superqode 2.3.1__tar.gz → 2.3.2__tar.gz

{superqode-2.3.1 → superqode-2.3.2}/CHANGELOG.md

@@ -7,6 +7,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.3.2] - 2026-09-13
+
+A remote UHP bind no longer serves the harness catalog without a bearer.
+
+### 🔐 UHP security
+
+- A remote bind no longer serves the harness catalog without a bearer.
+  Architecture section 5 of the specification allows one unauthenticated
+  route, discovery, so opening the catalog left the bind failing the suite's
+  authentication checks and disclosing the harness id, the model list and the
+  harness configuration to anyone who found the host. The new
+  `serve uhp --public-catalog` flag restores the old behaviour for anyone who
+  wants it, and says in its help what it costs. Present since `serve uhp`
+  shipped in 2.2.2.
+
+### 🧩 Unified Harness Protocol
+
+- Core conformance is now measured by HarnessRouter rather than by us. Their
+  `conformance-measure` workflow ran suite `2026.9.12` against
+  `uhp.superqode.dev` itself at class full: core passed 40 of 40, including
+  both authentication checks. The badge and report are on the UHP conformance
+  page. Extended stays out of reach on that host, because artifact retrieval
+  is deferred and session listing is off wherever one bearer is shared.
+
+### 📦 Packaging
+
+- The `uhp` extra is recorded in `uv.lock`. It has been declared in
+  `pyproject.toml` since 2.2.4, so a locked install of the extra resolved
+  against a lock file that did not know it existed.
+- The `uhp` extra is listed in the installation reference.
+
 ## [2.3.1] - 2026-09-13
 
 A saved UHP connection is now scoped to the server it was saved against.

{superqode-2.3.1 → superqode-2.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: superqode
-Version: 2.3.1
+Version: 2.3.2
 Summary: The harness layer for coding agents
 Author-email: Shashi Jagtap <info@super-agentic.ai>
 Maintainer-email: Shashi Jagtap <info@super-agentic.ai>
@@ -184,6 +184,7 @@ Dynamic: license-file
 <p align="center">
   <a href="https://pypi.org/project/superqode/"><img src="https://img.shields.io/pypi/v/superqode?style=flat-square&color=7c3aed&label=pypi" alt="PyPI"></a>
   <a href="https://pypi.org/project/superqode/"><img src="https://img.shields.io/pypi/pyversions/superqode?style=flat-square&color=3776ab" alt="Python"></a>
+  <a href="https://unifiedharnessprotocol.org/conformance#measured-implementations"><img src="https://unifiedharnessprotocol.org/badges/superqode.svg" alt="UHP core 2026-09-12"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-green?style=flat-square" alt="License"></a>
   <a href="https://github.com/SuperagenticAI/superqode/stargazers"><img src="https://img.shields.io/github/stars/SuperagenticAI/superqode?style=flat-square&color=f59e0b" alt="Stars"></a>
   <a href="https://github.com/SuperagenticAI/superqode/discussions"><img src="https://img.shields.io/github/discussions/SuperagenticAI/superqode?style=flat-square" alt="Discussions"></a>

{superqode-2.3.1 → superqode-2.3.2}/README.md

@@ -30,6 +30,7 @@
 <p align="center">
   <a href="https://pypi.org/project/superqode/"><img src="https://img.shields.io/pypi/v/superqode?style=flat-square&color=7c3aed&label=pypi" alt="PyPI"></a>
   <a href="https://pypi.org/project/superqode/"><img src="https://img.shields.io/pypi/pyversions/superqode?style=flat-square&color=3776ab" alt="Python"></a>
+  <a href="https://unifiedharnessprotocol.org/conformance#measured-implementations"><img src="https://unifiedharnessprotocol.org/badges/superqode.svg" alt="UHP core 2026-09-12"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-green?style=flat-square" alt="License"></a>
   <a href="https://github.com/SuperagenticAI/superqode/stargazers"><img src="https://img.shields.io/github/stars/SuperagenticAI/superqode?style=flat-square&color=f59e0b" alt="Stars"></a>
   <a href="https://github.com/SuperagenticAI/superqode/discussions"><img src="https://img.shields.io/github/discussions/SuperagenticAI/superqode?style=flat-square" alt="Discussions"></a>

{superqode-2.3.1 → superqode-2.3.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "superqode"
-version = "2.3.1"
+version = "2.3.2"
 description = "The harness layer for coding agents"
 readme = "README.md"
 license = "Apache-2.0"

{superqode-2.3.1 → superqode-2.3.2}/src/superqode/__init__.py

@@ -38,7 +38,7 @@ __all__ = [
     "sidebar",
 ]
 
-__version__ = "2.3.1"
+__version__ = "2.3.2"
 
 # Stable, lightweight public extension surface.  Importing this package does
 # not discover or execute third-party extensions; discovery happens only when

{superqode-2.3.1 → superqode-2.3.2}/src/superqode/commands/serve.py

@@ -354,6 +354,11 @@ def serve_a2a(
     help="Bearer token. Required with --allow-remote. Catalog GETs stay public.",
 )
 @click.option("--allow-remote", is_flag=True, help="Allow binding outside localhost")
+@click.option(
+    "--public-catalog",
+    is_flag=True,
+    help="Serve the harness catalog without a bearer. Architecture section 5 allows\n    only discovery unauthenticated, so this leaves the bind non-conformant.",
+)
 @click.option(
     "--harness-id",
     default=None,
@@ -368,6 +373,7 @@ def serve_uhp(
     working_dir: Path,
     api_key: Optional[str],
     allow_remote: bool,
+    public_catalog: bool,
     harness_id: Optional[str],
 ):
     """Expose a HarnessSpec as a native UHP 2026-08-11 HTTP server.
@@ -395,7 +401,7 @@ def serve_uhp(
             working_directory=working_dir.resolve(),
             api_key=api_key,
             harness_id=harness_id,
-            public_catalog=allow_remote,
+            public_catalog=public_catalog,
             require_caller_provider_key=allow_remote,
         )
     except MissingUHPServerDependency as exc:

{superqode-2.3.1 → superqode-2.3.2}/src/superqode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: superqode
-Version: 2.3.1
+Version: 2.3.2
 Summary: The harness layer for coding agents
 Author-email: Shashi Jagtap <info@super-agentic.ai>
 Maintainer-email: Shashi Jagtap <info@super-agentic.ai>
@@ -184,6 +184,7 @@ Dynamic: license-file
 <p align="center">
   <a href="https://pypi.org/project/superqode/"><img src="https://img.shields.io/pypi/v/superqode?style=flat-square&color=7c3aed&label=pypi" alt="PyPI"></a>
   <a href="https://pypi.org/project/superqode/"><img src="https://img.shields.io/pypi/pyversions/superqode?style=flat-square&color=3776ab" alt="Python"></a>
+  <a href="https://unifiedharnessprotocol.org/conformance#measured-implementations"><img src="https://unifiedharnessprotocol.org/badges/superqode.svg" alt="UHP core 2026-09-12"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-green?style=flat-square" alt="License"></a>
   <a href="https://github.com/SuperagenticAI/superqode/stargazers"><img src="https://img.shields.io/github/stars/SuperagenticAI/superqode?style=flat-square&color=f59e0b" alt="Stars"></a>
   <a href="https://github.com/SuperagenticAI/superqode/discussions"><img src="https://img.shields.io/github/discussions/SuperagenticAI/superqode?style=flat-square" alt="Discussions"></a>