Skip to content

v0.9.23

Choose a tag to compare

View all tags
@Lyin01 Lyin01 released this 19 Aug 05:53
· 4 commits to main since this release
v0.9.23
9ededba
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

LMcode 0.9.23

Hardening release after a full-repo review.

Security

  • Default permission is now auto, not yolo. Sensitive files, Git control paths, and out-of-cwd writes still ask for confirmation. Use lm --yolo or /yes for the old behavior.
  • Bash is no longer invisible to the file sandbox. Plan mode and read-only sandbox treat Bash as an unrestricted write and block it.
  • Bash no longer inherits host *_API_KEY / *_TOKEN / *_SECRET environment variables.
  • Desktop remote WebSocket clients attach only after pairing-token auth. Failed attempts are rate-limited. Token comparison is constant-time.
  • Desktop IPC Zod schemas are enforced at the secureInvoke boundary.

Reliability

  • Context-overflow retry continues only after a compaction actually commits.
  • New /goal runs get a default turn / token / wall-clock budget.
  • Image/audio/video parts are counted in the token estimate instead of 0.
  • WolfPack is no longer default-approved and runs in batches of 8.

UX / performance

  • TUI splash auto-dismisses after 1.5s (Enter still skips).
  • Footer / welcome / editor animations are cheaper; folded transcript components dispose timers.
  • Desktop long conversations window the message list.

DX

  • Node engines aligned to >=22.19.0.
  • pre-commit now runs lint-staged.
  • Scratch capture scripts removed from the repo.

Desktop app version: 0.7.2.

Assets 2
Loading