safe-chains releases

← Back to safe-chains · RSS

• v0.229.0 2026-08-27
  • feat *(log)* Give stats its flag surface, fix --source arity, gate archive paths
  • feat *(ghostty)* Cover the read-only +action helpers
  • fix *(parse)* Accept the time keyword before a compound command
  • fix *(tsc)* Accept the -p/-t/-m short spellings
  • fix *(tsc)* Gate its file reads — both the --pretty quote and @response files
  • other Remove superseded docs, finished TODO sections, and decorative comment bars
• v0.228.0 2026-08-22
  • feat *(php)* -l is a lint, not an execution — and takes files, not flags
  • feat *(rails)* Per-database task variants, 28 of 56 no longer prompt
  • fix *(engine)* Parse BSD's sed -i '', which shifted every operand by one
  • fix *(fuzz)* The prefilter target compared a declared role against a positional the walk gates differently
  • fix *(engine)* Project a level-eval pass to the band it earns, not always SafeWrite
  • other *(suggest)* A shell keyword is not a command name
  • other *(fuzz)* Sync fuzz/Cargo.lock, four versions stale
  • other *(regions)* Stop shielding the decision log; record research findings; v0.228.0
• v0.227.0 2026-08-16
  • feat *(engine)* Make the user locus rung reachable, and shield what that exposes
  • feat *(regions)* Declare the credential dotfiles, then let home dotfiles be ordinary
  • feat *(regions)* Shield /etc/ssh, where the host private keys live
  • feat *(regions)* Classify raw devices and per-process /proc as what they are
  • feat *(engine)* Open local reads to the machine rung
  • feat *(regions)* Shield the decision log; correct the docs for the new read policy; v0.227.0
  • fix *(engine)* Check unpinnability BEFORE the sentinel is rewritten away
  • fix *(engine)* Correct the dotfile claim, and guard the sentinel fix that was untested
  • fix *(engine)* Close the last four ways an unknowable read reached the shield uncleared
  • fix *(regions)* Ten more credential dotfiles, and the measurement that questions the approach
  • fix *(engine)* Bind find/fd -exec through the same stand-in the pipe uses
  • fix *(engine)* Build dd's read from its path, so the shield is asked
  • fix *(engine)* Fold macOS firmlinks, so /private/etc/shadow is /etc/shadow
  • fix *(engine)* An unbounded read cannot be cleared by naming its root
  • fix *(engine)* A glob and a glued placeholder name nothing the shield can check
  • fix *(engine)* Two spellings that walked straight past the shield
  • fix *(pathgate)* An ambiguously glued value is a guess, not a path
  • fix *(engine)* One test for "the shield cannot clear this read", not two
  • fix *(pathgate)* Gate the recursive copiers — rsync, ditto, pax
  • fix *(engine)* Fold case on the firmlink prefix, for shields only
  • fix *(cli)* A raw device is not a login-policy file, and say so
  • fix *(test)* Two assertions that only held on macOS, caught by CI
  • other *(design)* Write up relocation, and the locus a thing came FROM
  • other *(engine)* Restate the read invariant as "the shield cannot clear it", not "it is outside the workspace"
  • other *(policy)* Enforce the path corpus, which named a guard that never existed
• v0.226.0 2026-08-15
  • fix *(engine)* A read the credential shield cannot clear now says so, on the secret axis
• v0.225.0 2026-08-14
  • feat *(log)* The decision log — an opt-in JSONL record of what safe-chains decided
  • other *(design)* Denial log — what to capture at refusal time, and what an entry looks like
  • other The user-facing logging page
  • other Record three defects the decision log surfaced on its first day
• v0.224.0 2026-08-13
  • feat *(pathgate)* Gate ungated output-flag writes with operation-aware roles
  • feat *(pathgate)* Sub-scoped gates, and two guards that found live holes
  • feat *(git)* Vet the diff display keys for git -c
  • feat *(registry)* Sub-scoped stdout claims, so grep $(git diff --name-only) works
  • feat *(cargo)* Accept the rustup toolchain selector (cargo +nightly test)
  • fix *(allowlist)* A home grant covers both spellings of the same file
  • fix *(registry)* A sub-scoped stdout claim follows every trusted spelling of its command
  • fix *(git)* Gate git diff's positionals — it was an ungated credential reader
  • other Name the command-mode concept and record the output-flag burn-down
  • other Regenerate for the cargo toolchain selector examples
  • other *(registry)* Make the path-named-flag guard compile, and record the 142 rows it was hiding
  • other *(pathgate)* Cap the undeclared-valued-flag backlog a positional gate creates
• v0.223.1 2026-08-07
  • fix *(registry)* Return errors from load_toml instead of panicking
  • other *(registry)* Cover the validators mutation testing found unguarded
  • other *(fuzz)* Run the nightly two hours earlier
  • other Ignore cargo-mutants output, and record what it found
• v0.223.0 2026-08-05
  • feat *(cargo)* Add cargo mutants, researched at 27.1.0
  • feat *(levels)* Clamp permissions.allow coverage by the stated level
  • fix *(commands)* Gate relocation flags at their locus
  • fix *(systemctl)* Stand the read subs on their enumerated flags
  • fix *(cli)* Confine --suggest's config write to the project
  • fix *(cst)* Give explain its own classification budget
  • fix *(cst)* Cap brace expansion on words produced, not brace count
  • other *(safe-chains)* Describe --suggest in our own entry
• v0.222.0 2026-08-04
  • feat *(regions)* A grant may name a credential store
  • feat *(regions)* A third face, so a directory can be written into but not replaced
  • fix *(pulumi)* Bound config to its bare form, and remove the get allowance
  • fix *(pathgate)* Let a gate carry both a handler and flags
  • fix *(pulumi)* Support -C/--cwd with a locus gate, and repair a file I corrupted
