superqode 2.3.0__tar.gz → 2.3.2__tar.gz

{superqode-2.3.0 → superqode-2.3.2}/CHANGELOG.md

@@ -7,6 +7,52 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.3.2] - 2026-09-13
+
+A remote UHP bind no longer serves the harness catalog without a bearer.
+
+### 🔐 UHP security
+
+- A remote bind no longer serves the harness catalog without a bearer.
+  Architecture section 5 of the specification allows one unauthenticated
+  route, discovery, so opening the catalog left the bind failing the suite's
+  authentication checks and disclosing the harness id, the model list and the
+  harness configuration to anyone who found the host. The new
+  `serve uhp --public-catalog` flag restores the old behaviour for anyone who
+  wants it, and says in its help what it costs. Present since `serve uhp`
+  shipped in 2.2.2.
+
+### 🧩 Unified Harness Protocol
+
+- Core conformance is now measured by HarnessRouter rather than by us. Their
+  `conformance-measure` workflow ran suite `2026.9.12` against
+  `uhp.superqode.dev` itself at class full: core passed 40 of 40, including
+  both authentication checks. The badge and report are on the UHP conformance
+  page. Extended stays out of reach on that host, because artifact retrieval
+  is deferred and session listing is off wherever one bearer is shared.
+
+### 📦 Packaging
+
+- The `uhp` extra is recorded in `uv.lock`. It has been declared in
+  `pyproject.toml` since 2.2.4, so a locked install of the extra resolved
+  against a lock file that did not know it existed.
+- The `uhp` extra is listed in the installation reference.
+
+## [2.3.1] - 2026-09-13
+
+A saved UHP connection is now scoped to the server it was saved against.
+
+### 🔐 UHP security
+
+- A saved UHP connection no longer applies to a different server. The bearer,
+  the selected harness and the token cap were resolved field by field with no
+  regard for which host they were saved against, so connecting to a second
+  server sent it the credential saved for the first. A `chrn_` id carried the
+  same way named a harness that server had never heard of. Explicit arguments
+  and environment variables are unchanged, and reconnecting to the saved
+  server still uses everything saved for it. Present since the UHP client
+  shipped in 2.2.1.
+
 ## [2.3.0] - 2026-09-13
 
 The UHP server release. `serve uhp` serves session listing, inspection and

{superqode-2.3.0 → superqode-2.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: superqode
-Version: 2.3.0
+Version: 2.3.2
 Summary: The harness layer for coding agents
 Author-email: Shashi Jagtap <info@super-agentic.ai>
 Maintainer-email: Shashi Jagtap <info@super-agentic.ai>
@@ -153,43 +153,53 @@ Requires-Dist: opentelemetry-sdk>=1.39.1; extra == "observability"
 Dynamic: license-file
 
 <p align="center">
-  <img src="assets/superqode-banner.png" alt="SuperQode" width="760">
+  <a href="https://superqode.dev"><img src="assets/superqode-logo.png" alt="SuperQode" width="104"></a>
 </p>
 
-<h2 align="center">The harness layer for coding agents.</h2>
+<h1 align="center">SuperQode</h1>
+
+<h3 align="center">The harness layer for coding agents.</h3>
+
 <p align="center">
   Discover, build, run, evaluate and optimize coding-agent harnesses from one terminal.<br>
   Interoperable over ACP, A2A, MCP and UHP: drive any coding agent, and be called as one.
 </p>
 
