v0.9.1

What's Changed

Features

• Merge pull request #964 from AltimateAI/upstream/merge-v1.17.9 (f9c3034)
• feat: add source field to session_start telemetry (#968) (f376fef)
• feat: add /release-beta skill — cut a beta to the npm beta channel (latest users untouched) (3b16acc)
• feat: [release] enable safe beta releases (channel-from-tag + prerelease ordering) (b7f5a61)
• feat: restore three fork behaviors deferred during the v1.17.9 re-home (audit findings) (ae16338)
• feat: [v1.17.9] fully restore prompt-enhance via api.prompt.active() extension (checkpoint 13) (1b691bd)
• feat: [v1.17.9] port 4 fork TUI features to host-registered plugins (checkpoint 12) (74f73fa)
• feat: [v1.17.9] fork TUI features as host-registered plugins — ADR + scaffold (checkpoint 11) (1b8fd97)

Bug Fixes

• fix: [release] scope MCP annotation-hint classifier to the path array (acda69c)
• fix: [merge] tighten MCP annotation-hint error classifier (codex review) (dcea826)
• fix: [merge] fold MCP Fabric tolerance into catalog's gated listTools (5abec22)
• fix: [#791][#792] support bearer-auth remote MCP servers (Microsoft Fabric, etc.) (#793) (986641e)
• fix: [release] pre-publish smoke test also targets altimate-code (d009fd9)
• fix: [release] smoke-test the shipped binary (altimate-code) after de-dupe (bcb0f8a)
• fix: [release] de-dupe platform binary (npm E413) + restore pre-release alias (37e6fd0)
• fix: [release] unblock release workflow — full-typecheck deps + Verdaccio .dockerignore (37864cd)
• fix: [merge] upstream_fix: don't blank unresolved ${VAR} — fixes bedrock region (6765d87)
• fix: [merge] round-4 regression review — complete jsonc support + lock reviewer safety (a26f586)
• fix: [merge] round-3 findings — env-flag regressions + cli debug/import (round 3) (5e287ce)
• fix: [merge] bot-review findings — config jsonc/cache, tui server-config, ci filter (3d48a58)
• fix: [security] MCP tools were executing with NO permission check (e7ec6a9)
• fix: [merge] 8 shipped-path bugs from proactive codex review (round 2, tui+server) (def7a55)
• fix: [merge] 15 shipped-path bugs from proactive codex review (round 1) (383eaf1)
• fix: [merge] 4 shipped-path bugs from PR review (fresh-install, data-loss, +2) (b57aa69)
• fix: [release] derive release version from the fork package, not upstream opencode-ai (c357612)
• fix: [merge] preserve provider-executed flag on tool part metadata (14a72bc)
• fix: [security] make the #209 sensitive-write guard actually fire (8c74589)
• fix: [merge] restore 5 dropped upstream fixes + 3 unwired auth plugins (release board) (b0ade91)
• fix: [release] bump release.yml Bun 1.3.10 -> 1.3.14 (was release-blocking) (386e653)
• fix: [merge] restore fork-wanted refinements + branding (audit judgment calls) (7232b34)
• fix: [merge] restore dropped upstream behavioral refinements (audit findings) (00dde08)
• fix: [upgrade] make migration-journal marking idempotent (stop per-launch row growth) (27c4905)
• fix: close unclosed marker in db.ts + update reviewer pin tests to the #978 ask design (01833e8)
• fix: restore codesearch for explore agent + gather prompt.skills keybind (merge drops) (98933b3)
• fix: [#976] clicking a truncated URL now opens the full URL (1794048)
• fix: [#971][#972][#974] dedupe /mcps autocomplete, surface MCP auth command, calm /feedback (c4a474f)
• fix: [#973][#975] restore Ctrl+A/Ctrl+E in prompt + history recall from a non-empty prompt (a30e477)
• fix: [#978] make reviewer mode usable — external reads prompt, bash asks, webfetch allowed (ab83ed5)
• fix: [merge] route /experimental/workspace to the HttpApi (was 500 via proxy) (555ac7f)
• fix: [merge] restore config env-interpolation telemetry (c75f793)
• fix: [merge] restore file diffs in shared sessions (c7c7f5e)
• fix: [merge] idempotent DB migration adopt — stop "duplicate column" startup crash (cf62f1f)
• fix: [merge] restore ACP altimate-backend default-model preference (89eaf01)
• fix: [merge] MCP hardening — stderr-drain hang, OAuth-state leak, silent failures (ded1893)
• fix: [merge] restore read-only guard on db <query> (was able to DELETE/DROP user data) (c87d59d)
• fix: [merge] restore session-level diff so the modified-files sidebar works again (b5715e7)
• fix: [merge] CRITICAL — skill remove customize-opencode could rm -rf the cwd (2df6c8f)
• fix: [merge] default thinking to hidden for upgraders too (not just fresh installs) (e695b53)
• fix: [merge] stop models echoing the date — carry it in , not the user turn (ea55ba9)
• fix: [merge] load project tools from .altimate-code/tools, not only .opencode/tools (c224354)
• fix: [merge] prevent fff SIGTRAP crash when TUI is launched from ~ or / (e29c065)
• fix: [merge] address two shipped-path review findings from the v1.17.9 PR (c44e0a9)
