chore(release): v0.12.0

Merged
SA
2mo ago
+596-19

Issue for this PR

Closes #

Release PR for v0.12.0. It closes no single issue; the six deferred findings from this release's review are tracked as #1321–#1326.

Type of change

  • Bug fix
  • New feature
  • Documentation

What does this PR do?

Everything the release ships — the /workspace menu and prompt identity (#1278), sidebar sync status (#1279), extension tools in the prompt (#1291), skill publish (#1280, #1313), and the three fixes (#1306, #1318, #1319) — is already on main. This PR carries only what the release process produces on top of that:

  1. Review fixes (e5ee6e7cf9), from a five-persona pre-release review of v0.11.2..main, every item small enough to land here rather than in a follow-up:
    • skill publish is registered only under ALTIMATE_WORKSPACE=1, like link. Outside the pilot it showed in --help and its "not linked" error told users to run a link command that does not exist for them. skill list now hints the command when the pilot is on.
    • The publish junk filter refuses the credential shapes that arrive in a skill folder by copy or habit: private keys and certificates (id_rsa, *.pem, *.key, *.p12, …), .npmrc/.netrc/.pypirc, credentials.json, secrets.*, and the .ssh/.aws/.gnupg/.altimate directories. Still a filename blocklist (a config.yaml holding a token ships) — #1321 tracks a content scan or a pre-upload preview.
    • test/installation/ownership.test.ts called bunGlobalRoot without an env, so it read the developer's real BUN_INSTALL and was red on any machine where bun had ever installed this package globally (two reviewers reproduced it independently).
    • Docs: skill publish and the "Publish to workspace" action in skills.md; a "Workspaces (pilot)" note in cli.md; a garbled comment in link.ts.
  2. release: v0.12.0 (e37a5c171b): the ## [0.12.0] CHANGELOG entry and test/skill/release-v0.12.0-adversarial.test.ts (37 tests over the junk filter, assertProjectSkill, inertWorkspaceName, flattenToolParts, the .synced-at marker reader, and the install resolver against hostile input — two guards were mutation-checked by deleting them and watching the tests fail).

main's ruleset requires a PR for any push. Once this merges I'll tag v0.12.0 on the new main tip, which triggers the release workflow.

How did you verify your code works?

  • bun test over test/altimate, test/cli, test/installation, the flatten/llm suites and the new adversarial file: 6367 pass / 673 skip / 1 fail — the one failure was tracing-rename-race.test.ts on a disk with 568 MiB free (it writes 52 MB × 10 trials); it passes 8/8 after freeing space and is untouched by this release. The full suite ran earlier on a7f328f000 (6251 pass; the 11 failures are pre-existing timeouts in sample_setup/validator e2e files that also fail on v0.11.2).
  • tsgo --noEmit clean; upstream marker guard clean (--markers --base origin/main --strict).
  • OPENCODE_VERSION=0.12.0 bun run pre-release: all four checks pass; the dist binary, run by path, reports 0.12.0, hides skill publish without ALTIMATE_WORKSPACE=1 and shows it with it.
  • script/release-preflight.ts --version 0.12.0 --stage tag: PASSED.
  • Earlier in this cycle, every workspace change in the release was exercised end to end against freemium with throwaway workspaces (see #1278/#1279/#1280/#1313/#1319 threads).

Screenshots / recordings

N/A — no UI change beyond the skill list hint line.

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

🤖 Generated with Claude Code

https://claude.ai/code/session_012Q51zFUmPg1WwtS5CrGJE6

Summary by cubic

Release PR for v0.12.0: the payload is already on main, and this PR carries the pre-release review fixes, the CHANGELOG entry, and a new adversarial test file. The six deferred review findings are tracked as #1321–#1326.

  • skill publish (CLI) and the TUI "Publish to workspace" row are registered only under ALTIMATE_WORKSPACE=1, like link; outside the pilot they are hidden rather than telling users to run a link command that is not registered for them, and skill list hints the command when the pilot is on.
  • The publish junk filter now refuses private keys and certificates (id_rsa, *.pem, *.key, *.p12), .npmrc/.netrc/.pypirc, credentials.json, secrets.*, and the .ssh/.aws/.gnupg/.altimate directories, case-insensitively.
  • The filter stays a filename blocklist, so a config.yaml holding a token still ships; #1321 tracks a content scan.
  • ownership.test.ts now passes an env to bunGlobalRoot instead of reading the developer's real BUN_INSTALL.
  • Docs gain skill publish, the "Publish to workspace" action, and a "Workspaces (pilot)" section in cli.md.
  • The new release-v0.12.0-adversarial.test.ts (37 tests) pushes hostile input at the junk filter, assertProjectSkill, inertWorkspaceName, flattenToolParts, the .synced-at reader, and install resolution.
  • After merge, tag v0.12.0 on the new main tip to trigger the release workflow.

Summary by CodeRabbit

  • New Features
    • Added pilot workspace management with linking status, memory and skill sync indicators, refresh/sync/unlink actions, and quick workspace creation.
    • Added publishing of project skills to a linked workspace.
    • Added live extension-tool names to agent prompts.
  • Bug Fixes
    • Improved handling of unknown installation methods during upgrades and uninstallations.
    • Fixed toolless requests, workspace linking, and pilot-only skill commands.
    • Prevented sensitive and temporary files from being included in published skills.
  • Documentation
    • Added workspace and skill-publishing guidance to the CLI and skills documentation.