freelabz · ocervell · Jun 16, 2026 · Jun 19, 2026 · Jun 20, 2026 · Jun 20, 2026
diff --git a/.github/workflows/publish-canary.yml b/.github/workflows/publish-canary.yml
@@ -13,10 +13,6 @@ on:
     branches:
       - canary
 
-concurrency:
-  group: publish-canary-${{ github.ref }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
 

diff --git a/pyproject.toml b/pyproject.toml
@@ -92,7 +92,11 @@ gcs = [
 ]
 ai = [
 	'litellm < 2',
-	'safecmd'
+	'safecmd',
+	# safecmd shells out to the `shfmt` binary (via shutil.which); pin shfmt-py
+	# explicitly so `secator install addons ai` always ships the binary, not just
+	# the safecmd Python package. Without it the guardrail shell parser degrades.
+	'shfmt-py'
 ]
 
 [project.scripts]