chore: upgrade @altimateai/altimate-core to 0.8.0

Merged
AN
5d ago
+31-21

Issue for this PR

Closes #1529

Type of change

  • Bug fix
  • New feature
  • Refactor / code improvement
  • Documentation

What does this PR do?

This PR upgrades @altimateai/altimate-core from 0.7.0 to 0.8.0. That version is published to npm with all five platform packages, and to PyPI.

What users get from 0.8.0

  • Parser fixes for read syntax that 0.7.0 could not parse. sql_execute used to treat these statements as writes and ask for approval; they now classify and run as plain reads:
    • DuckDB // integer division
    • TIMESTAMPTZ '…' literals
    • a table aliased match
    • SQLite NOT GLOB
  • The second layer of the dbt reviewer: config lints are now parsed with the real dbt Jinja AST, and there is a new DBT006 finding for hardcoded relations. Findings flow through generically, so no consumer code changes were needed.
  • The TypeScript API is unchanged apart from a doc comment.

Changes in this PR

  • packages/opencode/package.json: the pin is now 0.8.0. bun.lock is refreshed, with the main package and its five platform packages at 0.8.0 and no other changes.
  • bunfig.toml: adds the six @altimateai/altimate-core* package names to minimumReleaseAgeExcludes. These are exact names, not a wildcard. Without the exemption, the 3-day cooldown blocks bun install from resolving a core release on the day it ships. The list already exempts other first-party and pinned packages such as @opentui/* and @ff-labs/*. Exact version pins and integrity hashes still apply.
  • Tests that pinned the old fail-closed behavior:
    • sql-execute.test.ts: the four statements now assert no approval request and exactly one dispatch of the original SQL.
    • sql-classify.test.ts:
      • The previously skipped DuckDB // aggregate test is enabled and expects read.
      • A malformed string_agg keeps parse-failure → write coverage.
    • The existing SELECT ( tests are unchanged. They cover the write-approval path with the parse diagnostic in its metadata, both when the write is denied and when it is approved.

How did you verify your code works?

All runs were local against the installed 0.8.0 (require('@altimateai/altimate-core/package.json').version → 0.8.0).

  • bun run typecheck in packages/opencode: clean.
  • bun test test/altimate: 9194 pass, 2 fail. The two failures are datamate_manager list-integrations 5-second timeouts. They fail the same way on main with 0.7.0 in this local environment and passed in CI on #1441. They are unrelated to this change.
  • bun test test/skill test/cli/check-e2e.test.ts test/install/smoke-test-binary.test.ts, the other suites that use core: 1158 pass, 0 fail.
  • Local Codex review of b12bce3775..5b3a5d5e30: no P0, P1 or P2 findings.
  • Independent review (Opus): one low-severity finding, a stale 0.7.0 pin reference in docs/internal/deterministic-checks-engine-split.md, fixed in 7507c57efe. It also tried adding writes after the newly parseable syntax, and all of them were still classified as writes.

Screenshots / recordings

Not applicable. There are no UI changes.

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Bug Fixes

    • Improved SQL classification and execution for DuckDB integer division, TIMESTAMPTZ, and MATCH syntax, as well as SQLite NOT GLOB queries. These queries are recognized as reads and can proceed without write approval.
    • Malformed string_agg queries now report a parse error while remaining unblocked as writes.

  • Updates

    • Updated Altimate Core to version 0.8.0.

[!NOTE]
Medium Risk
Bumps the native SQL engine and changes read/write classification for queries that previously required write approval, which affects the safety gate around sql_execute.

Overview
Upgrades @altimateai/altimate-core from 0.7.0 to 0.8.0 (lockfile and packages/opencode pin), and documents the new pin in internal engine-split docs.

bunfig.toml now exempts the six @altimateai/altimate-core* package names from the 3-day minimumReleaseAge rule so fresh core releases can be installed on ship day.

With 0.8.0’s parser fixes, several dialect-specific read statements (e.g. DuckDB //, TIMESTAMPTZ literals, match as a table name, SQLite NOT GLOB) are classified as reads instead of failing closed as writes. sql-execute and sql-classify tests are updated to expect no write-approval prompt and normal sql.execute dispatch for those cases; DuckDB // coverage is un-skipped, and malformed string_agg still asserts parse-error → write behavior.

Reviewed by Cursor Bugbot for commit 9740204d786b4063d076423f73e31a10bf235f4c. Bugbot is set up for automated code reviews on this repo. Configure here.