@@ -10,6 +10,9 @@ concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   # ---------------------------------------------------------------------------
   # Detect which areas of the codebase changed to skip unaffected jobs.
@@ -18,6 +21,9 @@ jobs:
   changes:
     name: Detect Changes
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     timeout-minutes: 2
     outputs:
       typescript: ${{ steps.filter.outputs.typescript }}
@@ -181,6 +187,8 @@ jobs:
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - uses: oven-sh/setup-bun@ecf28ddc73e819eb6fa29df6b34ef8921c743461 # v2
         with:
@@ -429,6 +437,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - uses: oven-sh/setup-bun@ecf28ddc73e819eb6fa29df6b34ef8921c743461 # v2
         with:
@@ -524,6 +534,8 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - uses: oven-sh/setup-bun@ecf28ddc73e819eb6fa29df6b34ef8921c743461 # v2
         with:
@@ -550,6 +562,8 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - name: Install Pester
         shell: pwsh
@@ -579,6 +593,8 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - uses: oven-sh/setup-bun@ecf28ddc73e819eb6fa29df6b34ef8921c743461 # v2
         with:
@@ -715,6 +731,8 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - uses: oven-sh/setup-bun@ecf28ddc73e819eb6fa29df6b34ef8921c743461 # v2
         with:
@@ -758,6 +776,7 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - uses: oven-sh/setup-bun@ecf28ddc73e819eb6fa29df6b34ef8921c743461 # v2
 
@@ -1,6 +1,6 @@
 ---
 name: altimate-setup
-description: Configure Altimate platform credentials for datamate and API access
+description: Configure Altimate platform credentials for API and workspace access
 ---
 
 # Altimate Setup
@@ -28,4 +28,4 @@ Guide the user through configuring their Altimate platform credentials.
    ```
    Then set permissions to owner-only: `chmod 600 ~/.altimate/altimate.json`
 
-4. **Validate**: Call the `datamate_manager` tool with `operation: "list"` to verify the credentials work. Report success or failure to the user.
+4. **Validate**: If the `datamate_manager` tool is available, call it with `operation: "list"` to verify the credentials work, and report success or failure to the user. If it is not (it is turned off in a project linked to an Altimate workspace), ask the user to run `/workspace` → Refresh instead, which calls the Altimate API with these credentials and reports an error if they don't work.
@@ -5,6 +5,33 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.12.7] - 2026-10-13
+
+**Workspace skills and knowledge come first.** In a linked project the agent prefers the workspace's own skills over lookalikes in the repo or your home folder, and checks the workspace's knowledge base for best practices without being asked. Linking now ends with a starter that says what the workspace provides and suggests prompts. Also in this release: opt-in automatic promotion for `learn`, session traces for the IDE extension, and Snowflake reconnects written to `opencode.log`.
+
+**Heads-up for support:**
+- **The start-screen workspace box is back.** 0.12.6 removed it because it stopped every keybinding once it loaded. The cause is fixed, and Ctrl+C, Ctrl+P and Esc were checked on the start screen of the release build, linked, unlinked and with the workspace service unreachable. If a signed-in user still reports dead keys, `ALTIMATE_DISABLE_WORKSPACE=1` remains the stopgap.
+- **The skill list changes for everyone, not only workspace users.** Each skill the agent sees now carries its source (`workspace`, `project`, `built-in`, `personal` or `other`), and the agent is told to prefer them in that order. So a skill in the repository now outranks a personal one with a similar purpose. It is guidance to the agent, not a filter: every skill is still listed and can be asked for by name.
+- **The agent may search the workspace knowledge base on its own.** When the linked workspace has knowledge, the agent consults it for best practices and team conventions without the user asking. Unlinking the project, or turning knowledge off for the workspace, stops it.
+- **`serve` has new read-only routes for the IDE extension** (see Added). Traces hold prompts and tool output, including SQL and query results. Like every `serve` route, they need no password unless `OPENCODE_SERVER_PASSWORD` is set, so set one on a shared machine.
+
+### Changed
+
+- **Workspace skills and knowledge are preferred.** Every skill in the agent's list is labelled with where altimate-code found it, and one rule tells the agent to load the highest source that fits instead of asking which team's skill to follow. A project skill with exactly the same name as a workspace skill still replaces it. Listings stay in name order, so built-in skills are not pushed out of the skill tool's list. With knowledge on, the workspace section also tells the agent to check the knowledge base before answering best-practice questions. (#1435)
+
+### Added
+
+- **A starter after linking.** `altimate-code link` ends with what the workspace provides (skills, knowledge, integrations, memory setting) and up to three prompts to try; the TUI shows the same after a link and from `/workspace` → **Get started**, where picking a prompt fills the input without sending it. It makes no model call, and anything not yet known is left out rather than shown as "none". `GET /altimate/workspace/starter` serves it to the IDE extension. (#1435)
+- **`learn` can promote lessons without a person, if you opt in.** `learn enable --auto-promote` (or `learn.auto_promote: true`, or `ALTIMATE_LEARN_AUTO_PROMOTE=1`) promotes a lesson an automatic reflection staged when every check passes: it came from a correction, review or CI signal; it is exactly what was staged; it validates like a manual promote; it does not weaken a verification step; it does not edit or remove a lesson a person approved or pinned; and it stays within 3 changes per promotion and 5 per day (`learn.auto_promote_max_changes`, `learn.auto_promote_daily`). Otherwise the candidate stays staged and `learn status` says why. Off by default, needs capture and automatic reflection on, and `learn rollback` undoes a promotion. (#1418)
+- **Session traces for the IDE extension.** `serve` adds `GET /altimate/trace` (a page of traces, newest first) and `GET /altimate/trace/<session>/view` (the trace viewer, without Copy Link), so the extension's `/traces` can list and open them. Browser-originated requests are refused, as for the workspace routes. (#1415)
+
+### Fixed
+
+- **The TUI's keybindings keep working with the start-screen workspace box.** The box rendered nothing until the project's link was resolved; each time its lines arrived, the start screen remounted it empty, and it resolved again without end, which held up every keybinding. It now keeps a root element from its first render. (#1435)
+- **Snowflake reconnects are in `opencode.log`.** When Snowflake closes a session and the driver reopens it, the log gains `reconnecting`, then `reconnected` (with the reason, how long it took, how many session settings were restored, and whether temporary tables or a transaction may have been lost) or `reconnect failed` (a warning with the masked error). The lines name the account, and the connection when only one uses it; they never contain SQL. Before, a session that kept dropping left no trace. (#1427)
+- **A trace containing `<!--<script` no longer opens as an empty page.** The viewer embeds the trace in an inline script, and that text in tool output (a fetched web page, say) stopped the script from running. Affected the TUI's `/traces` too. Found in this release's testing.
+- **The trace viewer page cannot call the server's API.** Served from `serve` for the IDE, the page now carries a content security policy that allows its own script but no requests or form posts, so script injected through trace content cannot reach other routes. Found in this release's review.
+
 ## [0.12.6] - 2026-10-06
 
