desktop-v0.7.0

shk Desktop v0.7.0

Installers for macOS, Linux, and Windows are attached as shk-desktop_* assets.
macOS installers are Developer ID signed, notarized, stapled, and verified during release.
Windows installers are not Authenticode-signed in this release; SmartScreen may warn on first run. Choose "More info", then "Run anyway".
Checksums are in shk-desktop.sha256sum.
Machine-readable desktop release metadata is in shk-desktop-latest.json.
Tauri updater metadata is published as latest.json and mirrored to the desktop-latest release.

What's Changed

• ci: pin the released v0.7.0 CLI in both workflows by @Kazuki-tam in #284
• feat(release): publish version-free desktop installers on desktop-latest by @Kazuki-tam in #285

Full Changelog: v0.7.0...desktop-v0.7.0

v0.7.0

Install shk-cli 0.7.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/Kazuki-tam/security-harness-kit/releases/download/v0.7.0/shk-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/Kazuki-tam/security-harness-kit/releases/download/v0.7.0/shk-cli-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install Kazuki-tam/tap/shk

Install prebuilt binaries into your npm project

npm install security-harness-kit@0.7.0

Download shk-cli 0.7.0

File	Platform	Checksum
shk-cli-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
shk-cli-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
shk-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
shk-cli-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
shk-cli-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

Windows Package Manager

Generated WinGet manifests for the CLI are attached as shk-winget-manifests.zip.
These files are for maintainers to validate and submit to microsoft/winget-pkgs;
WinGet is not an official install method until that submission is accepted.

What's Changed

• ci: pin pnpm/action-setup back to v6.0.10 by @Kazuki-tam in #280
• ci: pin the released v0.6.4 CLI in both workflows by @Kazuki-tam in #281
• feat: deterministic pseudonymization for tables, text, and Office files by @Kazuki-tam in #282
• chore: bump version to 0.7.0 by @Kazuki-tam in #283

Full Changelog: v0.6.4...v0.7.0

v0.6.4

Install shk-cli 0.6.4

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/Kazuki-tam/security-harness-kit/releases/download/v0.6.4/shk-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/Kazuki-tam/security-harness-kit/releases/download/v0.6.4/shk-cli-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install Kazuki-tam/tap/shk

Install prebuilt binaries into your npm project

npm install security-harness-kit@0.6.4

Download shk-cli 0.6.4

File	Platform	Checksum
shk-cli-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
shk-cli-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
shk-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
shk-cli-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
shk-cli-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

Windows Package Manager

Generated WinGet manifests for the CLI are attached as shk-winget-manifests.zip.
These files are for maintainers to validate and submit to microsoft/winget-pkgs;
WinGet is not an official install method until that submission is accepted.

What's Changed

• fix(desktop): detect a shk CLI that is not on the app's PATH by @Kazuki-tam in #254
• fix(ci-init): stop emitting an unused SHK_VERSION, and pin v0.6.3 in both workflows by @Kazuki-tam in #255
• docs(release): make shk.yml part of the post-release pin bump by @Kazuki-tam in #256
• chore(deps): bump taiki-e/install-action from 2.86.6 to 2.87.2 by @dependabot[bot] in #262
• chore(deps): bump anchore/sbom-action from 0.24.0 to 0.24.2 by @dependabot[bot] in #259
• chore(deps-dev): bump desktop dev dependencies (vite, oxlint, oxfmt, @types/*) by @Kazuki-tam in #265
• chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @dependabot[bot] in #260
• chore(deps): bump taiki-e/install-action from 2.87.2 to 2.87.7 by @dependabot[bot] in #266
• chore(deps): bump serde from 1.0.228 to 1.0.229 by @dependabot[bot] in #272
• chore(deps): bump ureq from 3.4.0 to 3.4.1 by @dependabot[bot] in #271
• chore(deps): bump tauri-plugin-updater from 2.10.1 to 2.11.0 by @dependabot[bot] in #269
• chore(deps): bump tauri-plugin-dialog from 2.7.2 to 2.7.3 by @dependabot[bot] in #268
• chore(deps): bump dirs from 6.0.0 to 7.0.0 by @dependabot[bot] in #267
• chore(deps): bump desktop dependencies (tauri plugins, plugin-react, oxlint, @types/node) by @Kazuki-tam in #278
• chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0 by @dependabot[bot] in #275
• chore: bump version to 0.6.4 by @Kazuki-tam in #279