+<p align="center">
+  <a href="https://superqode.dev"><img src="https://img.shields.io/badge/superqode.dev-Visit%20the%20site-7c3aed?style=for-the-badge" alt="superqode.dev"></a>
+  &nbsp;
+  <a href="https://docs.superqode.dev/"><img src="https://img.shields.io/badge/Read%20the-Documentation-1f2937?style=for-the-badge" alt="Documentation"></a>
+</p>
+
+<p align="center">
+  <a href="https://docs.superqode.dev/harness-hub/">Harness Hub</a>
+  &nbsp;·&nbsp;
+  <a href="https://uhp.superqode.dev/v1/uhp">UHP host</a>
+  &nbsp;·&nbsp;
+  <a href="https://www.youtube.com/watch?v=BmTWNMvJP4s">Demo</a>
+  &nbsp;·&nbsp;
+  <a href="https://github.com/SuperagenticAI/superqode/discussions">Discussions</a>
+</p>
+
 <p align="center">
   <a href="https://pypi.org/project/superqode/"><img src="https://img.shields.io/pypi/v/superqode?style=flat-square&color=7c3aed&label=pypi" alt="PyPI"></a>
   <a href="https://pypi.org/project/superqode/"><img src="https://img.shields.io/pypi/pyversions/superqode?style=flat-square&color=3776ab" alt="Python"></a>
+  <a href="https://unifiedharnessprotocol.org/conformance#measured-implementations"><img src="https://unifiedharnessprotocol.org/badges/superqode.svg" alt="UHP core 2026-09-12"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-green?style=flat-square" alt="License"></a>
   <a href="https://github.com/SuperagenticAI/superqode/stargazers"><img src="https://img.shields.io/github/stars/SuperagenticAI/superqode?style=flat-square&color=f59e0b" alt="Stars"></a>
   <a href="https://github.com/SuperagenticAI/superqode/discussions"><img src="https://img.shields.io/github/discussions/SuperagenticAI/superqode?style=flat-square" alt="Discussions"></a>
 </p>
 
 <p align="center">
-  <a href="https://www.producthunt.com/products/superqode?utm_source=badge-follow&utm_medium=badge&utm_source=badge-superqode" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/follow.svg?product_id=1155543&theme=light" alt="SuperQode - The&#0032;harness&#0032;interoperability&#0032;layer&#0032;for&#0032;coding&#0032;agent | Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
+  <img src="assets/superqode-hero.png" alt="The SuperQode terminal interface" width="880">
 </p>
 
 <p align="center">
-  <a href="https://docs.superqode.dev/"><strong>Documentation</strong></a>
-  &nbsp;·&nbsp;
-  <a href="https://docs.superqode.dev/getting-started/quickstart/">Quick Start</a>
-  &nbsp;·&nbsp;
-  <a href="https://docs.superqode.dev/harness-hub/">Harness Hub</a>
-  &nbsp;·&nbsp;
-  <a href="https://superqode.dev">superqode.dev</a>
-  &nbsp;·&nbsp;
-  <a href="https://www.youtube.com/watch?v=BmTWNMvJP4s">Demo</a>
-  &nbsp;·&nbsp;
-  <a href="https://github.com/SuperagenticAI/superqode/discussions">Discussions</a>
+  <img src="assets/superqode-banner.png" alt="" width="760">
 </p>
 
 <p align="center">
-  <img src="assets/superqode-hero.png" alt="The SuperQode terminal interface" width="880">
+  <a href="https://www.producthunt.com/products/superqode?utm_source=badge-follow&utm_medium=badge&utm_source=badge-superqode" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/follow.svg?product_id=1155543&theme=light" alt="SuperQode on Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
 </p>
 
 ## What is SuperQode?

{superqode-2.3.0 → superqode-2.3.2}/README.md

@@ -1,41 +1,51 @@
 <p align="center">
-  <img src="assets/superqode-banner.png" alt="SuperQode" width="760">
+  <a href="https://superqode.dev"><img src="assets/superqode-logo.png" alt="SuperQode" width="104"></a>
 </p>
 
-<h2 align="center">The harness layer for coding agents.</h2>
+<h1 align="center">SuperQode</h1>
+
+<h3 align="center">The harness layer for coding agents.</h3>
+
 <p align="center">
   Discover, build, run, evaluate and optimize coding-agent harnesses from one terminal.<br>
   Interoperable over ACP, A2A, MCP and UHP: drive any coding agent, and be called as one.
 </p>
 
