safe-chains v0.210.0

Released 2026-07-21 · View on GitHub

• feat *(engine)* Facet vocabulary — Capability and Profile
• feat *(engine)* Level predicate evaluator
• feat *(engine)* Compile level TOML; author the three local levels
• feat *(engine)* Supply-chain sub-facets (source, pinning, exec-surface)
• feat *(engine)* Resolver scaffolding — classify_locus (path -> LocalLocus)
• feat *(engine)* Resolver — echo, the reference structural certification
• feat *(engine)* Resolver — cat and grep (the file-read family)
• feat *(engine)* Wire the coexistence bridge, fail-closed flags, review hardening
• feat *(engine)* Resolve rm to a destroy profile (fail-closed, no admitting level yet)
• feat *(engine)* Author the developer level (destroy carve-in)
• feat *(engine)* Resolve mkdir + shared write helpers
• feat *(engine)* Resolve touch
• feat *(engine)* Resolve cp + generalize the developer write carve-in
• feat *(engine)* Resolve mv
• feat *(engine)* Resolve the head/tail/wc read family + numeric -NUM shorthand
• feat *(engine)* Resolve ln as cp-by-reference (gate the target locus)
• feat *(engine)* Resolve dd — key=value operands break the getopt model
• feat *(engine)* Resolve tar — dashless flag bundles + mode-split profiles
• feat *(engine)* Resolve sed — a flag (-i) flips read into in-place write
• feat Cwd-aware path classification via a scoped context (HP-19 #1, both layers)
• feat Wire the harness project root + CLI --cwd/--root (HP-19 #1 live)
• feat *(cst)* Track intra-line cd across a chain (HP-19 #2)
• feat *(engine)* HP-20 filesystem region model — read/write path faces
• feat *(engine)* Go live — the behavioral engine is authoritative, no opt-out
• feat *(engine)* Bind for-loop variables to their in-list locus
• feat *(engine)* User-level directory trust grants + file-location docs
• feat *(engine)* Workspace-boundary file model + role/scheme-aware command gate
• feat *(engine)* Add the retrieval-granularity facet axis (#1)
• feat *(engine)* Sibling-workspace (adjacent) locus — reach a peer project
• feat *(hook)* Reach the upper levels via a configured ceiling
• feat *(hook)* Support LOWERING the auto-approve ceiling (reader/paranoid)
• feat *(hook)* Make the coverage fallback level-aware — the full editor plan
• feat *(fd)* Delegate -x/--exec to the inner command, like find -exec
• feat *(credential)* Sweep spec + gate op/vault credential reads
• feat *(kubectl)* Gate get secret/secrets as credential-read
• feat *(credential)* Gate password-manager / secret-store reads (sweep batch 1)
• feat *(engine)* Credential_first_arg — the value-dependent credential gate
• feat *(cursor)* Make Cursor a deny-harness (allow is ignored on the CLI)
• feat *(engine)* Decrypt-read archetype — decrypt-to-screen as a facet capability
• feat *(engine)* [[command.flag]] classifying-flag mechanism; gate age -d
• feat *(sops)* Restructure for 3.13 subcommands; gate decrypt to decrypt-read
• feat *(gpg)* Classify -d/--decrypt as decrypt-read
• feat *(engine)* Flag escalation on bimodal subs; gate openssl decrypt
• feat *(engine)* Unless_flags — neutralize a profile when output is diverted; gate openssl private-key subs
• feat *(gpg)* Require an inspection command — deny bare-file implicit decrypt
• feat *(openssl)* Gate pkcs12 -nodes key extraction; extend unless_flags to escalating flags
• feat *(gpg)* Classify --decrypt-files as decrypt-read
• feat *(rails)* Cover db:test:prepare and db:test:load
• feat *(jjpr)* Surface jjpr watch --help
• feat *(yarn)* Run test runners via safe delegation (jest/karma/mocha/vitest)
• feat *(tmutil)* Add read-only Time Machine query subcommands
• feat *(safe-chains)* Allow its own read-only inspection flags
• feat *(nudge)* Explain the peer dot-shield instead of a generic 'outside workspace'
• fix *(engine)* Classify_locus fail-closed ordering + proptest gate
• fix *(engine)* Re-author read-local around locus (fail-closed secret handling)
• fix *(engine)* Harden fail-open cases found by adversarial probing
• fix *(engine)* Cp worktree overwrite is recoverable, not effortful
• fix *(engine)* Cp optional-argument longs must not swallow an operand
• fix *(engine)* Sed resolver worst-cases the exec command (RCE parity)
• fix *(shell)* Treat xargs -I replacement string as an invisible stdin item
• fix *(engine)* Grep resolver reads dash-patterns as patterns, not flags
• fix *(find)* Bind -exec {} to the find path locus; add composition harness
• fix *(gcloud)* Rescope subgroup-name globs to per-subgroup read verbs at every depth
• fix *(az)* Rescope subgroup-name globs to per-subgroup read verbs at every depth
• fix *(pathgate)* Gate ~156 ungated output-flag/positional writes (output-flag sweep)
• fix *(pathgate)* Close the output-flag sweep residuals (16 more gates)
• fix *(pathgate)* Close the positional last-arg writer class end to end
• fix *(copilot)* Correct hook config path to ~/.copilot/hooks; allow is honored
• fix *(ansible-vault)* Classify decrypt as decrypt-read (was a bypass)
• fix *(openssl)* Harden decrypt-read against -out/-text/-EncryptedData_decrypt bypasses
• fix *(openssl)* Close -pubout+-text and the --/- alias family (review round 3)
