Repository navigation
coolhand-cli v0.11.1
What's new in v0.11.1
This patch release closes two secret-handling gaps found in a whole-package security review, upgrades coolhand-node to ^0.14.0, clears all open npm audit advisories in dev dependencies, and renames the repository's agent instructions file from CLAUDE.md to AGENTS.md. There are no new commands or flags.
Changed
coolhand-node bumped to ^0.14.0.
The repository's agent instructions file is now AGENTS.md (previously CLAUDE.md), with every reference updated. Claude Code 2.1.277+ falls back to AGENTS.md automatically; older versions won't pick up the instructions until updated. This affects contributors only, not the published package.
Dev dependencies updated: eslint to 10.10.0, @typescript-eslint/parser and @typescript-eslint/eslint-plugin to 8.70.0, and globals to 17.12.0.
Security
redactSecrets now catches quoted secret assignments whose quotes are JSON-escaped — for example export DB_PASSWORD="…" inside a captured tool input. Session payloads are stringified before redaction, so previously the secret value was uploaded to Coolhand unredacted.
The proxy sender and the last-sync lookup no longer follow HTTP redirects, so the X-API-Key header can't be forwarded to a redirect target.
Transitive dev-dependency advisories resolved (brace-expansion, browserslist, baseline-browser-mapping, qs) via a lockfile update. npm audit now reports 0 vulnerabilities.
Breaking changes
None.