+<p align="center">
+  <a href="https://superqode.dev"><img src="https://img.shields.io/badge/superqode.dev-Visit%20the%20site-7c3aed?style=for-the-badge" alt="superqode.dev"></a>
+  &nbsp;
+  <a href="https://docs.superqode.dev/"><img src="https://img.shields.io/badge/Read%20the-Documentation-1f2937?style=for-the-badge" alt="Documentation"></a>
+</p>
+
+<p align="center">
+  <a href="https://docs.superqode.dev/harness-hub/">Harness Hub</a>
+  &nbsp;·&nbsp;
+  <a href="https://uhp.superqode.dev/v1/uhp">UHP host</a>
+  &nbsp;·&nbsp;
+  <a href="https://www.youtube.com/watch?v=BmTWNMvJP4s">Demo</a>
+  &nbsp;·&nbsp;
+  <a href="https://github.com/SuperagenticAI/superqode/discussions">Discussions</a>
+</p>
+
 <p align="center">
   <a href="https://pypi.org/project/superqode/"><img src="https://img.shields.io/pypi/v/superqode?style=flat-square&color=7c3aed&label=pypi" alt="PyPI"></a>
   <a href="https://pypi.org/project/superqode/"><img src="https://img.shields.io/pypi/pyversions/superqode?style=flat-square&color=3776ab" alt="Python"></a>
+  <a href="https://unifiedharnessprotocol.org/conformance#measured-implementations"><img src="https://unifiedharnessprotocol.org/badges/superqode.svg" alt="UHP core 2026-09-12"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-green?style=flat-square" alt="License"></a>
   <a href="https://github.com/SuperagenticAI/superqode/stargazers"><img src="https://img.shields.io/github/stars/SuperagenticAI/superqode?style=flat-square&color=f59e0b" alt="Stars"></a>
   <a href="https://github.com/SuperagenticAI/superqode/discussions"><img src="https://img.shields.io/github/discussions/SuperagenticAI/superqode?style=flat-square" alt="Discussions"></a>
 </p>
 
 <p align="center">
-  <a href="https://www.producthunt.com/products/superqode?utm_source=badge-follow&utm_medium=badge&utm_source=badge-superqode" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/follow.svg?product_id=1155543&theme=light" alt="SuperQode - The&#0032;harness&#0032;interoperability&#0032;layer&#0032;for&#0032;coding&#0032;agent | Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
+  <img src="assets/superqode-hero.png" alt="The SuperQode terminal interface" width="880">
 </p>
 
 <p align="center">
-  <a href="https://docs.superqode.dev/"><strong>Documentation</strong></a>
-  &nbsp;·&nbsp;
-  <a href="https://docs.superqode.dev/getting-started/quickstart/">Quick Start</a>
-  &nbsp;·&nbsp;
-  <a href="https://docs.superqode.dev/harness-hub/">Harness Hub</a>
-  &nbsp;·&nbsp;
-  <a href="https://superqode.dev">superqode.dev</a>
-  &nbsp;·&nbsp;
-  <a href="https://www.youtube.com/watch?v=BmTWNMvJP4s">Demo</a>
-  &nbsp;·&nbsp;
-  <a href="https://github.com/SuperagenticAI/superqode/discussions">Discussions</a>
+  <img src="assets/superqode-banner.png" alt="" width="760">
 </p>
 
 <p align="center">
-  <img src="assets/superqode-hero.png" alt="The SuperQode terminal interface" width="880">
+  <a href="https://www.producthunt.com/products/superqode?utm_source=badge-follow&utm_medium=badge&utm_source=badge-superqode" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/follow.svg?product_id=1155543&theme=light" alt="SuperQode on Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
 </p>
 
 ## What is SuperQode?

{superqode-2.3.0 → superqode-2.3.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superqode"
-version = "2.3.0"
+version = "2.3.2"
 description = "The harness layer for coding agents"
 readme = "README.md"
 license = "Apache-2.0"

{superqode-2.3.0 → superqode-2.3.2}/src/superqode/__init__.py

@@ -38,7 +38,7 @@ __all__ = [
     "sidebar",
 ]
 
