Conversation
New fast-path: when a supported provider's API key is already in the environment, init lists those providers up front and lets the user pick one in a single step (falling through to the full menu otherwise). Scoped strictly to known provider env vars - never a broad scan - and never echoes key values. Also fixes a pre-existing bug where the paste path exported os.environ[provider_id] instead of os.environ[key_env], so key verification silently could not see a freshly pasted key. Messages now name the env var (e.g. GROQ_API_KEY) rather than the provider id.
Adds an accurate "Data flow & privacy" section (no telemetry/server/account; exactly what leaves the machine and when; local-model path for zero third-party egress). Replaces the vague implication that everything stays local. Moves the brand-asset table out of the main README into assets/README.md so the main doc stays focused on using the tool.
Align the tagline across all branding surfaces so the logo, dark logo, social card, and terminal banner share one canonical line. Drops the "- not a bot" suffix on the social card so all assets match exactly.
Asserts every src/vigilant/*.py begins with the exact Apache-2.0 copyright + SPDX header, catching both deletion and entity-name abbreviation. Headers have silently regressed twice during reinstall churn; this fails CI before the drift can be committed.
Follow-up to the tagline change: the plain-banner assertion still expected the old "adversarial PR review" string.
Adds -V/--version (reads installed package version, with a source fallback) so users can confirm what they have and that an upgrade took effect. Documents the reliable forced-reinstall upgrade path in the README and the pin/version-string trap with pipx/uv. Config and keys in ~/.config/vigilant-pr survive upgrades untouched.
Adds `vigilant --version`, tagline unification, license-header drift guard, upgrade docs, and the data-flow/privacy section since v1.5.2.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release v1.6.0
Promotes
developtomain. Version bumped1.5.2 -> 1.6.0(new user-facing CLI flag).Highlights
vigilant --version/-V- reports the installed package version (with a0+sourcefallback when run from an uninstalled tree) so users can confirm what they have and that an upgrade took effect. Additive; does not affect existing command parsing.--forcereinstall path and the pipx/uv version-string trap (a bare-gitupgradecan skip a newermain; a pinned install won't move). Config and keys in~/.config/vigilant-prare untouched by upgrades.tests/test_license_headers.pyfails the build if anysrc/vigilant/*.pyloses or alters its exact Apache-2.0 + SPDX header (catches both deletion and entity-name abbreviation). Closes a recurring regression.assets/README.md.vigilant initfast-path - offers API keys already present in the environment (scoped to known provider vars) before the full menu.Verification
vigilantbinary reports version,--help,models, and a full--dry-runreview (mock model) render correctly and post nothing. No working-tree drift from reinstall.Post-merge
Tag
v1.6.0to triggerrelease.yml(sdist/wheel + GitHub Release) andpublish-image.yml(container).