chore: release v0.3.3

[szjanikowski]

Release v0.3.3 — 2026-05-09

Patch release. Pre-1.0 policy: no breaking changes to user-facing CLI, nasde.toml schema, or benchmark project layout.

Supersedes #46 (same commits + new ## [0.3.3] header + compare links + branch renamed to match RELEASING.md naming).

Added

• Windows PowerShell OAuth exporter for Claude Code. scripts/export_oauth_token.ps1 reads %USERPROFILE%\.claude\.credentials.json and exports $env:CLAUDE_CODE_OAUTH_TOKEN for users running nasde from PowerShell on Windows. (chore(scripts): add Windows PowerShell OAuth token exporter #42)
• PowerShell OAuth exporters for Codex and Gemini. scripts/export_codex_oauth_token.ps1 validates %USERPROFILE%\.codex\auth.json (ChatGPT subscription) and scripts/export_gemini_oauth_token.ps1 exports $env:GEMINI_OAUTH_CREDS from %USERPROFILE%\.gemini\oauth_creds.json.
• OAuth scripts now ship inside the nasde-benchmark-runner skill. nasde install-skills copies them to ~/.claude/skills/nasde-benchmark-runner/scripts/, so users who installed nasde via pip install nasde-toolkit no longer need a repo checkout to authenticate. Repo scripts/ stays as the public-facing copy. (feat(skill): bundle OAuth scripts into nasde-benchmark-runner #45)

Changed

• Cloud sandbox extras shipped by default. pyproject.toml now depends on harbor[cloud] instead of bare harbor, so --harbor-env daytona|modal|e2b|runloop|gke works out-of-the-box after uv tool install nasde-toolkit. Trade-off: ~113 MB extra in the tool venv. (fix(deps): ship harbor[cloud] extras by default #48)
• scripts/export_oauth_token.sh works on Linux. Falls back to ~/.claude/.credentials.json when macOS Keychain is unavailable.
• nasde-benchmark-runner skill: rewritten "Authentication setup" with per-agent (Claude/Codex/Gemini) and per-OS (macOS, Linux, Windows PowerShell, Windows WSL) tables. (feat(skill): bundle OAuth scripts into nasde-benchmark-runner #45)
• nasde init writes shell scripts and Dockerfile with explicit LF line endings. Scaffold also drops a .gitattributes so future edits stay LF. (fix(windows): enforce LF line endings for shell scripts and Dockerfile #47)
• Benchmark-authoring skills gained a "Critical: line endings on Windows" section so AI agents enforce the same LF policy. (fix(windows): enforce LF line endings for shell scripts and Dockerfile #47)

Fixed

• Windows core.autocrlf=true no longer breaks Linux benchmark trials. Repo-wide .gitattributes locks *.sh, Dockerfile, and other Linux-bound files to LF. Previously produced bash: required file not found / RewardFileNotFoundError on every trial. (fix(windows): enforce LF line endings for shell scripts and Dockerfile #47)
• Windows path bug in skill bundle resolver. _bundled_skills_root() now resolves correctly on Windows. (fix(install): cap requires-python<3.14, add Windows smoke matrix, fix path bug #43)
• Pin requires-python<3.14 — some transitive deps don't yet ship Python 3.14 wheels. (fix(install): cap requires-python<3.14, add Windows smoke matrix, fix path bug #43)

Internal

• Quality-gate CI extended to Windows. Matrix now runs on ubuntu-latest + windows-latest × Python 3.12 + 3.13. (ci: extend quality-gate matrix to Windows; fix codex backend test isolation #44)
• Windows smoke matrix in publish.yml. Fresh-install smoke tests on TestPyPI and PyPI now also run on windows-latest. (fix(install): cap requires-python<3.14, add Windows smoke matrix, fix path bug #43)
• Codex backend test isolation fix. (ci: extend quality-gate matrix to Windows; fix codex backend test isolation #44)
• Drift guard asserts six OAuth scripts under scripts/ and .claude/skills/nasde-benchmark-runner/scripts/ stay byte-identical. (feat(skill): bundle OAuth scripts into nasde-benchmark-runner #45)

Pre-flight (per docs/RELEASING.md)

• CI green on main (latest Quality Gate run after fix(deps): ship harbor[cloud] extras by default #48 merge — all jobs passing on ubuntu+windows × py3.12+3.13)
• No half-finished [Unreleased] entries — everything cited maps to a merged PR (chore(scripts): add Windows PowerShell OAuth token exporter #42, fix(install): cap requires-python<3.14, add Windows smoke matrix, fix path bug #43, ci: extend quality-gate matrix to Windows; fix codex backend test isolation #44, feat(skill): bundle OAuth scripts into nasde-benchmark-runner #45, fix(windows): enforce LF line endings for shell scripts and Dockerfile #47, fix(deps): ship harbor[cloud] extras by default #48)
• Working tree clean — release commit only touches CHANGELOG.md
• CI green on this PR
• After merge: git checkout main && git pull && git tag v0.3.3 && git push origin v0.3.3

Test plan

• CHANGELOG renders with new ## [0.3.3] — 2026-05-09 header below [Unreleased]
• Compare links updated: [Unreleased]: …compare/v0.3.3...HEAD, new [0.3.3]: …compare/v0.3.2...v0.3.3
• Empty [Unreleased] block ready for the next cycle
• All cited PR refs (#42, #43, #44, #45, #47, #48) have link-ref entries at the bottom

🤖 Generated with Claude Code