chore(release): prepare v0.8.0 - #25
Merged
Merged
Conversation
Harden Git subprocesses on Windows, report AGY authentication as unverifiable instead of inferring Gemini OAuth, and position AGY as a first-class conditional engine across runtime and documentation. Constraint: Keep Gemini-only and AGY-only installations valid Rejected: Make AGY a universal hard dependency | It would break existing Gemini-only installations Confidence: high Scope-risk: moderate Not-tested: Real macOS AGY 1.1.2
There was a problem hiding this comment.
Pull request overview
This PR prepares the v0.8.0 release by hardening Git invocation on Windows (shell:false for all Git helper calls), promoting AGY from “fallback” to a first-class supported engine (while keeping Gemini→AGY ordering for auto), and making AGY authentication reporting explicitly “unknown/unverifiable” instead of inferred from Gemini OAuth. It also updates tests and documentation to reflect the new engine/auth semantics and bumps all version sources to 0.8.0.
Changes:
- Force all Git helper invocations through
shell:falseand add a regression test to ensure repository-derived refs with shell metacharacters remain literal. - Change AGY auth reporting to
state:"unknown"/verifiable:falseand update setup rendering/tests/docs accordingly. - Bump release/version artifacts to 0.8.0 and update release notes, skills, and setup guidance for first-class AGY.
Reviewed changes
Copilot reviewed 23 out of 24 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/runtime.test.mjs | Updates setup/runtime assertions for AGY availability, new auth state fields, and new non-JSON labels. |
| tests/render.test.mjs | Updates rendered setup report expectations to include AGY auth detail line. |
| tests/helpers.mjs | Allows explicit shell override to support Git security regression tests. |
| tests/git.test.mjs | Adds regression test ensuring default-branch auto-detection doesn’t enable shell metacharacter execution. |
| tests/fake-gemini-fixture.mjs | Renames fixture comments from “fallback” framing to “availability” framing. |
| tests/commands.test.mjs | Updates setup command documentation tests for first-class engine wording and curl allowance. |
| README.zh-TW.md | Updates Traditional Chinese docs for first-class AGY framing, auth guidance, and v0.8.0 pinning. |
| README.md | Updates English docs for first-class AGY framing, auth guidance, and v0.8.0 pinning. |
| plugins/gemini/skills/gemini-prompting/references/gemini-prompt-antipatterns.md | Clarifies AGY stdout behavior differences across versions while keeping transcript recovery authoritative. |
| plugins/gemini/skills/gemini-cli-runtime/SKILL.md | Updates skill guidance to reflect first-class engines and revised engine-routing wording. |
| plugins/gemini/scripts/lib/render.mjs | Updates setup status label from “AGY fallback only” to “AGY available”. |
| plugins/gemini/scripts/lib/process.mjs | Updates security comment to remove Git from bare-name shell-fallback list. |
| plugins/gemini/scripts/lib/git.mjs | Forces shell:false for all Git helper calls to prevent shell reinterpretation on Windows. |
| plugins/gemini/scripts/lib/gemini.mjs | Changes AGY auth reporting to unknown/unverifiable and renames runtime label from fallback to plain AGY. |
| plugins/gemini/scripts/lib/failures.mjs | Updates “binary missing” guidance to treat both engines as supported options. |
| plugins/gemini/scripts/lib/engine.mjs | Updates auto routing commentary and adjusts “no engine found” error text. |
| plugins/gemini/scripts/gemini-companion.mjs | Adds agyAvailable + keeps compatibility alias, updates next steps text (but has a readiness logic bug for --engine gemini). |
| plugins/gemini/NOTICE | Updates attribution wording from “fallback handling” to “engine handling”. |
| plugins/gemini/commands/setup.md | Updates setup command guidance for first-class engines and allows curl installer tool usage. |
| plugins/gemini/CHANGELOG.md | Adds v0.8.0 release notes covering Git hardening, engine status changes, and auth semantics. |
| plugins/gemini/.claude-plugin/plugin.json | Bumps plugin version to 0.8.0. |
| package.json | Bumps package version to 0.8.0. |
| package-lock.json | Bumps lockfile package version entries to 0.8.0. |
| .claude-plugin/marketplace.json | Bumps marketplace metadata/plugin versions to 0.8.0. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
192
to
+196
| const agySelected = requestedEngine === "agy"; | ||
| const geminiReady = geminiStatus.available && geminiAuth.loggedIn; | ||
| const agyFallbackAvailable = agyStatus.available; | ||
| const agyAvailable = agyStatus.available; | ||
| // Backward-compatible alias retained for existing JSON consumers. AGY is a | ||
| // first-class supported engine; "fallback" describes only auto-routing order. |
Comment on lines
229
to
233
| if (agySelected && agyStatus.available) { | ||
| nextSteps.push( | ||
| "AGY is installed, but its authentication state cannot be verified non-interactively. Run an `--engine agy` command to confirm it is logged in." | ||
| ); | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
shell:falseso repository-derived refs stay literal on Windowsunknown/unverifiable instead of inferring Gemini OAuthCompatibility
agyFallbackAvailableremains as a compatibility alias andagyAvailableis additiveValidation
npm test: 238 tests, 235 passed, 0 failed, 3 expected POSIX-only skips on Windowsnpm run check-version: pass for 0.8.0npm run verify-contracts: passgit diff --check: passagyAvailable:true,authState:"unknown",authVerifiable:falseCloses #18