safe-chains releases

← Back to safe-chains · RSS

• v0.213.0 2026-07-23
  • feat *(cargo)* Support the cargo-swift plugin (init + package)
  • fix *(find)* Guard against panic on a trailing -D option
  • other *(engine)* Teach the monotonicity check that execute-locus is an origin band
  • other *(fuzz)* Cut fuzz budget to 5h so runs finish inside GitHub's 6h cap
• v0.212.0 2026-07-23
  • feat *(cli)* Add -v short flag for version
  • other *(cli)* Clarify --suggest usage in help output
• v0.211.0 2026-07-23
  • feat *(suggest)* --suggest generates the local TOML to support an unknown command
  • feat *(targets)* Add Grok CLI (xAI) as a hook target
  • feat *(cst)* Reason about functions, variables, and pipe/loop data-flow
  • feat *(media)* Add sips, the macOS image processing tool
  • feat *(engine)* Honor ~/.claude read-approvals as read-only trusted dirs
  • fix *(engine)* Match credential shields and write-freezes case-insensitively on macOS
  • fix *(registry)* Match credential-read first-arg denials case-insensitively
  • fix *(commands)* Eliminate duplicate command definitions and guard against them
• v0.210.2 2026-07-22
  • fix *(resolve)* Clamp sudo/doas inner-command slice to prevent a panic
  • fix *(classifier)* Budget the recursion so nested exec-delegation can't hang
  • fix *(classifier)* Lower the recursion budget to 512 for bounded hook latency
  • other *(fuzz)* Fork mode so a run enumerates all crashes instead of dying on the first
• v0.210.1 2026-07-21
  • fix *(cst)* Bound substitution parsing against exponential backtracking
  • other *(fuzz)* Pin install-action and pass tool explicitly
  • other *(fuzz)* Pin fuzz target to the gnu host triple
  • other *(fuzz)* Fan out to parallel shards with a corpus-merge job
• v0.210.0 2026-07-21
  • feat *(engine)* Facet vocabulary — Capability and Profile
  • feat *(engine)* Level predicate evaluator
  • feat *(engine)* Compile level TOML; author the three local levels
  • feat *(engine)* Supply-chain sub-facets (source, pinning, exec-surface)
  • feat *(engine)* Resolver scaffolding — classify_locus (path -> LocalLocus)
  • feat *(engine)* Resolver — echo, the reference structural certification
  • feat *(engine)* Resolver — cat and grep (the file-read family)
  • feat *(engine)* Wire the coexistence bridge, fail-closed flags, review hardening
  • feat *(engine)* Resolve rm to a destroy profile (fail-closed, no admitting level yet)
  • feat *(engine)* Author the developer level (destroy carve-in)
  • feat *(engine)* Resolve mkdir + shared write helpers
  • feat *(engine)* Resolve touch
  • feat *(engine)* Resolve cp + generalize the developer write carve-in
  • feat *(engine)* Resolve mv
  • feat *(engine)* Resolve the head/tail/wc read family + numeric -NUM shorthand
  • feat *(engine)* Resolve ln as cp-by-reference (gate the target locus)
  • feat *(engine)* Resolve dd — key=value operands break the getopt model
  • feat *(engine)* Resolve tar — dashless flag bundles + mode-split profiles
  • feat *(engine)* Resolve sed — a flag (-i) flips read into in-place write
  • feat Cwd-aware path classification via a scoped context (HP-19 #1, both layers)
  • feat Wire the harness project root + CLI --cwd/--root (HP-19 #1 live)
  • feat *(cst)* Track intra-line cd across a chain (HP-19 #2)
  • feat *(engine)* HP-20 filesystem region model — read/write path faces
  • feat *(engine)* Go live — the behavioral engine is authoritative, no opt-out
  • feat *(engine)* Bind for-loop variables to their in-list locus
  • feat *(engine)* User-level directory trust grants + file-location docs
  • feat *(engine)* Workspace-boundary file model + role/scheme-aware command gate
  • feat *(engine)* Add the retrieval-granularity facet axis (#1)
  • feat *(engine)* Sibling-workspace (adjacent) locus — reach a peer project
  • feat *(hook)* Reach the upper levels via a configured ceiling
  • feat *(hook)* Support LOWERING the auto-approve ceiling (reader/paranoid)
  • feat *(hook)* Make the coverage fallback level-aware — the full editor plan
  • feat *(fd)* Delegate -x/--exec to the inner command, like find -exec
  • feat *(credential)* Sweep spec + gate op/vault credential reads
  • feat *(kubectl)* Gate get secret/secrets as credential-read
  • feat *(credential)* Gate password-manager / secret-store reads (sweep batch 1)
  • feat *(engine)* Credential_first_arg — the value-dependent credential gate
  • feat *(cursor)* Make Cursor a deny-harness (allow is ignored on the CLI)
  • feat *(engine)* Decrypt-read archetype — decrypt-to-screen as a facet capability
  • feat *(engine)* [[command.flag]] classifying-flag mechanism; gate age -d
  • feat *(sops)* Restructure for 3.13 subcommands; gate decrypt to decrypt-read
  • feat *(gpg)* Classify -d/--decrypt as decrypt-read
  • feat *(engine)* Flag escalation on bimodal subs; gate openssl decrypt
