safe-chains releases

← Back to safe-chains · RSS

• v0.220.0 2026-07-31
  • feat *(registry)* Add the atom output kind, wired fail-closed
  • feat *(regions)* Drop the peer dot-shield; the credential shield carries it
  • feat *(engine)* Confine a flanked atom leaf under its literal prefix
  • feat *(engine)* Add the locus.anchoring axis and explain an unconfined path as one
  • fix *(ci)* Install cargo-fuzz the supported way in the property-target job
  • fix *(engine)* Dot-only flanking does not confine an atom
  • fix *(engine)* --help / --version void a command's output claim
  • fix *(hook)* Render internal substitution sentinels as $(…) before a human sees them
  • fix *(hook)* A sentinel LOOKALIKE must not truncate the path a nudge reports
  • fix *(hook)* An interpolated path keeps its credential warning
  • other *(todo)* Revise atom layer 1 — the tagged-substitution sentinel already carries it
  • other *(todo)* Record the $SCRATCH residue found in adversarial review
• v0.219.1 2026-07-31
  • fix *(herb)* Correct the lint flag surface against 0.10.2
• v0.219.0 2026-07-31
  • feat *(fuzz)* Add metamorphic and hook-envelope targets
  • feat *(fuzz)* Add explain_render and suggest_roundtrip targets
  • feat *(fuzz)* Add level_monotonic, and pin the staircase it explores
  • feat *(fuzz)* Add config_load, the one input an attacker can place in a repo
  • feat *(fuzz)* Add setup_merge, completing the property-target suite
  • feat *(regions)* Admit distributed package CONTENT for reading
  • feat *(regions)* Admit ~/.local/bin for reading; verify cargo deny --version
  • fix *(engine)* Unify the two locus gates, and move the grant rule to the seam
  • fix *(cargo)* Accept --version on the deny sub
  • other *(wasm-pack)* Classify by facet profile instead of candidate marks
  • other *(todo)* Record what the fuzzing does and does not reach
  • other 0.219.0
• v0.218.0 2026-07-30
  • feat *(cst)* Parse the last three POSIX shell grammar constructs
  • feat *(engine)* Let a researched command bound what its substitution names
  • feat *(cst)* Render >| and >> as the operator that was typed
  • feat *(engine)* Bound a loop over a declared substitution
  • feat *(cst)* Parse the both-streams redirects and the |& pipe
  • feat *(registry)* Tag the config-is-code class, and gate marp
  • fix *(perl)* Gate file operands by locus, and allow -i in the worktree
  • fix *(engine)* Gate a bounded substitution in the path-gate too
  • fix *(policy)* Treat a leading ~ as a path
  • fix *(tilt)* Gate the template positional as an executor
  • fix *(karma)* Gate config positionals, and guard the pattern structurally
  • fix *(registry)* Keep [command.output] out of repo-level custom TOML
  • fix *(targets)* Abstain when the envelope names a non-shell tool
  • fix *(agy)* Self-filter on toolCall.name
  • fix *(targets)* Don't panic when a settings file has a wrong-typed key
  • fix *(registry)* Skip an invalid custom config instead of aborting
  • fix *(pathctx)* An unresolvable cd leaves the cwd UNKNOWN, not unchanged
  • fix *(cst)* Track shell state a compound changes, not just a bare statement
  • fix *(cst)* Model word splitting on unquoted expansions
  • fix *(cst)* Parse a heredoc body inside $( ) as data, not code
  • fix *(cst)* Fence a doc example so it is not compiled as a doctest
  • fix *(hook)* Name only real operands in the overreach nudge
  • fix *(explain)* Stop a command from forging a line of our own output
  • fix *(hook)* Abstain on a blank command instead of approving it
  • fix *(targets)* Don't panic or clobber on a wrong-typed key in cursor/codex setup
  • fix *(suggest)* Don't let --suggest mislead the trust decision it asks for
  • fix *(registry)* Gate the wrapper flags whose value is a program
  • fix *(registry)* Gate executor flags outside the wrapper block too
  • fix *(registry)* Gate config flags on tools whose config file is code
  • fix *(envvars)* Pair executor flags with their env twins, and tag the pairing
  • fix *(tests)* Calibrate the termination budget instead of hardcoding 1.5s
  • fix *(tests)* Floor the termination budget at 10s, not 1.5s
  • other *(repo)* Drop two decision records misfiled as TODO items
  • other *(todo)* Record the ANSI-C quoting over-deny
  • other *(todo)* Measure the gate surface, and record two clean sweeps
  • other *(engine)* Assert a substitution never beats a path it could produce
  • other *(engine)* Extend abstraction soundness to every path-approximating site
  • other *(targets)* Assert each harness's decision FIELD, not just the value
  • other *(cst)* Hold the --explain renderer to the no-panic contract
• v0.217.0 2026-07-27
  • feat *(engine)* Classify the env assignments that change what a command does
  • feat *(engine)* Close four env twins of flags already denied
