v0.28.1 — skipped files no longer block finalising the review

Patch fix for the review viewer.

A diff containing a lock/vendored/binary file (e.g. uv.lock) left the streaming review stuck: those files' hunks showed as perpetually "queued" in the progress strip (0 running), so the pass never read as complete and finalising was blocked.

The skip decision was only applied in the augment pipeline; the pending page built before augmentation didn't share it, so skipped files entered the progress grid but never received a per-hunk event. The skip set is now shared between the pipeline and the pending-page builder — skipped files are marked "generated" up front, excluded from the grid, and rendered "not analysed" immediately. Config [augment].skip_globs is honoured on this path too.

v0.28.0 — claude-cli tool-surface parity (hosted MCP server)

The claude-cli backend now reaches SDK parity on the tool surface (ADR 0003).

• One warm HTTP MCP server per run/session instead of a stdio MCP child spawned per hunk (augment) and per turn (console) — eliminates the ~765 ms/spawn Python interpreter cold start (tens of seconds of wasted CPU on a multi-hunk PR).
• Live tool visibility in the CLI console: console-tool activity streams as the model reads/greps, matching the SDK console.
• Shared (sha, path) read/parse cache in RepoTools, benefiting the SDK path too — each file parsed once across the overview seed and per-hunk passes.
• The hand-rolled stdio MCP server is retired; mcp is now a pinned direct dependency (pulls starlette + uvicorn).

SDK backends (anthropic:, google-vertex:, openai:) are unchanged beyond the shared cache — they were already in-process.

v0.27.4

console

• feat: animate the pending indicator. The in-flight answer's static … is now three dots blinking in sequence, so it's clear the backend is working — the whole liveness cue for CLI backends, which stream nothing until the turn returns.

claude-cli backend

• fix: disable skills in the console + augment spawns (--disable-slash-commands). Skills resolve in claude -p even with --setting-sources "", but their definitions don't load — so a skill the reviewed code triggers (e.g. claude-api) is advertised, fails on invocation, and the model hedges ("the skill failed to load…") instead of grounding in the diff + our MCP tools.

v0.27.3

fix

• --debug on scr pr: the debug drawer flag (added in 0.27.2) was only on scr review; scr pr now accepts --debug (and honours SCR_DEBUG) too, threading the debug-sink binder through the PR flow.

Note: --debug is a per-command option on review/pr — invoke it as scr review … --debug or scr pr … --debug (or SCR_DEBUG=1), not as a top-level scr --debug.

v0.27.2

claude-cli backend

• fix (read-only MCP tools): the console and augment passes spawned claude -p with --tools "" + --permission-mode bypassPermissions. --tools "" disabled the MCP tools entirely — the model couldn't call read_file/grep, so console turns leaked the raw tool-call XML into the answer as text, and augment passes silently answered from the prompt without reading the code. bypassPermissions additionally granted the "read-only" surface built-in Bash/Edit/Write. Both paths now run in default permission mode with only our read-only MCP server allow-listed and the mutating built-ins denied. Verified against CLI 2.1.201.

review viewer

• feat (--debug / SCR_DEBUG): a gated raw-log drawer. When enabled, a toggle appears bottom-right; the drawer lists every claude -p spawn (console turns and augment passes) with its redacted argv, stdin preview, stderr, timing, and envelope summary (subtype, stop_reason, num_turns, session id, usage, result preview), each entry expandable. Off by default with zero overhead.

The live MCP contract test now asserts a distinctive file value reappears in the answer, so it proves the read happened over MCP rather than just checking for a non-empty result.

v0.27.1

claude-cli backend

• fix: --max-turns cutoffs now surface an actionable error instead of an opaque returned error … <empty>. A max-turns cutoff arrives as subtype=error_max_turns / is_error=true, which _raise_if_error collapsed generically; it's now detected and named, and the previously-dead max-turns diagnostics are corrected.
• feat: the review console now resumes one persisted claude -p session across turns (--resume <id>) instead of respawning single-shot with --no-session-persistence. The subprocess restores its own tool-loop context (MCP reads, prior answers) rather than re-deriving it from a lossy text replay, so multi-turn conversations no longer degrade. The structured augment path is unchanged. Adds a live contract test for the resume + session_id round-trip.

docs

• Add a full config.toml reference.

v0.27.0

Setup, config-safety, and cost-control release.

scr init — reworked wizard

• Arrow-key prompts (questionary) with a plain-text fallback off a TTY.
• Live model picker: lists the backend's real models once the credential resolves (also serves as a live credential check); free-text fallback.
• Composable credential sources (env / .env / user-config / command / vertex / none); each backend offers only the ones it accepts.