• fix: [storage] adopt core-owned schema on fresh installs (fresh-DB ship-blocker) (57584ed)
• fix(test): mcp-add asserts the altimate-code global config dir (34a11d7)
• fix: restore fork behaviors silently dropped by the v1.17.9 overlay merge (732a20d)
• fix(test): use ripgrep (OPENCODE_DISABLE_FFF) in subprocess tests — real linux-CI root cause (1db1181)
• fix(test): disable embedded web UI in subprocess test env (real root cause of linux CI red) (59b27ad)
• fix(ci): run subprocess tests via bun run src (not the binary) in the bounded pass (89ded86)
• fix(ci): run subprocess tests in a dedicated bounded pass (kill load-variance flakes) (e256ddf)
• fix(mcp): restore dropped MCP.remove + bunRun harness opt for error-path subprocess tests (7d664a7)
• fix: skip background @opencode-ai/plugin install under OPENCODE_PURE (CI subprocess hang) (3501636)
• fix: restore dropped --trace fork-fix + revert prebuilt-binary test de-flake (fe9f996)
• fix: load builtin DE skills into the live registry (merge dropped them) — shipped regression #3 (6e33598)
• fix: restore #209 sensitive-write guard dropped by the merge (shipped security regression #2) (baa8ca9)
• fix: restore symlink-aware project boundary the v1.17.9 merge dropped (shipped security regression) (65344da)
• fix: revert the v2-httpapi upgrade guard (broke its happy-path test; tree is unused) (b821039)
• fix: CI de-flake — OPENCODE_TEST_CLI must be absolute (CI passed relative); grep TOCTOU hardening (9fbe4d0)
• fix: address codex pass-2 findings (grep symlink-FILE bypass + publishable-channel allowlist) (b63660f)
• fix: de-flake CI subprocess tests via prebuilt test CLI + larger spawn timeout (056d375)
• fix: address codex deep-review findings (grep containment robustness, upgrade guards, prune isFile) (f6e79a4)
• fix: revert TUI wordmark to the clean uppercase ALTIMATE CODE block font (70436fc)
• fix: worker console guard also intercepts console.* (Bun bypasses process.stdout.write) (c60eb12)
• fix: prune trace files by mtime, not filename — TUI session traces were deleted on write (d524947)
• fix: systemic TUI log-hygiene guard so logging stops regressing on upstream merges (0ae4c7a)
• fix: three TUI/runtime issues from the Altimate Code Issues report (f647f6e)
• fix: address Kilo review findings on PR #964 (v2-core security + migration soundness + sync-trace exporters) (4c46533)
• fix: [v1.17.9] finalizeSync applies maxFiles pruning on the sync shutdown path (Kilo review) (f5ecdd8)
• test: [v1.17.9] de-flake M2 trace rename-race test (fixed-wait → poll under CI load) (a43d9a5)
• fix: [v1.17.9] lowercase TUI wordmark ("altimate code", not "ALTIMATE CODE") (630a4b2)
• fix: [v1.17.9] restore TUI session tracing — sync finalize on the quiet worker thread (50b295d)
• fix: [v1.17.9] stop log shim from flooding the TUI (quiet by default, lazy --print-logs) (ad005a7)
• fix: [v1.17.9] address codex PR #964 review comments (active-path subset) (d074d0f)
• fix: [v1.17.9] name WorkspaceContext ALS "workspace" not "instance" (55b23f1)
• fix: [v1.17.9] root-fix InstanceRef ALS split — bootstrap provides on canonical Instance context (591e711)
• fix: [v1.17.9] align server auth default username to "opencode" (codex PR review P1) (a3dc9f0)
• fix: [v1.17.9] restore skill list (read via server) + tracing/skill regression tests (14143ab)
• fix: [v1.17.9] restore session tracing — read tracing config via server client (761a660)
• fix: [v1.17.9] lazy-load playwright-core so trace-viewer e2e skips cleanly in CI (c2a7fa5)
• fix: rebrand residual OpenCode leaks surfaced by TUI visual inspection (95ab133)
• fix: [v1.17.9] eliminate test-suite DB migration race (table project already exists) (86be045)
• fix: bump CI bun-version 1.3.10 -> 1.3.14 to match merged runtime requirement (117b6b0)
• fix: [v1.17.9] TUI /api routing flood + branding 198->0 + require-markers config (CI green) (2c3d2ed)
• fix: [v1.17.9] build.ts stale TUI worker entry path (cli/cmd/tui -> cli/tui) (2999398)
• fix: [v1.17.9] audit follow-ups — partial branding (215->198) + TaskTool permission wiring (6beae93)
• fix: [v1.17.9] restore 8 dropped v1.17.9 session behaviors (autonomous panel consensus) (95d1680)
• fix: [v1.17.9] fix-everything batch 1 — server v2-location, Account dedup, formatValidationError, +1 session (ckpt47) (01d0aac)
• fix+test: [v1.17.9] DB split-brain fix + wave-2 triage; revert ec36 config regression (ckpt38) (cdfe5e0)
• fix: [v1.17.9] resolve bootstrap deadlock — agent runs end-to-end (checkpoint 36) (9e5d731)
• fix: [v1.17.9] resolve runtime circular-init via lazy LayerNode deps (checkpoint 34) (45b2262)
• fix: [v1.17.9] Env wrappers must be synchronous (checkpoint 16) (a1085ba)
• wip: v1.17.9 reconciliation — §4 re-home TUI customizations into packages/tui (checkpoint 5) (2a22e6b)