-__version__ = "2.3.0"
+__version__ = "2.3.2"
 
 # Stable, lightweight public extension surface.  Importing this package does
 # not discover or execute third-party extensions; discovery happens only when

{superqode-2.3.0 → superqode-2.3.2}/src/superqode/commands/serve.py

@@ -354,6 +354,11 @@ def serve_a2a(
     help="Bearer token. Required with --allow-remote. Catalog GETs stay public.",
 )
 @click.option("--allow-remote", is_flag=True, help="Allow binding outside localhost")
+@click.option(
+    "--public-catalog",
+    is_flag=True,
+    help="Serve the harness catalog without a bearer. Architecture section 5 allows\n    only discovery unauthenticated, so this leaves the bind non-conformant.",
+)
 @click.option(
     "--harness-id",
     default=None,
@@ -368,6 +373,7 @@ def serve_uhp(
     working_dir: Path,
     api_key: Optional[str],
     allow_remote: bool,
+    public_catalog: bool,
     harness_id: Optional[str],
 ):
     """Expose a HarnessSpec as a native UHP 2026-08-11 HTTP server.
@@ -395,7 +401,7 @@ def serve_uhp(
             working_directory=working_dir.resolve(),
             api_key=api_key,
             harness_id=harness_id,
-            public_catalog=allow_remote,
+            public_catalog=public_catalog,
             require_caller_provider_key=allow_remote,
         )
     except MissingUHPServerDependency as exc:

{superqode-2.3.0 → superqode-2.3.2}/src/superqode/providers/uhp.py

@@ -102,22 +102,44 @@ def _optional_int(value: object) -> int | None:
     return parsed if parsed > 0 else None
 
 
+def _same_server(one: str, other: str) -> bool:
+    """Whether two base URLs name the same server."""
+
+    def key(value: str) -> str:
+        trimmed = (value or "").strip().rstrip("/")
+        if trimmed.endswith("/v1"):
+            trimmed = trimmed[: -len("/v1")]
+        return trimmed.lower()
+
+    return bool(one) and key(one) == key(other)
+
+
 def resolve_settings(
     base_url: str | None = None,
     api_key: str | None = None,
     harness_id: str | None = None,
     max_output_tokens: int | None = None,
 ) -> UHPSettings:
-    """Resolve settings from arguments, then the environment, then the file."""
+    """Resolve settings from arguments, then the environment, then the file.
+
+    Saved values belong to the server they were saved against. A bearer must
+    never travel to another host, and a ``chrn_`` id means nothing there.
+    """
     saved = load_saved_connection()
+    resolved = (base_url or os.environ.get(BASE_URL_ENV) or saved.base_url or "").strip()
+    known = _same_server(resolved, saved.base_url)
     return UHPSettings(
-        base_url=(base_url or os.environ.get(BASE_URL_ENV) or saved.base_url or "").strip(),
-        api_key=(api_key or os.environ.get(API_KEY_ENV) or saved.api_key or "").strip(),
-        harness_id=(harness_id or os.environ.get(HARNESS_ENV) or saved.harness_id or "").strip(),
+        base_url=resolved,
+        api_key=(
+            api_key or os.environ.get(API_KEY_ENV) or (saved.api_key if known else "") or ""
+        ).strip(),
+        harness_id=(
+            harness_id or os.environ.get(HARNESS_ENV) or (saved.harness_id if known else "") or ""
+        ).strip(),
         max_output_tokens=(
             max_output_tokens
             or _optional_int(os.environ.get(MAX_OUTPUT_TOKENS_ENV))
-            or saved.max_output_tokens
+            or (saved.max_output_tokens if known else None)
         ),
     )
 

{superqode-2.3.0 → superqode-2.3.2}/src/superqode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: superqode
-Version: 2.3.0
+Version: 2.3.2
 Summary: The harness layer for coding agents
 Author-email: Shashi Jagtap <info@super-agentic.ai>
 Maintainer-email: Shashi Jagtap <info@super-agentic.ai>
@@ -153,43 +153,53 @@ Requires-Dist: opentelemetry-sdk>=1.39.1; extra == "observability"
 Dynamic: license-file
 