Config & secret safety

• All config/secret writes are now 0600 (dirs 0700). Fixes the wizard writing an API key into a world-readable .env.
• Relaxed 'no key in config': a key may live in the user config's [env] (0600), user scope only — never a repo's .scr/config.toml. Reuses the existing env-application path (no new resolution branch).
• scr config show redacts [env] values.

Cost control — skip uninteresting files

• The LLM-skip denylist is now config-extensible via [augment].skip_globs (accumulated across user+repo scopes), on top of the builtins; defaults broadened (go.sum, *.map, *.snap).
• The interactive /fold-summary route now skips GENERATED files (lockfiles/bundles), so expanding a fold in one no longer sends it to the model.

Backend messaging

• Dropped the claude-cli startup 'falling back — no API key' note; it's a first-class subscription path, not a fallback.

Adds questionary==2.1.1 (thin wrapper over the already-shipped prompt_toolkit).

v0.26.0

Highlights

Viewer

• Files sidebar axis is a foldable directory tree (single-child chains collapsed, siblings sorted, per-file comment badges).
• Filtering reworked into a collapse model: focusing a symbol/file keeps the matching hunks live and demotes the rest into collapsible "expand" regions. Files · Hunks · Segments · Off is a consistent depth ladder — code shows only at Off, segment-less hunks fold as one segment, and focus reveals just the focused hunk's code without leaking into the unfiltered view.
• Tighter sidebar density.

CLI

• scr init — interactive first-run setup wizard.

Dependencies

• Migrated to pydantic-ai 2.x (2.5.0) with anthropic 0.116. Slims the install considerably (drops ~40 unused provider SDKs the 1.x meta-package bundled — Bedrock/Cohere/Groq/Mistral/HF/xAI, etc.), which also shrinks the transitive attack surface.
• Cleared all outstanding Dependabot alerts (critical/high/moderate) rolled up from 0.25.x.

Docs & tests

• Screenshot walkthrough of the viewer (docs/walkthrough.md); README command list reorganised.
• Opt-in live contract tests for the claude-cli path (SCR_LIVE_CLI=1), guarding the unversioned CLI envelope + MCP handshake against upstream drift.

Both shipped backends (claude-api SDK, claude-cli subprocess/MCP) verified end-to-end on the 2.x stack.

v0.25.2

Security-hygiene release: clears the remaining moderate Dependabot alerts. No functional changes.

• pydantic-ai / pydantic-ai-slim 1.90.0 → 1.102.0 (SSRF cloud-metadata blocklist bypass; GHSA family). 1.102.0 is the minimal patched release compatible with the pinned anthropic==0.97.0, so no other direct dependency moves.

scr drives pydantic-ai only over its repo-tool MCP surface (read_file / grep), not its URL-fetching tools, so the SSRF path was not reachable; bumped for hygiene. pytest (473) green.

With this, all open Dependabot alerts (critical / high / moderate) are cleared.

v0.25.1

Security-hygiene release: clears the open Dependabot critical/high alerts. No functional changes.

Shipped runtime closure (transitive bumps)

• cryptography 48.0.0 → 49.0.0 (vulnerable OpenSSL in wheels)
• urllib3 2.6.3 → 2.7.0 (cross-origin header leak on proxied redirects; decompression-bomb bypass)
• starlette 1.0.0 → 1.3.1, python-multipart 0.0.27 → 0.0.32, pyjwt 2.12.1 → 2.13.0, joserfc 1.6.4 → 1.7.2

None were reachable with attacker-controlled input in scr (stdlib review server, no external JWT verification, trusted API endpoints); bumped for hygiene.

Dev toolchain (not shipped in the wheel)

• vitest 2.1.9 → ^3.2.6 (UI-server RCE advisory), @playwright/test 1.48.2 → ^1.61.1, form-data via npm audit fix.

npm audit clean; pytest (473) and the vitest 3 suite (110) green.