Full Changelog: v0.6.3...v0.6.4

desktop-v0.6.4

shk Desktop v0.6.4

Installers for macOS, Linux, and Windows are attached as shk-desktop_* assets.
macOS installers are Developer ID signed, notarized, stapled, and verified during release.
Windows installers are not Authenticode-signed in this release; SmartScreen may warn on first run. Choose "More info", then "Run anyway".
Checksums are in shk-desktop.sha256sum.
Machine-readable desktop release metadata is in shk-desktop-latest.json.
Tauri updater metadata is published as latest.json and mirrored to the desktop-latest release.

What's Changed

• ci: pin pnpm/action-setup back to v6.0.10 by @Kazuki-tam in #280

Full Changelog: v0.6.4...desktop-v0.6.4

v0.6.3

Install shk-cli 0.6.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/Kazuki-tam/security-harness-kit/releases/download/v0.6.3/shk-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/Kazuki-tam/security-harness-kit/releases/download/v0.6.3/shk-cli-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install Kazuki-tam/tap/shk

Install prebuilt binaries into your npm project

npm install security-harness-kit@0.6.3

Download shk-cli 0.6.3

File	Platform	Checksum
shk-cli-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
shk-cli-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
shk-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
shk-cli-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
shk-cli-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

Windows Package Manager

Generated WinGet manifests for the CLI are attached as shk-winget-manifests.zip.
These files are for maintainers to validate and submit to microsoft/winget-pkgs;
WinGet is not an official install method until that submission is accepted.

What's Changed

• ci: smoke the composite action against released v0.6.2 by @Kazuki-tam in #235
• chore(deps): batch Dependabot updates by @Kazuki-tam in #243
• chore(deps): bump taiki-e/install-action from 2.86.1 to 2.86.6 by @dependabot[bot] in #246
• chore(deps): replace yanked chacha20 release by @Kazuki-tam in #251
• chore(deps): batch desktop Dependabot updates by @Kazuki-tam in #252
• chore(deps): bump quick-xml from 0.41.0 to 0.42.0 by @dependabot[bot] in #244
• chore: bump version to 0.6.3 and fix pii.ja.phone date false positives by @Kazuki-tam in #253

Full Changelog: v0.6.2...v0.6.3

desktop-v0.6.3

shk Desktop v0.6.3

Installers for macOS, Linux, and Windows are attached as shk-desktop_* assets.
macOS installers are Developer ID signed, notarized, stapled, and verified during release.
Windows installers are not Authenticode-signed in this release; SmartScreen may warn on first run. Choose "More info", then "Run anyway".
Checksums are in shk-desktop.sha256sum.
Machine-readable desktop release metadata is in shk-desktop-latest.json.
Tauri updater metadata is published as latest.json and mirrored to the desktop-latest release.

What's Changed

• fix(desktop): detect a shk CLI that is not on the app's PATH by @Kazuki-tam in #254

Full Changelog: v0.6.3...desktop-v0.6.3

v0.6.2

Install shk-cli 0.6.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/Kazuki-tam/security-harness-kit/releases/download/v0.6.2/shk-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/Kazuki-tam/security-harness-kit/releases/download/v0.6.2/shk-cli-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install Kazuki-tam/tap/shk

Install prebuilt binaries into your npm project

npm install security-harness-kit@0.6.2

Download shk-cli 0.6.2

File	Platform	Checksum
shk-cli-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
shk-cli-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
shk-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
shk-cli-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
shk-cli-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

Windows Package Manager

Generated WinGet manifests for the CLI are attached as shk-winget-manifests.zip.
These files are for maintainers to validate and submit to microsoft/winget-pkgs;
WinGet is not an official install method until that submission is accepted.

