Skip to content

v1.1.2

Choose a tag to compare

View all tags
@Drix10 Drix10 released this 28 Sep 15:38
· 97 commits to main since this release
v1.1.2
1465b47

Security and correctness fixes with a regression test per row (docs/AUDIT-v1.1.md rows #67-76).

Security

  • Bare git push (no refspec) is blocked: git would have pushed the checked-out branch, default branch included. Dry runs and tag-only pushes are unaffected.
  • git fetch with a <src>:<dst> refspec is blocked: it rewrites local branches while looking like a read. Plain fetches only move remote-tracking refs and stay allowed.
  • git update-ref and non-list git replace are blocked: direct ref and object rewrites outside every branch protection here.

Fixed

  • state show / state update with a bare --issue no longer silently target issue 1; a missing --manifest value no longer leaks a TypeError; --reason keeps values containing =.
  • repairStale types extensionless paths by the filesystem instead of the name.
  • Launch commands use only flags the supported CLIs offer; Codex's strict-schema output and read-only sandbox, and Pi's read-only tool list, verified against live sessions.
  • Root plugin.json version corrected to 1.1.1; removed a README badge pointing at a directory the package was never listed in.

Full list with a regression test per row: docs/AUDIT-v1.1.md rows #67–76.

Assets 2
Loading