发布 TraceFetch 1.0.1 安全修复

CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes are documented here.
 
 ## Unreleased
 
+## 1.0.1 - 2026-08-01
+
+- Make crawl receipt verification recompute the top-level status from page records.
+- Return fixed, bounded failures for malformed receipts and invalid SQLite state without reflecting
+  input text, local paths, or tracebacks.
+- Read crawl receipts through one non-blocking, no-follow file descriptor with a 16 MiB limit,
+  complete-chunk checks, and pre/post identity validation.
+- Preserve complete Autopilot lineage for the rejected and accepted security-boundary candidates.
+
 ## 1.0.0 - 2026-07-24
 
 - Promote TraceFetch from an evidence-acquisition alpha to an agent-first local and public search

README.md

@@ -27,10 +27,10 @@ data.
 
 ## Install
 
-After the `v1.0.0` GitHub release is published:
+After the `v1.0.1` GitHub release is published:
 
 ```bash
-pipx install "git+https://github.com/estelledc/tracefetch.git@v1.0.0"
+pipx install "git+https://github.com/estelledc/tracefetch.git@v1.0.1"
 tracefetch --version
 tracefetch doctor
 ```
@@ -192,7 +192,7 @@ FIRECRAWL_API_KEY=... tracefetch fetch https://example.com \
 Install local document conversion separately:
 
 ```bash
-pipx install "tracefetch[markitdown] @ git+https://github.com/estelledc/tracefetch.git@v1.0.0"
+pipx install "tracefetch[markitdown] @ git+https://github.com/estelledc/tracefetch.git@v1.0.1"
 tracefetch ingest report.pdf \
   --source-url https://example.com/report.pdf \
   --output /tmp/tracefetch-report

docs/releasing.md

@@ -7,8 +7,8 @@ verified.
 ## 1.0 acceptance gates
 
 1. `make check` passes on Python 3.11, 3.12, and 3.13.
-2. `python scripts/check_version.py --tag v1.0.0` confirms pyproject, package, changelog, and tag
-   coherence.
+2. `python scripts/check_version.py --tag vMAJOR.MINOR.PATCH` confirms pyproject, package,
+   changelog, and tag coherence.
 3. A clean clone can install the wheel and execute `tracefetch --version`, local search, doctor,
    schema, and provider-example smoke tests.
 4. Public search runs at least one configured provider and reports partial failure rather than

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "tracefetch"
-version = "1.0.0"
+version = "1.0.1"
 description = "Agent-first local and web search with provenance-bearing evidence bundles."
 readme = "README.md"
 requires-python = ">=3.11"

src/tracefetch/__init__.py

@@ -15,4 +15,4 @@
     "SearchResultsEnvelope",
     "search_everywhere",
 ]
-__version__ = "1.0.0"
+__version__ = "1.0.1"

tests/test_release_contract.py

@@ -10,7 +10,7 @@
 
 def test_version_sources_and_release_tag_are_coherent() -> None:
     completed = subprocess.run(
-        [sys.executable, "scripts/check_version.py", "--tag", "v1.0.0"],
+        [sys.executable, "scripts/check_version.py", "--tag", "v1.0.1"],
         cwd=ROOT,
         capture_output=True,
         text=True,
@@ -23,18 +23,21 @@ def test_version_sources_and_release_tag_are_coherent() -> None:
         "failures": [],
         "schema_version": "tracefetch.version-check.v1",
         "status": "ok",
-        "version": "1.0.0",
+        "version": "1.0.1",
     }
 
 
 def test_release_workflow_builds_smokes_and_publishes_assets() -> None:
     workflow = (ROOT / ".github/workflows/release.yml").read_text(encoding="utf-8")
     readme = (ROOT / "README.md").read_text(encoding="utf-8")
+    release_docs = (ROOT / "docs/releasing.md").read_text(encoding="utf-8")
 
     assert 'tags:\n      - "v*.*.*"' in workflow
     assert "make check" in workflow
     assert 'scripts/check_version.py --tag "$GITHUB_REF_NAME"' in workflow
     assert "uv pip install" in workflow
     assert "gh release create" in workflow
-    assert "v1.0.0" in readme
+    assert readme.count("v1.0.1") == 3
+    assert "v1.0.0" not in readme
+    assert "scripts/check_version.py --tag vMAJOR.MINOR.PATCH" in release_docs
     assert "PyPI publication is not claimed" in readme