 Hotfix for 0.12.5. **Heads-up for support:** anyone on 0.12.5 who is signed in to Altimate gets a TUI where keybindings do nothing and Ctrl+C does not quit; they have to close the terminal. Upgrading fixes it, and so does `ALTIMATE_DISABLE_WORKSPACE=1` as a stopgap.
 
@@ -325,3 +325,19 @@ This disables skill discovery from `~/.claude/skills/` and `~/.agents/skills/` b
 ## Duplicate Handling
 
 If multiple skills share the same name, project-level skills override global skills. A warning is logged when duplicates are found.
+
+## Which Skill the Agent Picks
+
+The skill list the agent sees marks each skill with where it was found:
+
+| Source | Where |
+|---|---|
+| `workspace` | Synced from the Altimate workspace this project is linked to |
+| `project` | Inside the project, such as `.claude/skills/`, `.agents/skills/` or `.altimate-code/skills/` |
+| `built-in` | Ships with altimate-code |
+| `personal` | Your own folders under your home directory, such as `~/.claude/skills/` |
+| `other` | Anywhere else, such as a `skills.paths` entry outside the project and your home directory |
+
+When more than one skill fits a task, the agent is told to load the one from the highest source in that order, and to fall back to a lower source only when nothing higher covers the task. So a skill your team added to the workspace is preferred over a similar skill another team left in the repository. The label comes from the skill's location, not from anything written in the skill.
+
+One exception: a project skill with exactly the same name as a workspace skill replaces it, and is listed as `project`. That keeps a skill you are editing in the repository, and may later publish, from being shadowed by the workspace's older copy.
@@ -53,7 +53,7 @@ Each warehouse has a key (the connection name) and a config object:
 | `database` | No | Database name |
 | `schema` | No | Schema name |
 | `role` | No | User role |
-| `client_session_keep_alive` | No | Keep the session alive while Altimate Code is running (default `true`). A connection Snowflake closes anyway is reopened automatically. `USE`, `ALTER SESSION` and `SET` settings are applied again to the reopened session. A single read-only query interrupted by the close is run again; a statement that changes data, or calls a sequence, is not, because it may already have run, and the error says so. Temporary tables and an open transaction cannot be restored: statements issued before the reopen report that instead of running. |
+| `client_session_keep_alive` | No | Keep the session alive while Altimate Code is running (default `true`). A connection Snowflake closes anyway is reopened automatically. `USE`, `ALTER SESSION` and `SET` settings are applied again to the reopened session. A single read-only query interrupted by the close is run again; a statement that changes data, or calls a sequence, is not, because it may already have run, and the error says so. Temporary tables and an open transaction cannot be restored: statements issued before the reopen report that instead of running. Each reopen is written to `opencode.log` under `warehouse-connect` as `reconnecting`, then `reconnected` (with `reason`, `duration_ms`, `settings_restored` and `session_state_lost`) or `reconnect failed` (a warning with the masked error). The lines name the account, and the connection when only one uses that account; they never contain SQL. |
 