What's Changed

• ci: smoke the composite action against released v0.6.1 by @Kazuki-tam in #221
• feat(release): script the CLI mirror for combined tags and add a release skill by @Kazuki-tam in #222
• feat(xtask): let bump-version pin historical version references by @Kazuki-tam in #223
• chore(deps): batch Dependabot lockfile updates by @Kazuki-tam in #224
• chore(deps): bump taiki-e/install-action from 2.85.7 to 2.85.10 by @dependabot[bot] in #220
• chore(deps): bump Swatinem/rust-cache from e18b497796c12c097a38f9edb9d0641fb99eee32 to a45951ff880207c249adf57334cf2e9bd81d6e1e by @dependabot[bot] in #217
• chore(deps): bump pnpm/action-setup from 6.0.9 to 6.0.10 by @dependabot[bot] in #218
• chore(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 by @dependabot[bot] in #216
• chore(deps): batch Dependabot updates by @Kazuki-tam in #231
• feat(detection): guard public env names and follow MCP --env-file by @Kazuki-tam in #232
• feat(security): guard shell history files in the action guard by @Kazuki-tam in #233
• feat(doctor): add --strict, PATH executable checks, and CLI channel verification by @Kazuki-tam in #234

Full Changelog: v0.6.1...v0.6.2

desktop-v0.6.2

shk Desktop v0.6.2

Installers for macOS, Linux, and Windows are attached as shk-desktop_* assets.
macOS installers are Developer ID signed, notarized, stapled, and verified during release.
Windows installers are not Authenticode-signed in this release; SmartScreen may warn on first run. Choose "More info", then "Run anyway".
Checksums are in shk-desktop.sha256sum.
Machine-readable desktop release metadata is in shk-desktop-latest.json.
Tauri updater metadata is published as latest.json and mirrored to the desktop-latest release.

What's Changed

• ci: smoke the composite action against released v0.6.2 by @Kazuki-tam in #235

Full Changelog: v0.6.2...desktop-v0.6.2

v0.6.1

CLI asset mirror for v0.6.1.

The shk-v0.6.1 combined release published all artifacts under the
shk-v0.6.1
tag, but the shell/PowerShell installers, the Homebrew formula, and the npm
package resolve CLI binaries from releases/download/v0.6.1/.... This release
mirrors the CLI assets byte-for-byte (identical SHA-256) so those install
channels work.

Desktop installers and updater metadata live on
shk-v0.6.1,
which remains the canonical release for this version.

Full changes: see shk-v0.6.1.

shk-v0.6.1

Install shk-cli 0.6.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/Kazuki-tam/security-harness-kit/releases/download/v0.6.1/shk-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/Kazuki-tam/security-harness-kit/releases/download/v0.6.1/shk-cli-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install Kazuki-tam/tap/shk

Install prebuilt binaries into your npm project

npm install security-harness-kit@0.6.1

Download shk-cli 0.6.1

File	Platform	Checksum
shk-cli-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
shk-cli-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
shk-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
shk-cli-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
shk-cli-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

Windows Package Manager

Generated WinGet manifests for the CLI are attached as shk-winget-manifests.zip.
These files are for maintainers to validate and submit to microsoft/winget-pkgs;
WinGet is not an official install method until that submission is accepted.

shk Desktop v0.6.1

Installers for macOS, Linux, and Windows are attached as shk-desktop_* assets.
macOS installers are Developer ID signed, notarized, stapled, and verified during release.
Windows installers are not Authenticode-signed in this release; SmartScreen may warn on first run. Choose "More info", then "Run anyway".
Checksums are in shk-desktop.sha256sum.
Machine-readable desktop release metadata is in shk-desktop-latest.json.
Tauri updater metadata is published as latest.json and mirrored to the desktop-latest release.

What's Changed

• feat(desktop): notify on blocked AI activity, bump to 0.6.1 by @Kazuki-tam in #208

Full Changelog: desktop-v0.6.0...shk-v0.6.1