  • feat *(engine)* Unless_flags — neutralize a profile when output is diverted; gate openssl private-key subs
  • feat *(gpg)* Require an inspection command — deny bare-file implicit decrypt
  • feat *(openssl)* Gate pkcs12 -nodes key extraction; extend unless_flags to escalating flags
  • feat *(gpg)* Classify --decrypt-files as decrypt-read
  • feat *(rails)* Cover db:test:prepare and db:test:load
  • feat *(jjpr)* Surface jjpr watch --help
  • feat *(yarn)* Run test runners via safe delegation (jest/karma/mocha/vitest)
  • feat *(tmutil)* Add read-only Time Machine query subcommands
  • feat *(safe-chains)* Allow its own read-only inspection flags
  • feat *(nudge)* Explain the peer dot-shield instead of a generic 'outside workspace'
  • fix *(engine)* Classify_locus fail-closed ordering + proptest gate
  • fix *(engine)* Re-author read-local around locus (fail-closed secret handling)
  • fix *(engine)* Harden fail-open cases found by adversarial probing
  • fix *(engine)* Cp worktree overwrite is recoverable, not effortful
  • fix *(engine)* Cp optional-argument longs must not swallow an operand
  • fix *(engine)* Sed resolver worst-cases the exec command (RCE parity)
  • fix *(shell)* Treat xargs -I replacement string as an invisible stdin item
  • fix *(engine)* Grep resolver reads dash-patterns as patterns, not flags
  • fix *(find)* Bind -exec {} to the find path locus; add composition harness
  • fix *(gcloud)* Rescope subgroup-name globs to per-subgroup read verbs at every depth
  • fix *(az)* Rescope subgroup-name globs to per-subgroup read verbs at every depth
  • fix *(pathgate)* Gate ~156 ungated output-flag/positional writes (output-flag sweep)
  • fix *(pathgate)* Close the output-flag sweep residuals (16 more gates)
  • fix *(pathgate)* Close the positional last-arg writer class end to end
  • fix *(copilot)* Correct hook config path to ~/.copilot/hooks; allow is honored
  • fix *(ansible-vault)* Classify decrypt as decrypt-read (was a bypass)
  • fix *(openssl)* Harden decrypt-read against -out/-text/-EncryptedData_decrypt bypasses
  • fix *(openssl)* Close -pubout+-text and the --/- alias family (review round 3)
  • fix *(openssl)* Fail-closed output-destination check for the resolver
  • fix *(openssl)* Reject a dash-leading -out value (parser token-swallow)
  • fix *(pathgate)* Gate a sensitive path hidden in a glued -flag=path token
  • fix *(engine)* Make flag_present cluster-aware for short classifying flags
  • fix *(pathgate)* Gate a short-glued -Xpath (no =) into a simple whole-command gate
  • fix *(pathgate)* Close ..-escape/$VAR glued-flag bypass; gate wget warc/cookie writes
  • fix *(pathgate)* Gate command-substitution operands in the simple path gate
  • fix *(cargo)* Let cargo about accept its own --version/--help
  • other *(engine)* Review round-2 code-health + medium coverage
  • other *(engine)* Shared Flags walker for the fixed-flag resolvers
  • other *(engine)* Intention-revealing capability constructors + shared helpers
  • other *(engine)* Split resolve into flags/locus/capability submodules
  • other *(engine)* Funnel cp/mv/ln through a transfer_profile builder (HP-18 rung 2)
  • other *(engine)* Derive the conservation sweep from a resolver-side operand contract
  • other *(engine)* Remove shadow mode; add with_mode test override
  • other *(opencode)* Drop --opencode-config (it advertised an allowlist it never produced)
  • other *(openssl)* Classify decrypt/private-key disclosure in an engine resolver
  • other *(design)* Specify the admin level; resolve the containment question
  • other *(design)* The golden-set — full corpus + settled decisions
  • other *(design)* Behavioral taxonomy v1.4 — retire ci, add yolo, per-ecosystem pinning
  • other *(design)* Safety by positive assertion — the fail-closed rule
  • other *(design)* Reframe secret classification as locus + disclosure (fail-closed)
  • other *(design)* Propose the attested-typical basis (third epistemic state)
  • other Record the scope / trust-model boundary (identity by name/path, not signature)
  • other *(design)* HP-17 session-scoped grants + record install-clause revision
  • other *(design)* Reflect the write-family resolvers in the golden-set & levels
  • other *(design)* Note ln creation-time target gating in HP-5
  • other *(design)* HP-18 capability laundering + the guard ladder
  • other *(design)* Mark HP-18 guarded — all three rungs shipped
  • other *(design)* HP-18 rung 3 refinement landed — resolver-side operand contract
  • other *(design)* HP-19 cwd-blindness — correct the earlier 'accepted residual' framing
  • other *(harness)* Hook-payload capability matrix + rubric + e2e note
  • other *(design)* Mark HP-19 resolved (with residuals)
  • other *(design)* Drop the install-time-root dead end (HP-19)
