v0.5.1

Changelog

• 178422f Merge pull request #11 from AndersonTechSolutions/fix/memory-subagent-flag
• 08576f4 chore(security): port upstream CVE dependency bumps (#10)
• ef25c3d fix(memory): stop auto-extracting subagent sessions into mem0

v0.5.0

Changelog

• 3f3afa4 docs(memory): Phase 0 hardening + Phase 3a Codex ingestion design spec (#7)
• 2649527 feat(arc-sync): Phase 0 watcher hardening — state v2, directory discovery, bounded reads, 409/413 (PR-0b) (#9)
• c7d0be4 feat(memory): Phase 0 hardening — dedup migration, atomic ingest, bounded extraction, admission queue (PR-0a) (#8)
• f20b423 fix(auth): split skills:write so a publishing key cannot reach every workstation
• ff4c10b test(server): fail the build when a public /api or /mcp route has no auth

v0.4.2

Changelog

• e53ef12 chore(security): document the gosec exemptions inline
• 9b0622b docs(changelog): record the security fixes and CI repair
• 727996d fix(lint): check the error returns errcheck flags
• 57b88eb fix(skills): reject backslash path traversal in arc-sync installs
• a13547f fix(skills): validate upstream git URLs before handing them to git
• 652fb18 fix: resolve staticcheck findings, two of them real
• 0c45eb3 style: gofmt the tree

v0.4.1

Changelog

• 9b50abd chore: add .oneleetignore.json to suppress false-positive SAST findings
• 7eae11b chore: merge upstream security and SAST fixes (v0.1.2-v0.1.4)
• 6d5d522 deps(arc-relay): bump golang.org/x/crypto, x/sys, go.opentelemetry.io/otel to clear CVEs
• c31eba1 docs(changelog): record the memory-ingest chunking fix
• 466599a docs(spec): expand dashboard redesign — fold in admin fleet view of /api-keys
• c591e8e feat(api): PUT/DELETE /api/skills/{slug}/upstream
• 37b38ff feat(arc-sync): skill set-upstream / clear-upstream subcommands
• 7da3c52 feat(dashboard): admin form to set/edit/clear skill upstream
• ac2e454 feat(dashboard): expose API-key capability picker
• b0cd71d feat(dashboard): surface skill drift state on /skills pages
• 025d67f feat(web): add buildActivityFeed with 5 unit tests [Task 1]
• 5234e71 feat: add Recent*, CountActiveAPIKeys, ListAllAPIKeys store helpers
• f0d8345 feat: admin fleet view of all API keys at /api-keys?all=1 [Task 4]
• a1ebe01 feat: edit skill metadata in place — visibility/display_name/description
• a7e5e09 feat: real MCP Servers page with 4-stat summary [Task 3]
• cfaf04a feat: rename Servers nav to MCP Servers, show to all authenticated users [Task 5]
• 2266e09 feat: tile-based dashboard with activity feed [Task 2]
• 6f6e21e fix(arc-relay): confine variable file paths (Oneleet SAST file-inclusion)
• 599ff32 fix(arc-relay): hoist CLAUDE.md read so #nosec G304 attaches cleanly
• 846f82b fix(deps): complete go.sum for otel v1.44.0 (go-logr/logr, stdr)
• 2053a18 fix(docker): bump builder image to golang:1.25-alpine for go 1.25 module
• d2c9a5e fix(release): point goreleaser at the current repo owner
• 9bec52b fix(sync): chunk memory ingest so a large delta cannot wedge the watcher
• 2f7eed0 fix(web): address code review findings in dashboard_activity [Task 1]
• 1f3bcf3 fix(web): extract timeAgoStr helper, fix /servers redirect [Task 2]
• d66233e fix(web): handle ListAPIKeys error and preserve fleet context on revoke [Task 4]
• 46089d3 fix(web): unify Flash to struct in handleAPIKeys, remove duplicate Flash block from api_keys.html
• c7b2649 fix: correct error message wording in CountActiveAPIKeys
• 932dca2 fix: correct nosec comment placement on HTTP calls in main.go
• cac1f07 fix: remove extra whitespace on http.Post line
• 50ba2c8 fix: tighten dir permissions and annotate HTTP URL in main.go (SAST)
• 092d56b fix: tighten dir permissions in project/codex.go (SAST)
• e616a7c fix: tighten file permissions in testutil/golden.go (SAST)
• bd1d911 fix: tighten file permissions in testutil/temp_project.go (SAST)
• a5642d4 fix: tighten temp_project.go file/dir permissions to 0600/0750
• 0758e66 security: resolve gosec G703/G710 findings in web handlers

v0.4.0 — per-API-key capabilities

Headline: API keys can now be granted specific write capabilities (e.g. skills:write, recipes:write) without granting full admin powers. CI servers and teammates can publish skills/recipes without holding admin keys.

