Skip to content

Release 2.0.63 (2026-05-27)

Bug fixes

  • output shell strings instead of JSON arrays The CLI is the translation layer between Python's list[str] command model and shell consumers that need eval-able strings. Use shlex.join() for proper shell quoting instead of json.dumps(), and rename output keys to match what the composite action expects (build, publish, credential-secret).

  • replace _checks_registered with SHA-pinned REST API query

  • make wait_for_checks commit-aware and drop fail-fast
  • update release subprocess wait_for_checks to use SHA-pinned flow
  • rename local variable to avoid CodeQL false positive The variable held an environment variable name (e.g. PYPI_TOKEN), not an actual secret. Renaming from credential_secret to env_name avoids triggering CodeQL clear-text-logging-sensitive-data pattern matching.

Documentation

  • add commit-aware check waiting design spec
  • apply pushback review findings to check-waiting spec
  • add commit-aware check waiting implementation plan

Features

  • host-path-preserving workspace mount and Claude sub-mounts Make VM workspace mount path-preserving (VM path = host path) so Claude Code derives identical project memory keys regardless of environment. Add ~/.claude/projects (rw) and ~/.claude/skills (ro) mounts to persist session transcripts, memory, and skills across VM rebuilds. Update session workdir to use identity projects_dir instead of hardcoded /projects. Ref #1205

  • add head_sha() to resolve PR HEAD commit

Refactoring

  • remove unused _NO_CHECKS_PHRASE constant

Styling

  • apply ruff formatting to modified files