v0.1.0-alpha.2

Alpha.2 adds portable integrity-checked source snapshots and writable disposable replay workspaces. Generated replay files are tracked and discarded; the original checkout and evidence snapshot remain unchanged. Replay remains offline, non-root, resource-limited, and best-effort redacted.

v0.1.0-alpha.1

ReproSpec v0.1.0-alpha.1 (Pre-release)

We are releasing the first public pre-release of ReproSpec, an experimental CLI and evidence-bundle format designed to make Node.js executions portable, integrity-checked using SHA-256 file hashes, and re-runnable inside local sandboxed containers.

Key Capabilities

• Capture Engine: Logs exit codes, standard streams, and redacts supported secret patterns from the persisted evidence representation, including supported environment metadata, stored command arguments, stdout, and stderr.
• Integrity Validation: Computes and verifies SHA-256 integrity hashes for all declared files in the bundle directory.
• Sandboxed Docker Replay:
  • Phase 1 (Dependency Build): The ephemeral dependency builder may use network access only to run npm ci and obtain packages. It runs without host credentials, home-directory mounts, Docker socket access, or inherited host environment variables.
  • Phase 2 (Offline Replay): The actual replay container runs offline with --network none, applying CPU, memory, and PID limits.
• Preconfigured Resource Profiles: Choose between minimal, standard, and extended profiles to enforce sandbox execution limits.

⚠️ Experimental Alpha Warnings:

• Replay executes project code. It should only be used with trusted local repositories during this alpha phase.
• Redaction is best-effort using regex heuristic patterns and does not guarantee that every credential is caught.
• SHA-256 verification does not prove author identity or captured trace truthfulness.