 <p align="center">
-  <img src="assets/superqode-banner.png" alt="SuperQode" width="760">
+  <a href="https://superqode.dev"><img src="assets/superqode-logo.png" alt="SuperQode" width="104"></a>
 </p>
 
-<h2 align="center">The harness layer for coding agents.</h2>
+<h1 align="center">SuperQode</h1>
+
+<h3 align="center">The harness layer for coding agents.</h3>
+
 <p align="center">
   Discover, build, run, evaluate and optimize coding-agent harnesses from one terminal.<br>
   Interoperable over ACP, A2A, MCP and UHP: drive any coding agent, and be called as one.
 </p>
 
+<p align="center">
+  <a href="https://superqode.dev"><img src="https://img.shields.io/badge/superqode.dev-Visit%20the%20site-7c3aed?style=for-the-badge" alt="superqode.dev"></a>
+  &nbsp;
+  <a href="https://docs.superqode.dev/"><img src="https://img.shields.io/badge/Read%20the-Documentation-1f2937?style=for-the-badge" alt="Documentation"></a>
+</p>
+
+<p align="center">
+  <a href="https://docs.superqode.dev/harness-hub/">Harness Hub</a>
+  &nbsp;·&nbsp;
+  <a href="https://uhp.superqode.dev/v1/uhp">UHP host</a>
+  &nbsp;·&nbsp;
+  <a href="https://www.youtube.com/watch?v=BmTWNMvJP4s">Demo</a>
+  &nbsp;·&nbsp;
+  <a href="https://github.com/SuperagenticAI/superqode/discussions">Discussions</a>
+</p>
+
 <p align="center">
   <a href="https://pypi.org/project/superqode/"><img src="https://img.shields.io/pypi/v/superqode?style=flat-square&color=7c3aed&label=pypi" alt="PyPI"></a>
   <a href="https://pypi.org/project/superqode/"><img src="https://img.shields.io/pypi/pyversions/superqode?style=flat-square&color=3776ab" alt="Python"></a>
+  <a href="https://unifiedharnessprotocol.org/conformance#measured-implementations"><img src="https://unifiedharnessprotocol.org/badges/superqode.svg" alt="UHP core 2026-09-12"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-green?style=flat-square" alt="License"></a>
   <a href="https://github.com/SuperagenticAI/superqode/stargazers"><img src="https://img.shields.io/github/stars/SuperagenticAI/superqode?style=flat-square&color=f59e0b" alt="Stars"></a>
   <a href="https://github.com/SuperagenticAI/superqode/discussions"><img src="https://img.shields.io/github/discussions/SuperagenticAI/superqode?style=flat-square" alt="Discussions"></a>
 </p>
 
 <p align="center">
-  <a href="https://www.producthunt.com/products/superqode?utm_source=badge-follow&utm_medium=badge&utm_source=badge-superqode" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/follow.svg?product_id=1155543&theme=light" alt="SuperQode - The&#0032;harness&#0032;interoperability&#0032;layer&#0032;for&#0032;coding&#0032;agent | Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
+  <img src="assets/superqode-hero.png" alt="The SuperQode terminal interface" width="880">
 </p>
 
 <p align="center">
-  <a href="https://docs.superqode.dev/"><strong>Documentation</strong></a>
-  &nbsp;·&nbsp;
-  <a href="https://docs.superqode.dev/getting-started/quickstart/">Quick Start</a>
-  &nbsp;·&nbsp;
-  <a href="https://docs.superqode.dev/harness-hub/">Harness Hub</a>
-  &nbsp;·&nbsp;
-  <a href="https://superqode.dev">superqode.dev</a>
-  &nbsp;·&nbsp;
-  <a href="https://www.youtube.com/watch?v=BmTWNMvJP4s">Demo</a>
-  &nbsp;·&nbsp;
-  <a href="https://github.com/SuperagenticAI/superqode/discussions">Discussions</a>
+  <img src="assets/superqode-banner.png" alt="" width="760">
 </p>
 