Other Changes

• release: v0.9.1 (9e1dc7e)
• docs: [release] document headersCommand + fix release-notes prev-tag selection (4baf41b)
• ci: add aireceipts auto-attach hook (two-file kit) (#994) (ddc8864)
• merge: bring ori...

v0.9.0-beta.2

What's Changed

Features

Bug Fixes

• fix: [release] pre-publish smoke test also targets altimate-code (d009fd9)
• fix: [release] smoke-test the shipped binary (altimate-code) after de-dupe (bcb0f8a)
• fix: [release] de-dupe platform binary (npm E413) + restore pre-release alias (37e6fd0)

Other Changes

• docs: [release-beta] add the local pre-tag gates the skill was missing (932d002)

Install

npm install -g @altimateai/altimate-code@0.9.0-beta.2
# or
brew install AltimateAI/tap/altimate-code

Full Changelog: v0.9.0-beta.1...v0.9.0-beta.2

v0.8.10

What's Changed

Features

Bug Fixes

• fix(opencode): move volatile date out of cached system prefix (#950) (df50da4)
• fix: [#958] make Windows installer Pester env injection deterministic (#959) (a412cef)

Other Changes

• release: v0.8.10 (f0fb1e1)
• docs: clarify v0.8.10 date-cache comment (long-lived vs rolling breakpoint) (fb8ea64)

Install

npm install -g @altimateai/altimate-code@0.8.10
# or
brew install AltimateAI/tap/altimate-code

Full Changelog: v0.8.9...v0.8.10

v0.8.9

What's Changed

Features

Bug Fixes

• fix: address v0.8.8 pre-release review findings (3443829)
• fix: wrap diverged upstream lines in altimate_change markers (#844, #937) (2a9e8c5)

Other Changes

• release: v0.8.9 (8fea433)
• test: add v0.8.8 adversarial suite; fix ineffective MCP config parse-guard (84da8e3)

Install

npm install -g @altimateai/altimate-code@0.8.9
# or
brew install AltimateAI/tap/altimate-code

Full Changelog: v0.8.8...v0.8.9

Windows Powershell installer updates

What's Changed

Features

• fix(install): resilient latest-version fetch (both installers) (#946) (dfe0364)
• feat(install): verify release archive checksums in both installers (#942) (31e73d0)
• feat: IDE-aware datamate transport, enabled-state persistence, and /mcps command (#893) (07eaa94)
• feat: [AI-6949] add session transcript REST endpoint for datamates extension (#941) (ae69109)
• feat: Windows PowerShell installer (install.ps1) (#930) (faf0b61)

