能](#实验性功能)。
+只展示已配置好 key 的提供商。DeepSeek 与 MiniMax 都有完整 500 题的 bench
+成绩（见上方「能力量化」）；Kimi 与 GLM 属于[实验性功能](#实验性功能)。
 
 推理深度旋钮（`/effort off|high|xhigh|max`）与提供商无关；各提供商在请求层
 把它映射到自己的档位（例如 DeepSeek 只区分 `high|max`，`xhigh` 会收敛为
@@ -220,8 +258,8 @@ sqlite-vec + FTS5 索引；没有 Ollama 则平滑退化为关键词检索。删
   有界的只读调查，只拿回带引用、经机械校验的报告；搜索噪声绝不进入你的会话。
   它同样为 goal 模式的分支评审与里程碑验证提供依据。
 - **DeepSeek 以外的提供商。** MiniMax、GLM / z.ai、Kimi 都以 OpenAI 兼容的
-  profile 接入（`/model`），但只有 DeepSeek 在 harness 上验证过 —— 其余在拿到
-  bench 分数前，请当作未验证。
+  profile 接入（`/model`）。DeepSeek 与 MiniMax 已有完整 bench 成绩（见
+  「能力量化」）；GLM 与 Kimi 在拿到 bench 分数前，请当作未验证。
 
 ## 复用你已有的配置
 

{rockycode-0.1.0 → rockycode-0.1.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rockycode"
-version = "0.1.0"
+version = "0.1.2"
 description = "A coding agent harness, benchmarked on SWE-bench Verified. amaze!"
 requires-python = ">=3.11"
 readme = "README.md"
@@ -68,6 +68,13 @@ pdf = [
 #   uv pip install 'rockycode[keyring]'
 keyring = ["keyring>=24"]
 
+[dependency-groups]
+# Development-only quality gate. Pin it so contributors and CI enforce the
+# exact same rules; Ruff is not shipped in the rockycode runtime wheel.
+dev = [
+    "ruff==0.16.1",
+]
+
 [project.scripts]
 rockycode = "rockycode.cli:app"
 
@@ -81,3 +88,14 @@ packages = ["rockycode"]
 [tool.ruff]
 line-length = 110
 target-version = "py311"
+
+[tool.ruff.lint]
+# Conservative correctness baseline: import/syntax errors, undefined names,
+# unused imports/variables, and a small set of unambiguous PEP 8 errors.
+select = ["E4", "E7", "E9", "F"]
+
+[tool.ruff.lint.per-file-ignores]
+# Smoke tests are executable scripts: many intentionally set cwd/env before
+# importing rockycode, and some use compact procedural assertions. Keep F/E9
+# correctness checks active without forcing a wholesale test rewrite.
+"tests/*.py" = ["E402", "E702", "E741"]

rockycode-0.1.2/rockycode/__init__.py

@@ -0,0 +1,11 @@
+# Version comes from installed package metadata (single source: pyproject) —
+# a hardcoded string here shipped stale once ("0.1.0" inside the 0.1.1 wheel).
+# Lazy module __getattr__ keeps `import rockycode` free of the metadata scan.
+def __getattr__(name: str):
+    if name == "__version__":
+        from importlib.metadata import PackageNotFoundError, version
+        try:
+            return version("rockycode")
+        except PackageNotFoundError:  # running from a bare checkout, uninstalled
+            return "unknown"
+    raise AttributeError(name)