  • other *(design)* HP-20 — a positive path-admissibility model (parked)
  • other *(todo)* Mark cargo-fuzz done, protected-location won't-fix, add harness grid
  • other *(todo)* Record credential sweep round-2 findings (value-dependent residuals)
  • other *(harness)* Claude Code decision contract — VERIFIED LIVE
  • other *(harness)* Consolidate the per-target verification scorecard
  • other *(harness)* Cursor CLI verified live — allow IGNORED, deny works (finding)
  • other *(harness)* Opencode integration is INERT — pattern generator is a stub (finding)
  • other Regenerate COMMANDS.md and command book for the pre-1.0 batch
  • other Regenerate for decrypt-read; record the sops/age/ansible-vault batch
  • other Regenerate for gpg/openssl decrypt gating; record in TODO
  • other Regenerate for ansible-vault decrypt gating
  • other Regenerate for gpg require_any + openssl private-key gating; close #2/#3 in TODO
  • other Regenerate for openssl pkcs12 gating; close pkcs12 in TODO
  • other Regenerate for openssl decrypt hardening + gpg --decrypt-files
  • other *(todo)* Record the openssl engine resolver + decrypt-read convergence
  • other Regenerate for the coverage additions
  • other Correctness pass and prose cleanup for the 0.210.0 release
  • other *(cst)* Make word brace-expansion linear, not quadratic
  • other *(engine)* Facet-monotonicity coherence check + shared generators
  • other *(engine)* Level -> TOML -> Level round-trip
  • other *(engine)* Golden-profile facet coverage + the data-driven corpus gate
  • other *(engine)* Fix the vacuous corpus gate + cover the rollout modes
  • other *(engine)* Use a designated sentinel for the unresearched-command stand-in
  • other *(engine)* Proptest guarding against capability laundering in transfers
  • other *(engine)* Corpus-wide conservation sweep (HP-18 rung 3)
  • other *(engine)* Prove the cwd-blindness gap at engine + production layers
  • other *(engine)* Rerunnable shadow-validation sweep
  • other *(registry)* Harden the cloud-batch review findings — footgun guards + model limits
  • other *(pathgate)* Sweep guard for ungated output-flag writes + gate asciidoctor/graphviz
  • other *(registry)* Guard the decrypt-read class end to end
  • other *(registry)* Corpus ratchet + bimodal-sub structural guard for decrypt-read
  • other *(registry)* Extend the decrypt-read corpus for openssl keys + gpg bare-file
  • other *(pathgate)* Prove glued-flag handling with a spelling-invariance property
  • other *(fuzz)* Cargo-fuzz scaffold + nightly CI for the classifier
  • other Drop levels/default.toml.tmp (stray, accidentally committed)
• v0.209.0 2026-07-07
  • feat *(commands)* Cargo test --workspace and --exclude
  • feat *(commands)* Rustup target add and remove
  • feat *(commands)* Fmt (tofu/terraform) and cargo update are SafeWrite
  • feat *(commands)* Add acorn parser; complete hcloud read surface
  • feat *(commands)* Expand doctl read surface
  • feat *(commands)* Expand linode-cli and sentry-cli read surfaces
  • feat *(commands)* Add oci (Oracle Cloud Infrastructure CLI)
  • other *(design)* Consolidate behavioral capability model into canonical v1.1
  • other *(design)* Stage 3 — default safety levels as facet predicates
  • other *(design)* Add hard-problems log for unresolved model gaps
  • other *(design)* Pilot 2 — tree-heavy conversion of 22 commands (R8-R15)
  • other *(design)* The payload frame + resolution-depth principle
  • other *(design)* Pilot 3 — 21 novel-behavior commands (R16-R23)
  • other *(design)* Payload/language grammar survey (k8s, SQL, HCL, REST)
  • other *(design)* Consolidate findings into canonical spec v1.2
  • other *(design)* Pin trigger axis, sub-machine loci, and the infra level
  • other *(design)* V1.3 touch-up — fold R24-R26 into the canonical spec
  • other *(design)* Spec §4.5 — graceful coexistence with the legacy model
  • other *(design)* The Kubernetes R3 payload-body resolver
  • other *(design)* The profile-resolution engine (Stage 4)
  • other *(commands)* Regenerate COMMANDS.md for command coverage
  • other *(commands)* Regenerate COMMANDS.md for linode/sentry coverage
  • other *(commands)* Regenerate COMMANDS.md for oci
  • other Exclude ..-segment targets from the redirect-promotes proptest
• v0.208.0 2026-07-03
  • feat *(workon)* Support 0.20.0 subcommands and session flags
• v0.207.0 2026-07-03
  • feat *(commands)* Cargo init/new + missing cargo flags + espeak-ng
  • other *(design)* Behavioral capability model — spec, pilot, and research
• v0.206.0 2026-06-30
  • feat *(xcode)* Allow read-only xcrun devicectl; xcrun --version
  • fix *(parse)* Handle redirects on compound commands and eval-safe subs
  • fix *(workon)* Reclassify as SafeWrite; refresh entry for 0.17.x (#3)
  • fix *(check)* Don't auto-approve redirects to sensitive write targets