Skip to content

v1011-release-notes.md

Latest commit

 

History

History
166 lines (134 loc) · 6.69 KB

v1011-release-notes.md

File metadata and controls

166 lines (134 loc) · 6.69 KB
Raw

Code Mower v1.0.11 Release Notes

Code Mower v1.0.11 is a release-qualification patch. It moves canonical hosted Devin campaigns onto the bounded, pollable Devin Sessions API v3 transport, and it lets macOS Claude release qualification cold-install an exact PyPI release again without weakening the maintained strict sandbox. It preserves the supervised-pilot operating model, Python 3.12+ requirement, and metadata-only privacy boundary.

Install the pinned package:

export CODE_MOWER_PYTHON="$(command -v python3.12)"
pipx install --python "$CODE_MOWER_PYTHON" code-mower==1.0.11
code-mower --version

Hosted agents and CI boxes can use:

uv tool install --python 3.12 code-mower==1.0.11
code-mower --version

What Is New

  • Canonical hosted Devin release campaigns dispatch through the Devin Sessions API v3 instead of a GitHub issue comment. The API call is the execution trigger: it needs a service-user DEVIN_API_KEY with the UseDevinSessions and ViewOrgSessions organization permissions, the opaque org-* DEVIN_ORG_ID, and the exact OWNER/REPO target acknowledged in CODE_MOWER_DEVIN_REPOSITORIES. Matching is against the full slug, so a same-name personal fork does not satisfy an organization repository target. Credentials are read but never printed or persisted (#770, PR #771).
  • A hosted Devin dispatch is bounded and pollable rather than a wait on a bot comment. A resume (--resume or watch) polls the stored session id and never creates another paid session; --retry-provider devin --apply creates a new session only after the prior session is known terminal or its one-hour response deadline has expired, so an active or owner-blocked session is polled but never duplicated. Accepted retries preserve bounded attempt history (#770, PR #771).
  • --issue is now optional audit evidence for hosted Devin. When supplied, Code Mower records the existing campaign marker on the issue; it does not post @devin run and does not depend on a bot reply. Cursor Cloud Agent keeps the issue-comment transport and its own five-check profile (#770, PR #771).
  • An informational Devin attempt that stays active but cannot be completed can be closed out with release campaign dispose, which records a terminal, metadata-only disposition without inventing a result or contacting Devin again (#770, PR #771).

What Is Fixed

  • macOS Claude release campaigns can cold-install an exact PyPI release again inside the maintained strict sandbox. Claude Code's macOS sandbox denies the Security.framework call pip's default platform trust store makes (OSStatus -26276), so a macOS Claude qualification prompt now runs pip with its TLS-verifying legacy (certifi) certificate path and no inherited pip configuration. Certificate verification stays enabled -- no trusted-host option, no disabled TLS, and no unsandboxed command -- and the sandbox, domain allowlist, home denials, and disabled escape hatch are unchanged. Linux Claude runs and every other provider keep pip's default certificate path. A certificate failure that survives this path always classifies as a network package-install failure, never sandbox_permission and never package_index; a non-certificate index response such as a 404 still classifies as package_index (#769, PR #772). See macOS Claude sandbox certificate path.

Provider Posture

This release does not change reviewer authority. Codex audit and Claude audit remain the established reviewer lanes with merge authority; Gitar stays informational corroboration. Devin remains an opt-in paid lane (enabled_by_default: false, trigger_policy: manual, spend_policy: paid) and an informational reviewer unless repository-specific evidence promotes it under the lane promotion policy. A successful hosted dispatch is transport evidence, not builder-quality or reviewer-promotion evidence.

Run A Qualification Campaign

Qualify one provider environment directly when a full campaign is unnecessary:

code-mower release qualify \
  --release-tag v1.0.11 \
  --package-spec code-mower==1.0.11 \
  --output adoption-result.json \
  --execute

Preview a campaign with established local providers required and experimental or hosted providers informational:

code-mower release campaign create \
  --release-tag v1.0.11 \
  --package-spec code-mower==1.0.11 \
  --providers claude,codex,antigravity,muse,cursor_cloud_agent,devin \
  --required-providers claude,codex \
  --repo-slug OWNER/REPO

Apply only after the preview and adoption doctor are clean:

code-mower doctor --adoption --repo OWNER/REPO
code-mower release campaign dispatch \
  --release-tag v1.0.11 \
  --required-providers claude,codex \
  --apply \
  --repo-slug OWNER/REPO \
  --issue ISSUE_NUMBER
code-mower release campaign watch --release-tag v1.0.11

A hosted Devin attempt needs --repo-slug OWNER/REPO and its API environment; --issue is optional for that lane. See Devin Setup.

Preview the closed cloud bundle, then upload it explicitly:

code-mower release campaign upload --release-tag v1.0.11 --json
code-mower release campaign upload --release-tag v1.0.11 --yes --json

Qualification writes the closed code_mower.adoptionResult.v1 artifact. Campaign upload converts terminal results into additive adoption_run events. It does not upload source, raw diffs, prompts, transcripts, issue body text, raw provider output, authentication output, local paths, or secrets.

Recommended Update

For an existing pipx install:

export CODE_MOWER_PYTHON="$(command -v python3.12)"
PIP_NO_CACHE_DIR=1 pipx install --force --python "$CODE_MOWER_PYTHON" code-mower==1.0.11
code-mower --version
code-mower board list

For hosted agents using uv:

uv tool install --python 3.12 --reinstall --refresh-package code-mower code-mower==1.0.11
code-mower --version

--refresh-package takes a package name as its value, so the first code-mower is the cache-refresh target and code-mower==1.0.11 is the single package argument.

Restart a Board that still serves an older package. For existing repositories, review migration setup-drift output in a pull request before applying any generated changes.

Quality And Privacy Proof

The implementation PRs passed package CI on Python 3.12, 3.13, and 3.14 and exact-head peer audits with the author lane excluded. The audits found and corrected duplicate-session, repository-scope, and package-install failure classification defects before merge.

Cloud sharing remains opt-in and dry-run first. The default release campaign works locally without a CodeMower.com account.