Bug Fixes

• fix(install): resilient latest-version fetch (both installers) (#946) (dfe0364)
• fix: increase DEFAULT_CHUNK_TIMEOUT from 2min to 5min (#844) (7039545)
• fix: auto-resolve question tool in non-interactive contexts (#937) (9644a00)
• fix: bubble real dbt show error instead of generic "Could not parse" (#933) (37072bc)
• fix: trigger auto-update check on headless serve startup (#940) (fd9d7c7)

Other Changes

• test: add release-validation coverage for post-v0.8.7 merged PRs (#952) (f8b3454)
• serve: log trace directory on startup (#929) (3a8d1c0)

Install

npm install -g @altimateai/altimate-code@0.8.8
# or
brew install AltimateAI/tap/altimate-code

Full Changelog: v0.8.7...v0.8.8

v0.8.7

What's Changed

Features

• feat: wire altimate-core 0.5.1 equivalence dialect + decidable (#928) (53127b7)
• feat: verified query optimization via altimate_core_rewrite verify_equivalence mode (#918) (1748c37)
• feat: per-turn tool retrieval (trim tool-definition context flood) (#858) (88b7f6f)
• feat: dispatch centralized ocr/Gemini review on PR ready (gated loop) (#914) (c2019ba)

Bug Fixes

• fix: pin release-v0.8.5 gate to constant version (was breaking on every later release) (#923) (5c1fedf)

Other Changes

• release: v0.8.7 (146acea)
• chore: bump @altimateai/altimate-core to 0.5.1 (#925) (ea6a2a0)
• Make dbt PR reviewer demo-parity reliable (#919) (2aa8b0e)
• Fix dbt YAML review file classification (#920) (954cc32)

Install

npm install -g @altimateai/altimate-code@0.8.7
# or
brew install AltimateAI/tap/altimate-code

Full Changelog: v0.8.6...v0.8.7

v0.8.6

What's Changed

Features

Bug Fixes

• fix: address v0.8.6 release-review findings (ecc7001)
• fix: write session traces in headless serve mode (#886) (ed1eecd)

Other Changes

• release: v0.8.6 (f52da2d)

Install

npm install -g @altimateai/altimate-code@0.8.6
# or
brew install AltimateAI/tap/altimate-code

Full Changelog: v0.8.5...v0.8.6

v0.8.5

What's Changed

Features

Bug Fixes

• fix: harden dbt review action version lookup and credential write (#911) (b7d15ee)
• fix: prepare dbt review action for v0.8.5 (#900) (3572f1c)
• fix(tracing): reliability follow-ups from v0.8.4 review (#901, #902, #903) (#905) (49fd9be)
• fix(tooling): marker guard no longer false-positives on changes deep inside a pre-existing block (#904) (db81d41)

Other Changes

• release: v0.8.5 (5ffeadb)

Install

npm install -g @altimateai/altimate-code@0.8.5
# or
brew install AltimateAI/tap/altimate-code

Full Changelog: v0.8.4...v0.8.5

v0.8.4

What's Changed

Features

Bug Fixes

• fix(tracing): clarify interrupted-span message so restarts aren't read as agent failures (3982d8d)
• fix(tracing): trace waterfall + summary prompt + chat tab all lose data after each agent turn (#895) (89699f6)

Other Changes

• release: v0.8.4 (d2cf6b3)
• test: harden v0.8.3 plan-mode trust-boundary tests + fix nested marker tracking (#899) (7e909a9)

Install

npm install -g @altimateai/altimate-code@0.8.4
# or
brew install AltimateAI/tap/altimate-code

Full Changelog: v0.8.3...v0.8.4

v0.8.3

What's Changed

Features

Bug Fixes

• fix: harden #888 plan-mode hoist — behavioral trust-boundary tests + warning copy (823a016)
• fix: plan-mode refusals on altimate-default + warning false-positive (#887) (#888) (f5e10cc)

Other Changes

• release: v0.8.3 (daa0351)

Install

npm install -g @altimateai/altimate-code@0.8.3
# or
brew install AltimateAI/tap/altimate-code

Full Changelog: v0.8.2...v0.8.3