Tags: jlevy/kash
Tags
Tooling and project-scaffolding release; no library code changes. - **Rolling dependency cool-off**: resolution now enforces a rolling 14-day release-age floor (`tool.uv.exclude-newer = "14 days"`, with `required-version >=0.9`), exported as `UV_EXCLUDE_NEWER` by the Makefile and CI so ad-hoc commands inherit the policy. Replaces the fixed-date form from v0.4.0. - CI and publish workflows pin **uv 0.11.25 by checksum**; the lockfile-drift gate (`uv lock --check`) and the Python 3.11–3.14 matrix carry over. - Updated to **simple-modern-uv v0.4.0**: docs now live under `docs/` (development, installation, publishing), `AGENTS.md`/`CLAUDE.md` are committed files, and `devtools/lint.py` gains a `--check` mode (used by CI) with a matching `make lint-check` target. - **`docs/publishing.md` now includes an agent-runnable end-to-end release runbook**: release-notes guidance, a no-`gh` fallback (annotated tag + `workflow_dispatch`), scriptable PyPI confirmation and smoke test, and the downstream pin-bump order for the kash repos. - Installed the `simple-modern-uv` agent skill alongside `tbd` (managed under `.agents/skills/` with `skills-lock.json`). v0.4.0...v0.4.1
- **Standalone action runner**: `kash.run()` lets you invoke kash act… …ions programmatically as a library, without starting the shell. - **Clean public API surface**: canonical imports with explicit `__all__`, so `import kash` exposes a stable, documented API. - **Minimal installs via optional dependency groups**: `kash-shell[llm]`, `[web]`, `[media]`, `[server]`, `[shell]`, or `[all]` — the default install keeps the full toolset for backward compatibility, but slim installs are now possible. - Faster startup: action and command registration is now lazy. - **litellm upgraded to 1.90.0**, past every known litellm advisory (PYSEC-2026-390, PYSEC-2026-388, CVE-2026-35029, CVE-2026-42271, CVE-2026-47101, CVE-2026-47102), with an explicit `litellm>=1.84.0` security floor. The `openai==1.99.9` pin is relaxed and now resolves to openai 2.x (2.44.0 in the lock). `pip-audit` on the resolved environment reports no known vulnerabilities. - **Supply-chain cool-off**: dependency resolution now enforces a 14-day release-age floor (`tool.uv.exclude-newer`), and CI fails on lockfile drift (`uv lock --check`). See [supply-chain-hardening](https://github.com/jlevy/supply-chain-hardening). - Hardened agent session hooks: the gh CLI installer works in a private temp dir with cleanup, Codex hooks resolve from the git root so they work from subdirectories, and the pinned tbd fallback carries an on-the-record cool-off exception. - **xonsh 0.23 compatibility**: unloading the fnm xontrib no longer crashes (xonsh removed `Event.handlers`; the handler is now removed via the new set-like Event API). xonsh floor is now `>=0.23.0`. - **Table conversion**: markdownify 1.x stopped promoting the first row of header-less tables to a Markdown header, which degraded docx and scraped-HTML conversions; `table_infer_header=True` restores the previous behavior (markdownify floor is now `>=1.2.2`). - Both fixes are covered by new regression tests. - All dependencies upgraded to current releases under the cool-off policy, including deepgram-sdk 7.4, rich 15.0, mcp 1.28, fastapi 0.138, pydantic 2.13, and the current strif/flowmark/chopdiff/clideps/frontmatter-format/sidematter-format releases. - Python 3.11–3.14 supported (3.14 added to the CI matrix). - Major test expansion: pure-function and mocked tests across the action registry, argument resolution, preconditions, selections, completion scoring, and LLM completion, plus integration tests for the action pipeline — 303 tests passing. **Full commit history**: v0.3.37...v0.4.0
chore: Upgrade dependencies and fix breaking changes - Upgrade all dependencies via `uv sync --upgrade` - Convert 11 str+Enum classes to StrEnum (ruff UP042) - Fix pyrate-limiter v4 API: move blocking/timeout to try_acquire() Key upgrades: pandas 3.0, pyrate-limiter 4.0, mcp 1.26, xonsh 0.22, huggingface-hub 1.4, fastapi 0.128, ruff 0.15 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
PreviousNext