Skip to content

Releases: DavidCarliez/trustmebro

Release list

TrustMeBro v0.1.1

TrustMeBro v0.1.1 Latest
Latest

Choose a tag to compare

View all tags
@DavidCarliez DavidCarliez released this 26 Aug 20:46
v0.1.1
cd80222

Hardening release

v0.1.1 makes configuration correctness a security boundary instead of silently falling back to the real command.

Fixed

  • No-argument host and nslookup calls now pass through instead of panicking.
  • Existing malformed configs fail closed with exit status 78.
  • TRUSTMEBRO_DISABLE=1 remains an explicit passthrough escape hatch.
  • YAML unknown fields, invalid actions, malformed rewrites, unsafe shim names, duplicate names, invalid record types, and out-of-range exit codes are rejected.
  • shim_commands can no longer escape the managed shim directory.
  • Default audit logs now use a 0700 state directory and 0600 file permissions.
  • Compiled rewrite regexes are reused at runtime.

Verification

  • Added subprocess tests for spoof, passthrough, rewrite, exit status, stderr, no-argument commands, malformed configs, unknown fields, disable mode, and installer traversal.
  • Added Linux and macOS CI with formatting, vet, race tests, and release cross-compilation.
  • Release assets were cross-compiled and verified against SHA256SUMS.
Assets 8
Loading

TrustMeBro v0.1.0

TrustMeBro v0.1.0

Choose a tag to compare

View all tags
@DavidCarliez DavidCarliez released this 26 Aug 19:11
v0.1.0
ee5e5b4

What is TrustMeBro

Transparent proxy for LLM-harness tool calls (codex, Claude Code, pi, ...). Shims named after real commands (dig, nslookup, host, ...) sit first in PATH and, per user-defined rules, spoof output (fixed text or generated dig/nslookup/host answers), rewrite real output (find/regex transforms), or pass through untouched. Zero harness configuration; JSONL audit log of every call.

Install

curl -sL https://github.com/DavidCarliez/trustmebro/releases/latest/download/trustmebro_linux_amd64.tar.gz | tar xz
./trustmebro install

or go install github.com/DavidCarliez/trustmebro@latest.

Features

  • dig/nslookup/host output generators: full sections, +short, +noall +answer, -x reverse, @server, ANY
  • rewrite mode with ordered find/replace or RE2 transforms
  • passthrough via syscall.Exec (same PID, exit codes, TTY behavior)
  • reject mode / default_action for sandboxing model tools
  • install/uninstall with PATH wiring incl. login-shell files (bash -lc)
  • JSONL audit log

Contributors

server
Loading