 ### Key-pair authentication
 
 
@@ -54,16 +54,18 @@ Workspace features are on by default. When you are signed in to Altimate, altima
 
 With workspaces on:
 
-- `altimate-code link` links the current project to a workspace (or creates one). The sidebar then names the workspace and shows how many memories are not yet synced and when skills last synced.
+- `altimate-code link` links the current project to a workspace (or creates one), then shows what the workspace provides (its skills, knowledge, integrations and whether memory is on) and a few prompts to start with. The sidebar then names the workspace and shows how many memories are not yet synced and when skills last synced.
 - From a shell, script or CI job, without the TUI:
     - `altimate-code link --workspace <name|id>` links to an existing workspace (an id is matched before a name), and `altimate-code link --create [name]` creates one (named after the repo by default) and links to it. Neither prompts. If the project is already linked to a different workspace they refuse unless `--yes` is passed. Running `--create` again when the project is already linked to a workspace of that name creates nothing, so it is safe in a devcontainer's setup command; if another workspace already has that name it refuses and names its id, unless `--allow-duplicate` is passed. Linking to the workspace the project is already linked to confirms that link on this machine, which a fresh clone needs before `workspace sync` sends its memory.
     - `altimate-code workspace status [--json]` shows the linked workspace and, when known, how many saved memories have not reached it and when skills last synced.
     - `altimate-code workspace refresh` pulls the workspace's skills (memory is loaded by the next session started in the project); `altimate-code workspace sync` sends memory the workspace has not received; `altimate-code workspace unlink [--yes]` detaches the project (`--yes` is required without a terminal).
     - These commands accept `--directory`. Exit codes: `0` done, `1` failed (including when the workspace service could not be reached), `2` a request to change (not signed in, a re-link or unlink without `--yes` and no terminal to confirm on, or a `sync` to a link not yet confirmed on this machine), `3` the project is not linked. With `--json`, `ok` is `true` exactly when the exit code is `0`.
-- `/workspace` in the TUI opens a menu: **Refresh** pulls the workspace's skills and memory into this project, **Sync** re-sends local memory the workspace never received, **Open in browser** (when a web URL is available) shows the workspace on the web, **Switch workspace** relinks the project, **Unlink** detaches it. In a project that is not linked yet, it offers **Link to a workspace** instead.
+- `/workspace` in the TUI opens a menu: **Get started** shows what the workspace provides and prompts to try (choosing one puts it in the prompt without sending it; after you link from the TUI, the confirmation shows the same summary and prompts), **Refresh** pulls the workspace's skills and memory into this project, **Sync** re-sends local memory the workspace never received, **Open in browser** (when a web URL is available) shows the workspace on the web, **Switch workspace** relinks the project, **Unlink** detaches it. In a project that is not linked yet, it offers **Link to a workspace** instead.
 - `altimate-code skill publish <name>` uploads a project skill to the linked workspace; see [Skills](../configure/skills.md#cli-commands).
+- When the linked workspace has knowledge, the agent is told to check it for best practices and team conventions before answering, without you having to mention the knowledge base.
 - In an ordinary session the agent is told every turn which workspace the project is linked to — or that none is, or that the link could not be verified just now. In an extension-pinned session it is told the pinned workspace instead, and that it differs from the project's own link. Either way "which workspace am I in?" has an answer, and the agent is told not to confuse it with a Databricks workspace or an IDE workspace folder.
 - When `altimate-code serve` is launched by the VS Code / Cursor extension, the workspace selected in the extension's panel governs that session's skills, memory and (unless `--integrations local` is set) warehouse tool routing, taking priority over whatever the project is linked to on the backend, and is scoped to the folder it was launched for. A pin is fixed for the life of the `serve` process, so the extension relaunches `serve` when the selection changes; nothing updates a running one.
+- `serve` also gives the IDE extension what the TUI shows: `GET /altimate/workspace/starter` (the starter message after a link) and `GET /altimate/trace` with `GET /altimate/trace/<session>/view` (the trace list and viewer behind `/traces`). Traces hold prompts and tool output, including SQL and query results. Like every `serve` route, these need no password unless `OPENCODE_SERVER_PASSWORD` is set, so set one on a shared machine.
 
 ## Global Flags
 
 
@@ -8,6 +8,10 @@ export { normalizeConfig, sanitizeConnectionString } from "./normalize"
 export { onBrowserSignIn, redactSignInUrl } from "./sign-in"
 export type { BrowserSignInNotice } from "./sign-in"
 
+// Re-export reconnect events (a closed session reopened by the driver)
+export { onReconnect } from "./reconnect-events"
+export type { ReconnectEvent } from "./reconnect-events"
+
 // Re-export file-backed store guards
 export { allowsCreate, assertStoreExists, isLocalFilePath, requireStorePath } from "./file-store"