• fix *(openssl)* Fail-closed output-destination check for the resolver
• fix *(openssl)* Reject a dash-leading -out value (parser token-swallow)
• fix *(pathgate)* Gate a sensitive path hidden in a glued -flag=path token
• fix *(engine)* Make flag_present cluster-aware for short classifying flags
• fix *(pathgate)* Gate a short-glued -Xpath (no =) into a simple whole-command gate
• fix *(pathgate)* Close ..-escape/$VAR glued-flag bypass; gate wget warc/cookie writes
• fix *(pathgate)* Gate command-substitution operands in the simple path gate
• fix *(cargo)* Let cargo about accept its own --version/--help
• other *(engine)* Review round-2 code-health + medium coverage
• other *(engine)* Shared Flags walker for the fixed-flag resolvers
• other *(engine)* Intention-revealing capability constructors + shared helpers
• other *(engine)* Split resolve into flags/locus/capability submodules
• other *(engine)* Funnel cp/mv/ln through a transfer_profile builder (HP-18 rung 2)
• other *(engine)* Derive the conservation sweep from a resolver-side operand contract
• other *(engine)* Remove shadow mode; add with_mode test override
• other *(opencode)* Drop --opencode-config (it advertised an allowlist it never produced)
• other *(openssl)* Classify decrypt/private-key disclosure in an engine resolver
• other *(design)* Specify the admin level; resolve the containment question
• other *(design)* The golden-set — full corpus + settled decisions
• other *(design)* Behavioral taxonomy v1.4 — retire ci, add yolo, per-ecosystem pinning
• other *(design)* Safety by positive assertion — the fail-closed rule
• other *(design)* Reframe secret classification as locus + disclosure (fail-closed)
• other *(design)* Propose the attested-typical basis (third epistemic state)
• other Record the scope / trust-model boundary (identity by name/path, not signature)
• other *(design)* HP-17 session-scoped grants + record install-clause revision
• other *(design)* Reflect the write-family resolvers in the golden-set & levels
• other *(design)* Note ln creation-time target gating in HP-5
• other *(design)* HP-18 capability laundering + the guard ladder
• other *(design)* Mark HP-18 guarded — all three rungs shipped
• other *(design)* HP-18 rung 3 refinement landed — resolver-side operand contract
• other *(design)* HP-19 cwd-blindness — correct the earlier 'accepted residual' framing
• other *(harness)* Hook-payload capability matrix + rubric + e2e note
• other *(design)* Mark HP-19 resolved (with residuals)
• other *(design)* Drop the install-time-root dead end (HP-19)
• other *(design)* HP-20 — a positive path-admissibility model (parked)
• other *(todo)* Mark cargo-fuzz done, protected-location won't-fix, add harness grid
• other *(todo)* Record credential sweep round-2 findings (value-dependent residuals)
• other *(harness)* Claude Code decision contract — VERIFIED LIVE
• other *(harness)* Consolidate the per-target verification scorecard
• other *(harness)* Cursor CLI verified live — allow IGNORED, deny works (finding)
• other *(harness)* Opencode integration is INERT — pattern generator is a stub (finding)
• other Regenerate COMMANDS.md and command book for the pre-1.0 batch
• other Regenerate for decrypt-read; record the sops/age/ansible-vault batch
• other Regenerate for gpg/openssl decrypt gating; record in TODO
• other Regenerate for ansible-vault decrypt gating
• other Regenerate for gpg require_any + openssl private-key gating; close #2/#3 in TODO
• other Regenerate for openssl pkcs12 gating; close pkcs12 in TODO
• other Regenerate for openssl decrypt hardening + gpg --decrypt-files
• other *(todo)* Record the openssl engine resolver + decrypt-read convergence
• other Regenerate for the coverage additions
• other Correctness pass and prose cleanup for the 0.210.0 release
• other *(cst)* Make word brace-expansion linear, not quadratic
• other *(engine)* Facet-monotonicity coherence check + shared generators
• other *(engine)* Level -> TOML -> Level round-trip
• other *(engine)* Golden-profile facet coverage + the data-driven corpus gate
• other *(engine)* Fix the vacuous corpus gate + cover the rollout modes
• other *(engine)* Use a designated sentinel for the unresearched-command stand-in
• other *(engine)* Proptest guarding against capability laundering in transfers
• other *(engine)* Corpus-wide conservation sweep (HP-18 rung 3)
• other *(engine)* Prove the cwd-blindness gap at engine + production layers
• other *(engine)* Rerunnable shadow-validation sweep
• other *(registry)* Harden the cloud-batch review findings — footgun guards + model limits
• other *(pathgate)* Sweep guard for ungated output-flag writes + gate asciidoctor/graphviz
• other *(registry)* Guard the decrypt-read class end to end
• other *(registry)* Corpus ratchet + bimodal-sub structural guard for decrypt-read
• other *(registry)* Extend the decrypt-read corpus for openssl keys + gpg bare-file
• other *(pathgate)* Prove glued-flag handling with a spelling-invariance property
• other *(fuzz)* Cargo-fuzz scaffold + nightly CI for the classifier
• other Drop levels/default.toml.tmp (stray, accidentally committed)

← All safe-chains releases · All releases