From dbf3a7519623515e2c67e899379359274144433d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Peter=20Sandstr=C3=B6m?= Date: Wed, 14 Oct 2026 19:33:07 +0200 Subject: [PATCH] chore(release): 7.0.0 Bump to 7.0.0 (the skill fingerprint change in #573 is breaking), assemble the CHANGELOG section, add a 7.x what's-new to the README, refresh the OpenCLI contract. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01RSop9MyLof8XxLTkFnF4KG --- CHANGELOG.md | 88 +++++++++++++++++++++++++++++--------- README.md | 14 ++++++ contracts/kit.opencli.json | 2 +- docs/COMMANDS.md | 2 +- package-lock.json | 4 +- package.json | 2 +- 6 files changed, 86 insertions(+), 26 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3ccb8d48..d6208a4a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,23 @@ ## [Unreleased] +## [7.0.0] - 2026-10-14 + +### Breaking + +- **BREAKING: the skill fingerprint now covers the body and is a full SHA-256.** It used to + leave the `SKILL.md` body out, so a substituted payload under a pinned identity reported + "matches committed snapshot". It was also a 64-bit prefix. Every committed + `.kit-skill.snapshot.json` gets a new 64-character fingerprint and must be pinned once: + `kit skill test --update-snapshot`. `regression` now fires on any body + edit, including a typo fix. Anything that parses the snapshot and assumes a 16-character + digest needs updating. kit's own two skills are pinned in this release. +- **BREAKING: `kit check` prints English labels.** The HITL block said `HITL behövs`, + `Ägare:` and `Svara med:`. Anything that greps for those strings breaks. The skill + `monkey-test` answers to "run monkey-test" and no longer to "kör apa-test". A skill whose + description holds a non-ASCII letter gets a new `triggerKey`; a pure-ASCII description is + unchanged. A skill that declares `Bash` reads differently in the `scope` line, because a + bare `Bash` is no longer called a bounded scope. + ### Changed - **`kit monkey-test` required five roles and a money flow from every app.** A @@ -14,6 +32,13 @@ it. The runner passes the decision to the spec, ignores the same names from `--env-command`, and checks the evidence against the plan. +- **Five verbs no longer accept a `--mode` flag they never read.** `kit skills`, + `escalate`, `governance`, `team` and `agent-config` shared a module with + `statusline`, so the generated flag surface admitted its `--mode` for all of + them, where it did nothing. `statusline` now has its own module; passing + `--mode` to the other five is refused as an unknown flag, and `statusline` no + longer accepts the four gate flags it never read. + ### Added - **`kit monkey-test plan` detects Tauri and Electron apps.** `plan --json` @@ -23,19 +48,6 @@ `playwright-electron`). The next steps say to run debug builds on a temporary data folder, because the browser crawl cannot close, quit, or restart the app. -### Fixed - -- **The monkey-test source scan read Rust build output instead of app source.** - The scan stops at 500 files and did not skip `target/` or `.svelte-kit/`. In a - Tauri repo the Cargo build folder filled the budget first, so auth and payment - markers in the app source were never read. Both folders are now skipped. -- **A Tauri app's CSP was reported as missing.** Tauri sets the CSP in - `app.security.csp` in its config, not in HTTP headers. The security pack now - accepts a string or object value there. A `null` value still reports the - finding, because it turns the CSP off. - -### Added - - **`kit init` creates the git repository it needs.** Hooks, the staged-file secret scan and repo-scoped memory all assume a repo, and init in a bare directory used to end half-installed. It now runs `git init` first: after a yes when a person is @@ -47,17 +59,42 @@ gap, and the exact text line. A UI (a Claude Code mod, a shell prompt) can render kit's own facts instead of parsing the text form. -### Changed - -- **Five verbs no longer accept a `--mode` flag they never read.** `kit skills`, - `escalate`, `governance`, `team` and `agent-config` shared a module with - `statusline`, so the generated flag surface admitted its `--mode` for all of - them, where it did nothing. `statusline` now has its own module; passing - `--mode` to the other five is refused as an unknown flag, and `statusline` no - longer accepts the four gate flags it never read. +- **`kit monkey-test desktop` interrupts a desktop app while it works.** The + browser crawl never closed, quit, or restarted the app, so it could not find + work lost to an interruption. In one desktop app, closing the window during an + AI summary quit the app and dropped the summary without a message. The new + command drives the real debug build through a debug-only eval hook, on a + temporary data folder. One seed chooses the random clicks and the + interruptions: a configured long operation is started and then hit with + close-window, quit (SIGTERM), kill (SIGKILL), reload, or restart. After each + restart the run checks that the app starts without a crash, every data file + parses, no record or file is missing, and the operation finished or the UI + says it was interrupted. Work that disappears without a message is a finding. + The click pass also reports page errors, console errors, technical error text, + runtime placeholders, unlabeled controls, and XSS. The real data folders must + be unchanged after the run. Configuration and the hook contract are in + `docs/MONKEY_TEST.md`. ### Fixed +- **`kit skill test` called a declared `Bash` "a bounded scope".