Skip to content

v4.3.0

Choose a tag to compare

View all tags
@cyyever cyyever released this 20 Mar 13:27
· 31 commits to main since this release
v4.3.0
0e428ed
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • 19 new CVE defenses — CVE tracker expanded from 26 to 45 real-world vulnerabilities with 80% full defense
    coverage. New rules protect Codex CLI config injection (CVE-2025-61260), Cursor workspace RCE
    (CVE-2025-61590), Roo Code config poisoning (CVE-2025-53536), and more.
  • Subcommand consolidation — Removed redundant acp-wrap, mcp gateway, agents, and reload-rules subcommands.
    crust wrap handles all stdio proxy modes (ACP + MCP auto-detection). Use status --agents and list-rules
    --reload instead.
  • Gin → stdlib — Replaced gin HTTP framework with Go's net/http.ServeMux, eliminating 30+ transitive
    dependencies and resolving CodeQL findings.
  • Zero global singletons — Removed all 4 global singletons (globalEngine, globalManager, globalStorage,
    globalProvider). Full dependency injection throughout.
  • Test coverage — 42 E2E tests + coverage improvements: telemetry 38→82%, proxyutil 45→97%, autowrap 50→75%.
  • Clean architecture — Fixed inverted internal/ → pkg/libcrust/ dependency. Shared code moved to
    internal/proxyutil/ and internal/plugin/wire.go.

Security

  • Add protection rules for .cursor/cli.json, .codex/config.toml, .roo/mcp.json, *.code-workspace (#117)
  • Update CVE tracker to 45 entries covering Cursor, Copilot, Claude Code, Codex CLI, OpenClaw, OpenCode, Roo
    Code (#117)
  • Fix DLP errWriter direction, data races, goroutine leaks (#108)
  • Fix fuzz-found looksLikeShellCommand slice panic on whitespace input (#115)

Features

  • Unified change monitor + CLI simplification (#103)
  • Move hook protocol formatting to libcrust (#104)

Refactoring

  • Replace gin with stdlib net/http.ServeMux (#113)
  • Deduplicate plugin init and metrics seeding (#112)
  • Remove all global singletons (#109, #110, #111, #119)
  • Consolidate redundant subcommands (#115)
  • Fix inverted internal → pkg/libcrust dependency (#118)

Bug Fixes

  • Fix gomobile bind FormatHookResponse return type (#106)
  • Fix ReDoS, race conditions, dependency injection (#105)
  • Fix patched status when toggling agents (#102)

Testing

  • Add 42 E2E tests across 5 packages (#114)
  • Improve coverage: telemetry 82%, proxyutil 97%, autowrap 75% (#120)
  • Add 7 CVE regression tests (#117)
Assets 2
Loading