release: 2.0.1 — 12 v2.0 audit fixes + live model-tier propagation - #21
release: 2.0.1 — 12 v2.0 audit fixes + live model-tier propagation#21dreamrec wants to merge 1 commit into
Conversation
… tier propagation Two rounds of audit findings against v2.0.0: - Live-TD audit: patch session lifecycle (3), td_python_help UX, 5 new recovery hints, info textDAT red ❌ - External security audit: .mcp.json portability, lockfile CVEs, WS URI token leak, freshness gate gap, npm shell injection, install.sh ZIP path Plus one new fix in this commit: AgentRuntime.start_turn() now live-refreshes the model_tier from the COMP's Modeltier param on every turn, so users can switch flash↔pro mid-session without pulsing Reload Config (which would rebuild the Agent and drop chat history). Pre-2.0.1 the tier was captured at agent construction, so a Modeltier dropdown change in the parameter panel had no effect on subsequent turns. Version bumps 2.0.0 → 2.0.1 across 13 canonical + cosmetic banner files. uv.lock auto-updated by uv lock --upgrade for the security CVE refresh. Tests: 1640 pass / 12 deselected (no regressions). Tox-freshness FAILS as expected — API_VERSION bump, runtime.py edit, and the freshness gate now self-tracks build scripts. Mirror the v2.0.0 release pattern: merge → rebuild .tox → tag → release → npm OIDC publish. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cd5b437ce0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # ───────────────────────────────────────────────────────────── | ||
|
|
||
| API_VERSION = "2.0.0" | ||
| API_VERSION = "2.0.1" |
There was a problem hiding this comment.
Bumping API_VERSION here without updating the committed td_component/tdpilot-dpsk4.tox and td_component/.tox-source-hash.json leaves the distributable artifact stale relative to source: scripts/check_tox_freshness.py explicitly hashes td_component/callbacks/_header.py, and CI invokes that gate in .github/workflows/ci.yml. In this state, users who install from the bundled .tox do not actually get the new runtime/version bytes, and the freshness check will fail until the .tox is rebuilt and recommitted.
Useful? React with 👍 / 👎.
|
Superseded by collapsed v2.1.0 release: bundling the v2.0.1 patch fixes + the live-tier fix + the v2.1.0 UI rework into a single release commit. The source-side fixes from this PR (live-tier propagation in runtime.py + the 13 version bumps + CHANGELOG entry) all carry forward to a new PR. Closing rather than merging since the bumps would target the wrong version (2.0.1 vs 2.1.0) and the CHANGELOG would split awkwardly. |
Path B per the user: bundle the would-be v2.0.1 patch (12 audit fixes from PRs #19 #20 + 1 live-tier propagation fix) and the chat UI rework (PR #22 — quiet mode, smaller fonts, contextual ASCII flourishes) into a single 2.1.0 minor release. Avoids a redundant .tox rebuild + npm publish cycle for what's effectively one batch of changes. Version bumps 2.0.0 → 2.1.0 across 13 canonical + cosmetic banner files. Live-tier fix re-applied to runtime.py (was on the closed PR #21 branch). uv.lock auto-refreshed in PR #20. CHANGELOG entry covers all 13 audit findings + the 4 UI rework items (font toggle removal, quiet mode toggle, smaller fonts, contextual ASCII flourishes), with migration notes for the two user-visible shifts (font-toggle → quiet-toggle and EXEC_MODE default flip). Tests: 1635 pass / 12 deselected (no regressions). Tox-freshness FAILS as expected — API_VERSION bump, runtime.py edit, chat HTML rework all need the .tox rebuilt. Mirror the v2.0.0 release pattern: merge → rebuild .tox → tag → release → npm OIDC publish. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
1 participant
Summary
v2.0.1 patch release. Bundles all v2.0.0 audit findings (already merged via PR #19 + PR #20) into the version-bumped release commit, plus one new fix in this PR.
What lands here
New fix: live model-tier propagation
AgentRuntime.start_turn()now readsModeltierfresh from the COMP parameter on every turn and updatesself._agent.model_tierif it changed. Pre-2.0.1, the tier was captured at agent construction, so the Modeltier dropdown change had no effect until the user manually pulsed Reload Config (which rebuilt the Agent and dropped chat history). This is the user-reported issue: "I cannot change it from flash now".Version bumps (2.0.0 → 2.0.1)
13 canonical + cosmetic banner files:
pyproject.toml,src/td_mcp/__init__.py,npm/package.json,.claude-plugin/plugin.json+marketplace.json,mcp/manifest.json,td_component/callbacks/_header.py(API_VERSION),plugin_README.md(header + inline),docs/MANUAL.md,npm/README.md,skills/tdpilot-dpsk4-core/SKILL.md,skills/tdpilot-dpsk4-production/SKILL.md,README.mdbanner.CHANGELOG entry
Comprehensive
## 2.0.1section covering all 12 fixes from PR #19 + PR #20 + this PR. Migration notes call out theTD_MCP_EXEC_MODEdefault change (full→restricted).What was already merged in PR #19 + #20
patch_commitclears state on endBlock failurepatch_rollbackusesui.undo.undo()patch_beginorphan recovery (stale + force=True)td_python_helpactionable errors.mcp.jsonportability + safe exec defaultTest plan
uv run --extra dev pytest tests/ -q→ 1640 pass / 12 deselecteduv run --extra dev ruff check .→ cleanuv run --extra dev ruff format --check .→ 298 files OKuv run --extra dev python scripts/check_versions.py→ in sync at v2.0.1uv run --extra dev python scripts/sync_counts.py --check→ OKbash scripts/check_no_personal_paths.sh→ cleanpython scripts/check_tox_freshness.py→ FAILS as expected (API_VERSION + runtime.py edits + freshness gate now self-tracks build scripts).tox rebuild
Required. Three reasons:
callbacks/_header.pytdpilot_api_runtime.pylive-tier fix (in standalone tox sources)After merge, rebuild .tox via the standard Textport recipe, then commit
build: rebuild .tox binaries against v2.0.1 sources. Tagv2.0.1,gh release create, npm publish via Trusted Publisher OIDC.🤖 Generated with Claude Code