** A literal `*` fails the same + check, so the two verdicts disagreed. A bare `Bash` is no longer reported as bounded. +- **A skill description in a non-Latin script failed for "no description".** The trigger key + deleted every non-ASCII letter, so a Chinese, Cyrillic or Arabic description was empty to + the check that also passed it for having a description. The key now keeps those letters. +- **kit printed Swedish.** Six labels in `kit check` and one skill trigger phrase were Swedish. + A test now fails on Swedish letters in kit's own output, with each exception named. +- **`src/skills.ts` was a dead second lock module.** It shadowed the live one's four export + names and is removed. +- **The monkey-test source scan read Rust build output instead of app source.** + The scan stops at 500 files and did not skip `target/` or `.svelte-kit/`. In a + Tauri repo the Cargo build folder filled the budget first, so auth and payment + markers in the app source were never read. Both folders are now skipped. +- **A Tauri app's CSP was reported as missing.** Tauri sets the CSP in + `app.security.csp` in its config, not in HTTP headers. The security pack now + accepts a string or object value there. A `null` value still reports the + finding, because it turns the CSP off. + - **The statusline told a repo without `[secrets]` to run `kit secrets` forever.** With no `[secrets]` section the command resolves nothing and writes no `.env.local`, so the score stayed at 4/6 and the hint never changed. The hint now says @@ -175,6 +212,15 @@ machine. Both entries are gone, and `src/repo-lock-consistency.test.ts` fails if the committed lock again records machine-local provenance or a tool that `.kit.toml` does not declare. +- **A "bumblebee catalogs are N days old" action item stayed open with nothing to do.** When + no newer bumblebee release exists, the bundled catalogs are as fresh as upstream has + published, so the age is shown in the check detail only and no action item is opened. With a + newer release available the item is still opened, keyed on that version. +- **`kit check` read a nested Rust or Go lockfile as "nothing to scan".** The osv-scanner check + looked for `Cargo.lock`, `go.mod` and the like in the repo root only. With a lockfile in a + subproject such as `src-tauri/` and osv-scanner missing, it reported `skip` instead of the + `warn` that says those dependencies are unscanned. It now searches subfolders (five levels, + skipping `node_modules`, `target`, `.git`, `dist`, `vendor`). ### Known limitations (2026-10-12) diff --git a/README.md b/README.md index bea71c46..4367e520 100644 --- a/README.md +++ b/README.md @@ -73,6 +73,20 @@ laptop)? Wire `kit setup` + `kit memory sync` into the environment's setup scrip so it fuels itself — config, secrets (vault-backed), agent gates, identity, and recall — with zero manual steps. See [docs/ENV_FUELING.md](docs/ENV_FUELING.md). +## What's new in 7.x + +The 7.x line starts with one breaking change to the skill fingerprint. + +- **7.0.0: skill fingerprints that cover the body, and desktop apps in the Monkey test.** + The skill fingerprint now hashes the whole `SKILL.md` as a full SHA-256, so a changed + payload under a pinned name no longer reports "matches committed snapshot". Re-pin each + skill once with `kit skill test --update-snapshot`. `kit check` prints English + only. `kit monkey-test desktop` drives a real Tauri or Electron debug build with seeded + clicks and interruptions (close, quit, kill, reload, restart). The role and money-flow + gate applies only to apps that have roles or payments. `kit init` creates the git + repository it needs. Read the Breaking section in the + [CHANGELOG](CHANGELOG.md) before you upgrade. + ## What's new in 6.x The 6.x line keeps every frozen contract from 5.0 and spends its effort on making each diff --git a/contracts/kit.opencli.json b/contracts/kit.opencli.json index 4d3ff4ec..5068b25e 100644 --- a/contracts/kit.opencli.json +++ b/contracts/kit.opencli.json @@ -4896,7 +4896,7 @@ "binary": "kit", "summary": "Deterministic, local-first developer-environment manager and fail-closed governance layer for AI agents and humans.", "title": "kit", - "version": "6.12.1" + "version": "7.0.0" }, "opencliVersion": "1.0.0-alpha.12" } diff --git a/docs/COMMANDS.md b/docs/COMMANDS.md index 39552a93..b9aa260d 100644 --- a/docs/COMMANDS.md +++ b/docs/COMMANDS.md @@ -1,6 +1,6 @@ # kit commands -> Complete reference for every `kit `. Last updated 2026-09-30 (kit 6.12.1). +> Complete reference for every `kit `. Last updated 2026-10-14 (kit 7.0.0). > Pair this with `docs/THREAT_MODEL.md` (what data flows where) and > `docs/DATA_FLOW.md` (exact reads/writes per op). diff --git a/package-lock.json b/package-lock.json index 70fa0753..28a9d810 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "sandstream-kit", - "version": "6.12.1", + "version": "7.0.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "sandstream-kit", - "version": "6.12.1", + "version": "7.0.0", "license": "MIT", "workspaces": [ "packages/*" diff --git a/package.json b/package.json index d12b2ad4..7b0c4b03 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "sandstream-kit", - "version": "6.12.1", + "version": "7.0.0", "description": "developer kit. zero LLM, local-first, multi-vault. one command from git clone to working dev environment.", "license": "MIT", "funding": "https://buymeacoffee.com/sandstream",