Server-side:

• New api_keys.capabilities JSON column (migration 018)
• New store.APIKey.HasCapability() + store.SupportedCapabilities canonical list
• requireCapability middleware on skill upload + recipe POST/PATCH paths
• 403 response now names the missing capability so CI operators know what to grant
• Admin keys retain all powers (additive model, capabilities are an opt-in extra)

Phase 2 of the design:

• POST /api/skills/{slug}/versions/{version} — was admin-only, now skills:write
• POST /api/recipes — now recipes:write
• PATCH /api/recipes/{slug} — now recipes:write

Still admin-only (TODO in code):

• Skill version yank (DELETE) — needs uploaded_by_api_key_id ownership tracking
• Recipe DELETE — same
• Web UI for issuing capability-bearing keys (today: direct DB INSERT)

arc-sync unchanged from v0.3.2 — version stamp bumped to v0.4.0 for release-line consistency. Self-update on existing v0.3.x clients pulls v0.4.0 cleanly.

Compatibility: clients running on relay v0.3.x continue working. Migrating from v0.3.x → v0.4.0 is a no-op deploy (migration runs automatically).

Issuing a capability-bearing key (until UI ships):

-- Find the user the key should belong to
SELECT id, username FROM users WHERE username = 'ci-publisher';
-- Update an existing key, or create one via the existing UI then update
UPDATE api_keys SET capabilities = '["skills:write","recipes:write"]' WHERE id = '<key_id>';

Test results: 805 passing in 30 packages.

v0.3.2

Drop codesign hint after self-update; rename already sidesteps amfid SIGKILL. Drop-in for v0.3.1.

v0.3.1 — self-update env-var fallback

self-update env-var/config-only fix; binary-compat with arc-relay v0.2.0+

v0.3.0 — arc-sync self-update

Headline: arc-sync self-update — hosts can now pull the latest binary from the relay with a single subcommand. Atomic, idempotent, and a clean drop-in for nightly cron.

What's new

• arc-sync self-update — replaces the running binary with the latest from the configured relay's /download/ endpoint
  • Same-directory atomic rename (no torn writes)
  • Hash-based no-op: re-running with no upstream change is exit-0 silent
  • 1 MiB min-size sanity check (catches captive portals, partial transfers)
  • Preserves the existing binary's mode bits (root-owned installs stay root-owned)
  • Flags: --dry-run (fetch + hash, don't replace), --json (single-line cron-log-friendly output)
  • macOS prints a follow-up codesign --force --sign - reminder after replacing (avoids amfid SIGKILL on adhoc-signed Go binaries)

Use it

arc-sync self-update                    # human output
arc-sync self-update --dry-run          # preview only
arc-sync self-update --json             # for cron / log scraping

Cron-friendly:

30 3 * * * root arc-sync self-update --json >> /var/log/arc-sync.log 2>&1

This retires the standalone /etc/cron.d/arc-sync-update shell script we'd deployed on hosts as a stopgap.

Compatibility

• arc-sync v0.3.0 is binary-compatible with arc-relay v0.2.0+ (no relay-side changes required for self-update).
• The relay's /download/<binary> endpoint already serves these v0.3.0 assets if ARC_RELAY_DOWNLOAD_REPO=ATECHPCS/arc-relay (default since v0.2.0).

v0.2.0 — skill update checker + ATECHPCS-fork divergence

First release published from the ATECHPCS/arc-relay fork. Continues the upstream comma-compliance/arc-relay v0.1.x line; v0.2.0 signals divergence and the skill-update-checker as the headline feature.

Highlights

• Skill update checker — opt-in skill upstream tracking with daily drift detection, LLM severity classification (gpt-4o-mini, with offline fallback)
• arc-sync skill subcommand — list, install, remove, sync, push
• arc-sync skill check-updates CLI for the new drift system
• Memory pivot — LLM extraction → mem0 with blended /recall, async + watcher quiescence + 30 min cron
• /download/<binary> defaults to this fork's releases (configurable via ARC_RELAY_DOWNLOAD_REPO env var)
• POST /api/skills/<slug>/check-drift admin endpoint
• Prometheus metrics: skill check counter + duration histogram

arc-sync binaries

Pre-built for 6 platforms (linux/darwin/windows × amd64/arm64). Install via the relay's /install.sh endpoint or download directly from this release.

Compatibility

Operators who want to keep pointing at the upstream release line: set ARC_RELAY_DOWNLOAD_REPO=comma-compliance/arc-relay in the relay's environment.