Skip to content

v0.10.0

Choose a tag to compare

View all tags
@I4cTime I4cTime released this 24 Apr 12:52
v0.10.0
99293cf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

Security

  • Approval HMAC now covers workspace and sessionId; forged/tampered bindings are rejected (new tamper test added).
  • ~/.config/q-ring/ created with mode 0o700.
  • JIT HTTP SSRF fails closed on DNS errors and blocks non-http(s) URLs.
  • Teleport AES-GCM new bundles use a 12-byte IV.
  • Shell hooks switched from exec to execFile with bounded stdout buffer.

Decomposition

  • CLI registration split into nine themed modules under src/cli/commands/.
  • MCP tool registration split into ten focused modules under src/mcp/tools/ plus a shared _shared.ts.

CLI beautification

  • qring --help now renders commands under nine glyph-prefixed sections: Secrets, Project, Quantum, Validation & Rotation, Dev Tooling, Audit & Health, Hooks, Agent Memory, Security & Governance.

Docs

  • docs/cli-mcp-parity.md — full CLI ↔ MCP command/tool mapping with shared-behavior notes.

Tests

  • 164 tests across 24 files (added keyring-lifecycle.test.ts, ssrf-jit.test.ts, workspace/session tamper coverage in approval.test.ts).

Installation

npm install -g @i4ctime/q-ring
# or
pnpm add -g @i4ctime/q-ring
# or (Homebrew)
brew install i4ctime/tap/qring

Full changelog: https://github.com/I4cTime/quantum_ring/blob/main/CHANGELOG.md

Assets 2
Loading