chore(release): v0.12.3

Merged
SA
2mo ago
+195-18

Issue for this PR

Release PR — no issue. Promotes the v0.12.2..HEAD payload (#1361: Altimate Base default with no consent gate; #1357: workspace routing-pin fix) to latest, with the fixes from this release's five-persona review.

Type of change

  • Other: release

What does this PR do?

Five commits on top of #1361/#1357, all from the v0.12.3 release review (CTO, PM, End User, Tech Lead, Chaos Gremlin = Support Engineer):

Review consensus: 4/5 SHIP WITH NOTES, 1/5 SHIP (Tech Lead). Two confirmed P0s, both fixed:

  • P0 (Chaos Gremlin): altimate agent create and altimate review never called FreeTier.autoRegisterWithin() before resolving a provider — unlike run/tui/serve/acp/web. On a fresh install, agent create leaked a raw upstream error mentioning "OpenCode" with no remediation, and review's AI lane silently produced zero findings with no visible signal. Wired both with the same pattern the other five entrypoints use; extended the entrypoint-late-notice-wiring pin test to cover both.
  • P1 (End User): tui.ts's up-to-3s auto-register wait gave zero terminal feedback on a fresh install — reads as a hang. Added a 300ms-gated status line.
  • P2 (CTO + PM, independently): altimate-base-disclosure.ts's header comment still described a pre-credential consent gate this release removed. README's "Step 1... required before anything works" contradicted the very next sentence about auto-registration. Both fixed.
  • Investigated and closed out (CTO + Tech Lead): the "Kilo Code Review" GitHub check shows FAILURE on #1361's merge commit despite a clean-looking bot summary comment. Traced all 9 individual Kilo findings against the actual current code (not just the summary) — every one was already fixed by a later commit within #1361's own history; nobody had clicked "Resolve conversation." Not a real blocker. Found and removed one harmless leftover duplicate // altimate_change end marker along the way.

Deferred, not blocking: security-faq.md's "secrets are automatically masked" claim (Tech Lead — gateway-side behavior this repo can't verify, needs a backend/security owner) and unconditional background registration for users with their own model already configured (End User — already documented as accepted/deferred behavior in #1361's own "Residuals" list, R1).

Adversarial test (release-v0.12.3-adversarial.test.ts) covers the new code from these fixes: autoRegisterWithin() ordering/scoping invariants in agent.ts/review.ts, the tui.ts feedback timer's delay bounds and cleanup, and a regression guard on the duplicate marker.

How did you verify your code works?

  • bun run typecheck (opencode package): clean
  • bun run script/upstream/analyze.ts --markers --base origin/main --strict: clean
  • test/altimate/entrypoint-late-notice-wiring.test.ts + test/cli/agent-create.test.ts + test/server/altimate-base-registration.test.ts: 24 pass
  • test/altimate/review-ci.test.ts + test/altimate/review.test.ts + test/altimate/review-runner.test.ts: 131 pass
  • test/context/stale-zen-cycle.test.tsx + test/context/altimate-base-disclosure-notice.test.tsx + test/cli/tui/dialog-model-welcome.test.tsx (packages/tui): 13+8 pass
  • test/skill/release-v0.12.3-adversarial.test.ts: 8 pass
  • Mutation-tested the tui.ts try/finally assertion directly against the source (removed the finally/clearTimeout, confirmed the change was real before trusting it, then restored)
  • Diffed every one of the 9 Kilo Code Review findings against their originally-commented commit vs. current HEAD to confirm each was actually fixed, not just assumed stale

Screenshots / recordings

N/A — CLI/TUI text output and doc changes, no UI screenshots applicable.

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

Summary by cubic

Promotes the v0.12.2..HEAD payload to latest, with fixes from the v0.12.3 five-persona release review and the release changelog.

  • altimate agent create and altimate review now auto-register Altimate Base before resolving a provider, fixing raw upstream errors and silent zero-finding AI reviews on fresh installs.
  • The TUI's auto-register wait now shows a "Connecting to Altimate Base…" status line after 300ms instead of appearing to hang.
  • Removed stale consent-gate wording from altimate-base-disclosure.ts and the README.
  • Added adversarial tests covering the new code.

Summary by CodeRabbit

  • New Features
    • Altimate Base is selected automatically when no AI provider is configured, replacing keyless Zen as the fallback. This also applies when creating agents or running reviews on a fresh install.
    • Registration no longer requires a confirmation prompt; an opt-out remains available.
  • Updates
    • The terminal displays “Connecting to Altimate Base…” if registration takes more than 300 milliseconds.
    • The onboarding notice appears after registration or alongside it in headless environments.
  • Bug Fixes
    • Pinned-workspace routing now follows the pinned workspace rather than the project’s own link.