v1.1.1

1.1.1 (2026-10-10)

Bug Fixes

• anchor secret-reuse scopes instead of listing endpoint keys (06d578c)
• check every enclosing server and endpoint before reusing a local secret (d8b6f37)

v1.1.0

1.1.0 (2026-10-10)

Features

• add follower role, machine id and autobackup-hook stripping primitives (ca7b20c)
• add placement engine with pull ledger and report (576761e)
• add redacted-value merge for live configs (2af5146)
• guard pushes and keep follower machines from pushing (4b6cf0b)
• make the pull ledger secret-blind and narrow marker repair (823c47e)
• pull adopts a follower role and reports kept files and missing secrets (cf5a874)
• route every restore write through the placement engine (8b97ce6)

Bug Fixes

• cap the list of files still containing the marker (ec1bffe)
• count shared deletions in the push guard (5f26a31)
• keep real secrets and local-only keys safe during pull (2a298cb)
• never hand a local secret to a changed MCP endpoint (8dc2163)
• reuse a local secret only when nothing else in its block changed (ac0a856)
• word the kept-for-secrets hint for MCP entries too (e97ea7a)

v1.0.2

1.0.2 (2026-10-10)

Bug Fixes

• treat only entries of root-level maps as identifier names (5f47fcb), closes #10

v1.0.1

1.0.1 (2026-10-10)

Bug Fixes

• address PR #10 review threads on the sanitizer (2f270dc)
• address second review round on PR #10 (1adf599)
• close ReDoS and three more literal leaks in the sanitizer (029cf65)
• close sanitizer leak paths in the literal-value rule (9b64aa4)
• fail closed on nesting, binary junk and webhook URLs (e59e946)
• judge Codex TOML array values under their own key (20d6a99)
• keep plain flags and numbers under env containers (e46753e)
• keep redacted assignments valid YAML and shell (9e4d41b)
• keep the secret-name subtree rule outside containers in TOML (c78e74d)
• match secret names in any letter case again (e77e500)
• read ${…} as one unit, including quoted defaults (32d6c02)
• redact brace-bearing and in-word-hash literals again (7bbd04f)
• redact only literal values in secret-named assignments (d4c6872)
• secret-named JSON objects are credentials at every level (149b10b)
• spare only switches under env, not multi-digit numbers (e838f9d)
• tighten the marker exemption and parse escaped defaults (38629d4)

v1.0.0

1.0.0 (2026-09-12)

Features

• automate npm releases from main starting at 1.0.0 (c65f602)
• carry MCP servers, linked home scripts, memories and external tools (v0.3) (80f3128)

Bug Fixes

• address PR #8 review findings and Windows CI (d619c33)
• apply captured file modes explicitly after write (umask-independent) (b4491f8)
• avoid exposing repository credentials in restore logs (f3d1e14)
• contain restore write targets, honor local policy, align dry-run (1680321)
• harden restore previews and shared skill writes (3f31c8c)
• match ~/.claude.json project keys by normalized path on Windows (545e031)
• prefer a tool's own instructions on pull, report skipped project MCP dirs from the plan (9901b44)
• preserve Codex MCP environment references (e452a3c)
• preserve linked skills and report failed installers (ee2a1b9)
• publish npm releases automatically after main checks (f2197ad)
• record every origin's claim in shared/home-index.json and write it atomically (7c0357e)
• refuse claude/files writes through non-skill symlinks on pull (f57d9b9)
• reuse stored credentials for private pull previews (d7df024)
• stop a partial push from hiding a tool's backup, and from committing nothing (1a5ff95)
• warn when per-project MCP servers are skipped on a fresh machine (916e013)

v0.2.0

Back up and migrate five more AI tools, with cross-platform and secret-safety fixes.

New tool support

• opencode, GitHub Copilot CLI, Kilo Code — terminal config-dir CLIs. Arbella captures each one's config dir (JSON/JSONC config, custom agents/commands, MCP config), redacts token-shaped values, and skips machine-local state, plugin-install artifacts, and reinstallable skills.
• Google Antigravity — a three-root IDE adapter: the VS Code-style User dir (settings/keybindings/snippets), the ~/.antigravity extension list, and the shared ~/.gemini agent config (global rules, MCP servers, skills). Your Google OAuth tokens never leave the machine.
• Cursor CLI (cursor-agent) — it shares ~/.cursor with the IDE, so the Cursor adapter now also captures cli-config.json, global commands/, and rules/, honors CURSOR_CONFIG_DIR, and excludes runtime worktrees.

Cross-platform fixes

• Windows: opencode and Kilo config now resolves to ~/.config/<tool> (XDG on every OS) instead of %APPDATA%\<tool> — the old mapping made detection fail and restore write where the CLI never reads.
• Copilot: freezes the real user config (settings.json, mcp-config.json, lsp-config.json, copilot-instructions.md, instructions/, agents/, hooks/) and excludes config.json (auto-managed auth/plugin state).
• Kilo: also captures tui.json (terminal-UI settings).
• Antigravity: handles the post-2.0 directory split (Antigravity IDE / ~/.antigravity-ide) by probing both layouts.

Secret-safety hardening

• UTF-16-encoded configs (PowerShell's default on Windows) are decoded and sanitized instead of being stored raw — no NUL-byte bypass of the redactor.
• env / environment / headers maps are treated as secret containers in the JSON pass, so arbitrarily-named env vars (e.g. KEY, OPENAI_KEY) are redacted.
• The binary fail-safe scans UTF-8 and UTF-16 views before storing any file.

Verified end-to-end with real push/pull runs across all seven tools, plus 230 automated tests and green CI on Linux, macOS, and Windows (Node 18 & 22).

Full changelog: v0.1.3...v0.2.0

arbella v0.1.3

Release v0.1.3.

Highlights:

• Adds arbella update for updating Arbella itself through npm.
• Adds --version and --dry-run options for update.
• Updates README documentation for the new command.

Published to npm automatically through GitHub Trusted Publishing.

arbella v0.1.2

Release v0.1.2.

Highlights:

• Adds full Cursor setup capture and restore support.
• Restores captured tools by default on pull.
• Normalizes captured symlink targets across platforms.
• Respects Cursor config locations from XDG_CONFIG_HOME and APPDATA.

Published to npm automatically through GitHub Trusted Publishing.

arbella v0.1.1

Fix Codex plugin restore.

Changes:

• Template Claude project plugin paths
• Defer built-in Codex marketplace plugins
• Use current Codex plugin add command
• Keep dry-run plan aligned with real restore

arbella v0.1.0

Initial public release of Arbella.

Published to npm as arbella@0.1.0.

Highlights:

• Push/pull AI dev setups through a private repo
• Supports Claude Code, Codex, and Cursor
• Sanitizes secrets by default
• Includes setup, init, push, pull, status, auth, and secrets commands

Install:
npm install -g arbella