 <p align="center">
-  <img src="assets/superqode-hero.png" alt="The SuperQode terminal interface" width="880">
+  <a href="https://www.producthunt.com/products/superqode?utm_source=badge-follow&utm_medium=badge&utm_source=badge-superqode" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/follow.svg?product_id=1155543&theme=light" alt="SuperQode on Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
 </p>
 
 ## What is SuperQode?

{superqode-2.3.0 → superqode-2.3.2}/tests/test_uhp_connect.py

@@ -338,3 +338,79 @@ def test_a_nonsense_cap_is_ignored_rather_than_sent(monkeypatch):
     for value in ("0", "-5", "lots", ""):
         monkeypatch.setenv(MAX_OUTPUT_TOKENS_ENV, value)
         assert resolve_settings().max_output_tokens is None
+
+
+# ── saved settings belong to the server they were saved against ────────────────
+
+
+def _save(tmp_path, monkeypatch, **fields):
+    import json
+
+    from superqode.providers import uhp as settings
+
+    path = tmp_path / "uhp.json"
+    path.write_text(json.dumps({"base_url": "https://saved.example", **fields}))
+    monkeypatch.setattr(settings, "connection_path", lambda: path)
+    for env in (
+        settings.BASE_URL_ENV,
+        settings.API_KEY_ENV,
+        settings.HARNESS_ENV,
+        settings.MAX_OUTPUT_TOKENS_ENV,
+    ):
+        monkeypatch.delenv(env, raising=False)
+    return settings
+
+
+def test_saved_bearer_does_not_travel_to_another_server(tmp_path, monkeypatch):
+    """A credential saved for one host must not be sent to a different one."""
+    settings = _save(
+        tmp_path,
+        monkeypatch,
+        api_key="bearer-for-saved",
+        harness_id="chrn_saved",
+        max_output_tokens=2000,
+    )
+
+    elsewhere = settings.resolve_settings(base_url="https://other.example")
+
+    assert elsewhere.api_key == ""
+    assert elsewhere.harness_id == "", "chrn_ ids are scoped to the server that issued them"
+    assert elsewhere.max_output_tokens is None
+
+
+def test_saved_settings_still_apply_to_their_own_server(tmp_path, monkeypatch):
+    settings = _save(
+        tmp_path,
+        monkeypatch,
+        api_key="bearer-for-saved",
+        harness_id="chrn_saved",
+        max_output_tokens=2000,
+    )
+
+    same = settings.resolve_settings(base_url="https://saved.example")
+    assert same.api_key == "bearer-for-saved"
+    assert same.harness_id == "chrn_saved"
+    assert same.max_output_tokens == 2000
+
+    # And with no base_url at all, the saved connection is the connection.
+    default = settings.resolve_settings()
+    assert default.base_url == "https://saved.example"
+    assert default.api_key == "bearer-for-saved"
+
+
+def test_same_server_ignores_trailing_slash_and_v1(tmp_path, monkeypatch):
+    settings = _save(tmp_path, monkeypatch, api_key="bearer-for-saved")
+
+    for variant in ("https://saved.example/", "https://saved.example/v1", "HTTPS://SAVED.EXAMPLE"):
+        assert settings.resolve_settings(base_url=variant).api_key == "bearer-for-saved", variant
+
+
+def test_explicit_arguments_and_env_still_win(tmp_path, monkeypatch):
+    settings = _save(tmp_path, monkeypatch, api_key="bearer-for-saved")
+
+    explicit = settings.resolve_settings(base_url="https://other.example", api_key="mine")
+    assert explicit.api_key == "mine"
+
+    monkeypatch.setenv(settings.API_KEY_ENV, "from-env")
+    from_env = settings.resolve_settings(base_url="https://other.example")
+    assert from_env.api_key == "from-env"