  • fix *(registry)* Remove 30 dead duplicate declarations found by the tree guard
  • fix *(registry)* Clear the last 5 duplicate declarations; backlog now empty
  • fix *(registry)* Assert a candidate sub declares no nested subs
  • fix *(repo)* Restore COMMANDS.md and make its generation atomic
  • fix *(regions)* A grant covers the subtree it names
  • fix *(regions)* Freeze writes to the harness settings file safe-chains trusts
  • fix *(nudge)* Tell the user how to allow a credential path
  • fix *(regions)* Compare the naming test against the deepest secret node
  • fix *(registry)* Stdin is not a workspace file for any executor
  • fix *(engine)* A process substitution is never an executor
  • fix *(nudge)* Stop advising a grant for a write that can never be granted
  • fix *(engine)* An informational flag is not a write with a hidden target
  • fix *(rmdir)* Gate the operand locus, like every other destroy
  • fix *(regions)* Stop a grant relocating the trust root
  • fix *(regions)* A home-anchored node must protect the absolute spelling too
  • fix *(engine)* Three defects in the rebind face, found reviewing it
  • fix *(cli)* Default --root to --cwd, as the hook already does
  • fix *(regions)* A freeze must survive a raised level, not just a grant
  • fix *(targets)* Claude permission files are trust for Claude only
  • fix *(pathgate)* Hand a colon-bearing value to the executor gate
  • fix *(engine)* A URL is never an executor
  • fix *(pathgate)* Judge a declared flag value instead of pre-filtering it
  • fix *(pathgate)* Drop the positional pre-filter too, and delete it
  • fix *(fuzz)* Silence the config diagnostic under cargo fuzz
  • fix *(cli)* The CLI is the Claude persona, so it honors Claude grants
  • fix *(cli)* Decide as the hook decides, coverage included
  • other *(copy)* Write the shipped copy in sentences, not dashes
  • other *(regions)* Canonicalize at the choke point, not per caller
  • other *(pathgate)* Hide the fuzz-only judge seams from the public API
  • other *(todo)* Correct the find "scale gap" entry — it was a misreading
  • other *(todo)* Re-verify the exec-gate class, and correct two stale headings
  • other *(pulumi)* Replace the doc-guessed config research with measured facts
  • other *(pulumi)* The config blocker rested on a wrong premise — config is a local FILE
  • other *(pulumi)* RESOLVE the config set question — the backend is ambient
  • other *(todo)* Record three structural classes probed clean, and the one real gap
  • other *(design)* Spec the refusal copy, keyed to emission rather than harness
  • other *(design)* Add ten worked examples to the refusal-copy spec, and a style rule
  • other *(design)* Revise the refusal examples on review, and record a UX inconsistency
  • other *(design)* Spec acknowledged grants so a user statement can cut through
  • other *(design)* A grant should cover what it names, not require an acknowledgement
  • other *(design)* Record partial-implementation risks for both specs
  • other *(design)* Enumerate every carve-out kind and rule on each
  • other *(design)* Decide system-integrity is absolute, correcting a false argument
  • other *(design)* Record what is settled and what still needs checking
  • other *(design)* Draft the user-facing docs change for grants
  • other *(design)* Record a blocker in the grants plan, and close two checks
  • other Document that a grant covers what it names
  • other *(regions)* Remove a doc comment stranded by the peer shield removal
  • other Say what write = true on a credential store actually allows
  • other Record what safe-chains cannot see, and the ~ decision
  • other *(todo)* Record what this stack defers, with the evidence
  • other *(todo)* Clear the nightly slow-units, and record how to measure them
  • other *(registry)* Guard the command TREE, not just its contents
  • other *(fuzz)* Replay every target per push, and test for drift
• v0.221.0 2026-08-02
  • feat *(parse)* Parse arithmetic bodies so their substitutions are classified
  • feat *(cargo)* Support cargo fuzz, with --fuzz-dir gated at the executor locus
  • feat *(find)* -delete delegates like -exec rm, so the traversal locus decides it
  • feat *(find)* Give find a registry entry and an output claim
  • feat *(cargo)* Support cargo fuzz --version, bounded by max_positional = 0
  • fix *(engine)* An executor slot must not accept a command line as a path
  • fix *(docs)* Stop leaking a name and url per command doc
  • fix *(parse)* Bound the parse work budget so nesting cannot buy itself time
  • fix *(cargo)* Withhold the cargo fuzz subs whose positional is a corpus path
  • fix *(parse)* Recognise NESTED arithmetic, so it stops reading as a subshell
  • fix *(cargo)* Withhold cargo fuzz add — its target NAME is a path component
  • fix *(pulumi)* Close pulumi config, and guard the shape that hid it
  • other *(find)* Move the primary vocabulary to TOML, deleting the WordSets
  • other *(todo)* Close the $VAR path-prefix idea — measured unsound
  • other *(todo)* Record the analysis for the three reported prompts
  • other *(todo)* Profile the nesting blow-up; correct the find diagnosis; add cargo fuzz
  • other *(todo)* Record the find output-claim blockers, including an -exec scale gap
  • other *(todo)* Find conversion plan, and derive that -delete is a false deny
  • other *(todo)* Design the find conversion from the handler's actual structure
  • other *(todo)* Correct the find data-move design; drift is avoided by deletion
  • other *(todo)* Decide the find examples stay in the handler; conversion complete
  • other *(todo)* Record the missing positional READER audit
  • other *(fuzz)* Let the equivalence target reach command-LINE values
  • other *(cargo)* Withdraw cargo fuzz entirely — the surface is not bounded yet