v0.11.5

thlibo v0.11.5

Local-Gemma tool-output compression middleware for Claude
Code + Codex CLI. Inference is delegated to
inferd — thlibo's
installer detects/installs inferd as a sidecar.

Binaries

Cross-platform binaries are attached as tarballs/zip.
Each bundle contains bin/thlibo, README.md,
CHANGELOG.md, and LICENSE.

Verifying signatures

Each archive, SHA256SUMS, and the CycloneDX SBOM are
signed by cosign via Sigstore's keyless flow. No public
key to manage — the identity is anchored in this
workflow's GitHub OIDC token.

cosign verify-blob \
  --certificate-identity \
    "https://github.com/3rg0n/thlibo/.github/workflows/release.yml@refs/tags/v0.11.5" \
  --certificate-oidc-issuer \
    "https://token.actions.githubusercontent.com" \
  --bundle thlibo-linux-amd64.tar.gz.cosign-bundle \
  thlibo-linux-amd64.tar.gz

The transparency-log entry is automatically published to
Rekor (rekor.sigstore.dev); cosign verifies it as part
of the flow above.

SBOM

thlibo-sbom.cdx.json is a CycloneDX SBOM generated from
the repo at the release tag. Signed with cosign like the
archives.

Inferd sidecar

On first run, thlibo install probes for a running inferd
admin socket and consumes it if present; otherwise it
fetches the matching inferd release for the host platform
and runs inferd's installer. The model GGUF is downloaded
once by inferd into a shared per-platform model store.

What's Changed

• ci: pin the scanner installs instead of resolving @latest at job time by @3rg0n in #112
• fix(pdf,ci): bound object nesting, fail open on zero pages, revive the CVE gate by @3rg0n in #113
• docs: record that fuzzing cannot catch a stack overflow by @3rg0n in #114
• fix(fuzz): derive the job timeout from fuzztime so a soak can finish by @3rg0n in #115
• test: close the zero-coverage gaps and the Linux autostart hole by @3rg0n in #116
• fix(install): replace the dead APE/WSL hint with a real autostart warning by @3rg0n in #117
• release: v0.11.5 — hardening, dead-advisory removal, and a moved changelog entry by @3rg0n in #118

Full Changelog: v0.11.4...v0.11.5