  • feat *(engine)* Classify interpreter option strings
  • feat *(engine)* Classify env assignments in every spelling
  • fix *(task)* Cap positionals so naming a task is not auto-approved
  • fix *(dotenv)* Gate the env-file path at the executor locus
  • other *(design)* Correct the loader-injection example, which was wrong on macOS
  • other *(design)* Enumerate the env-injection vectors and settle the design
  • other *(design)* Finish the env-var research — per-interpreter option allowlists
  • other *(design)* Probe rust, php, python, .NET; enumerate the untested ecosystems
  • other *(repo)* Lint test code too, and clear the backlog it hid
• v0.216.0 2026-07-26
  • feat *(cargo)* Support cargo sweep
  • feat *(rake)* Support the compile task
  • fix *(engine)* --explain named an inherited clause's tighter bound
  • fix *(allowlist)* A user rule must cover the command as typed, env prefix included
  • other *(cli)* Say that --explain shows the facet breakdown
  • other *(sqlite3)* Record why a read-only SQL subset is not expressible
  • other *(design)* Record the env-prefix findings without proposing a fix
• v0.215.0 2026-07-25
  • feat *(engine)* Add the local working-copy archetypes
  • feat *(vcs)* Re-research git's local working-copy surface under the facets
  • feat *(aws)* Restructure secretsmanager from glob to researched sub-subs
  • feat *(gcloud)* Restructure secrets from a glob into researched sub-subs
  • feat *(aws)* Restructure kms from a glob into researched sub-subs
  • feat *(aws)* Research iam's read-verb glob flags
  • feat *(aws)* Research the s3api, logs and cloudtrail read-verb glob flags
  • feat *(aws)* Research the ec2, rds, lambda and ecs read-verb glob flags
  • feat *(aws)* Research the ssm, dynamodb, cloudformation, sns and sqs glob flags
  • feat *(engine)* Recognize loopback network locations
  • feat *(registry)* Gate a flag on its value naming this machine
  • feat *(engine)* A local endpoint re-classifies a sub as its local archetype
  • feat *(aws)* Classify dynamodb's item surface for local development
  • feat *(engine)* Report WHICH facet refused a command
  • feat *(engine)* Detect confusable archetypes mechanically
  • fix *(registry)* Enforce the flag allowlist on profiled subcommands
  • fix *(registry)* Require a profiled sub to declare its flag surface
  • fix *(registry)* Enforce a researched flag list on first_arg glob families
  • fix *(aws)* Dynamodb scan is a data-export, not a bulk-object-read
  • fix *(registry)* A flag past -- is a positional, not an endpoint
  • fix *(registry)* Decide the loopback destroy rule by operation, not by name
  • fix *(engine)* Derive the fail-closed sentinel from declared per-axis hazards
  • fix *(engine)* The sentinel's operation was one an everyday level admits
  • other *(engine)* Compose the loopback effect instead of swapping archetypes
  • other *(repo)* Record the glob-family flag migration and its remaining set
  • other *(repo)* Record the loopback feature's remaining work
  • other *(repo)* Correct the install-clause claim in the unverified-axes note
  • other *(engine)* Property-test the facet enumeration and the loopback host check
• v0.214.0 2026-07-24
  • feat *(fuzz)* Registry-derived seed corpus + dictionary generator
  • feat *(scratchpad)* Recognize the session scratchpad as a trusted working area
  • feat *(hook)* Explain a foreign-temp execution denial and how to bless it
  • feat *(media)* Support whisper and whisper-cpp speech-to-text
  • fix *(fuzz)* Locate the coverage binary under the workspace target root
  • fix *(fuzz)* Make the per-push mutation burst opt-in, not automatic
  • fix *(commands)* Allow safe-chains' own --session-id flag
  • fix *(classifier)* Charge brace-expansion fan-out to the shared work budget
  • fix *(repo)* Name the default binary so bare cargo run works
  • other *(fuzz)* Record the fuzz entry point, registry seeding, and blind spots
  • other *(fuzz)* Design the composition-invariant fuzz target
  • other *(fuzz)* Commit the nightly's three slow inputs as seeds
  • other *(registry)* Guard that safe-chains knows its own CLI flags
  • other *(fuzz)* Build the target once per run, and add a coverage report
  • other *(fuzz)* Add a per-push corpus replay gate
  • other *(fuzz)* Seed the nightly with the registry corpus + dictionary
  • other *(fuzz)* Shards upload only new finds, not the whole corpus
• v0.213.0 2026-07-23
  • feat *(cargo)* Support the cargo-swift plugin (init + package)
  • fix *(find)* Guard against panic on a trailing -D option
  • other *(engine)* Teach the monotonicity check that execute-locus is an origin band
  • other *(fuzz)* Cut fuzz budget to 5h so runs finish inside GitHub's 6h cap
• v0.212.0 2026-07-23
  • feat *(cli)* Add -v short flag for version
  • other *(cli)* Clarify --suggest usage in help output