Skip to content

Compartment 4.13.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 18:12
· 2 commits to main since this release
v4.13.0
62a1c0e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Compartment 4.13.0 is a compatibility release: it is about Compartment installing, starting and staying connected on every system and in every agent, including the places it used to fail quietly - agents' sandboxed shells, Windows on ARM, Intel Macs, containers, and GUI apps that cannot see your PATH. 4.12.0 was merged but never published, so its 79 stability fixes ship here too.

Downloads

File For
Compartment-4.13.0.pkg macOS on Apple silicon, one click, with the menu bar app
Compartment-4.13.0.dmg macOS on Apple silicon, drag to Applications
Compartment-4.13.0-intel.pkg new: macOS on Intel, one click
Compartment-4.13.0-intel.dmg new: macOS on Intel, drag to Applications
compartment-4.13.0.mcpb new: Claude Desktop extension (attached a few minutes after publishing)
compartment-4.13.0-py3-none-any.whl pip and offline installs, any OS
compartment-4.13.0.tar.gz source
SHA256SUMS.txt checksums of all of the above

Everything here was built from this tag on GitHub's machines, and PyPI carries the very same wheel and sdist.

pipx install compartment && compartment init      # or: uv tool install compartment

The Mac app needs macOS 13.4 or newer. The README's new Where it runs table gives every system, CPU and Python version CI tests.

Highlights

  • Works from an agent's own shell. Claude Code and Codex run commands in a sandbox that blocks the macOS boot clock, Unix sockets and some file modes. Every compartment command an agent ran there used to fail with "Cannot identify this boot session". It now uses the vault you unlocked, embeds in-process, and never hangs.
  • Clients can always start the server. compartment integrate writes the full path of the installed command. GUI apps started from the Dock or Start menu do not inherit your PATH, and a bare compartment failed there with "spawn compartment ENOENT".
  • pip install compartment works on Windows on ARM and Intel Macs again. Two indirect dependencies (cryptography, argon2-cffi-bindings) stopped shipping wheels there, and pip tried to compile them. A new CI check fails if any supported platform would need a compiler again.
  • Intel Mac installer. The Mac app is built for Apple silicon and Intel, and no longer bundles libraries that need a newer macOS than it says it supports.
  • A plugin in every store.
    • New: a Claude Desktop extension (.mcpb).
    • Updated: the Claude Code plugin now carries a version, plus better Codex and MCP Registry listings, and corrected Gemini CLI and LM Studio listings.
    • Ready to submit: Docker MCP Catalog and Continue entries.
    • The full list is in the new docs/PLUGINS.md.

Agents and clients

  • 33 clients, adding Kiro, Amazon Q Developer CLI, Junie, Factory and Crush. Continue gets its own block file, and Goose gets a real YAML extension entry.
  • New config locations: Claude Desktop's Microsoft Store build, Cline 4, Kilo Code 7, Cline/Roo/Kilo inside Cursor, Windsurf, VSCodium and Flathub VS Code, and Zed on macOS.
  • Moved config homes followed: CODEX_HOME, GEMINI_CLI_HOME, QWEN_HOME, COPILOT_HOME, OPENCODE_CONFIG_DIR, GOOSE_PATH_ROOT, CLAUDE_CONFIG_DIR, and OpenClaw's state and config variables.
  • OpenClaw: the server is written under mcp.servers, where current OpenClaw reads it. An old entry is moved there.
  • Config edits keep what is already there:
    • Comments in Zed and VS Code files, and the user's own keys in a Codex entry.
    • Each file's own line endings.
    • Files saved by Notepad or PowerShell (byte order mark, UTF-16) are read correctly.
    • integrate codex can no longer corrupt config.toml.
  • Claude Code capture hook: quoted correctly for Git Bash on Windows and non-ASCII user names. It also follows CLAUDE_CONFIG_DIR and autoMemoryDirectory.
  • MCP:
    • Every tool says it never reaches the internet.
    • Tool errors reach the model with their reason.
    • A missing vault says "run compartment init" instead of "locked".
    • compartment serve --vault PATH works.
    • Closing a client's terminal keeps the session's audit rows.
    • mcp 1.x no longer logs a stderr line per request.
    • The real floor is mcp 1.21.2: nothing older runs beside today's pydantic.

Operating systems

  • Windows:
    • A machine up for more than 24.9 days no longer relocks the vault and deletes the unlock credential.
    • A process started without USERNAME no longer deletes everyone's credential.
    • No console windows behind the tray or the panel's buttons, and start at sign-in uses pythonw.
    • With fast user switching, another user's tray is not taken for yours.
    • Saves outlast OneDrive and antivirus holding the vault.
    • The lock always takes byte zero.
    • The Visual C++ message names the ARM64 installer on ARM.
  • macOS:
    • An acknowledged store survives a power cut (F_FULLFSYNC).
    • The boot time is read in-process instead of forking sysctl on every vault open.
  • Linux:
    • Start at login keeps working on Xfce, MATE, Cinnamon and LXQt.
    • It is refused, with a reason, inside Flatpak or a strict Snap.
    • A missing Tk names the exact package for your distribution.
    • compartment dash works on WSL (it opens the Windows browser) and on headless machines (it prints how to reach it).
  • Containers:
    • A container run as an arbitrary user with no home folder works, with COMPARTMENT_PASSPHRASE or COMPARTMENT_SESSION_DIR.
    • Inference threads respect CPU quotas.
    • The Docker image reads a host user's vault, runs with --network none and keeps the offline guard on.
  • BSD, Alpine, Termux:
    • FreeBSD, NetBSD, DragonFly and OpenBSD get the boot clock.
    • OpenBSD's on-disk shared memory is refused for the unlock secret.
    • The installers point Alpine, FreeBSD and Termux at their own onnxruntime package.
  • Installers:
    • They handle "externally-managed-environment" Pythons (Debian 12+, Ubuntu 23.04+, Fedora, Arch, Homebrew).
    • They pick a Python that works on the machine.
    • They survive being re-run or piped into a shell.
  • Offline guard: it now refuses every socket family that can reach another machine, not just IP: Bluetooth, VSOCK/Hyper-V (WSL 2's host) and packet sockets.

Storage

  • A disk that fills up or a sync that fails part way through a store no longer leaves a vault that will not open.
  • Text containing half an emoji (a lone surrogate) is stored and searched instead of failing.
  • Imports with odd dates, NaN, or Unicode line separators no longer break search.
  • A save by another process is noticed even on filesystems with coarse timestamps.
  • A store whose journal write failed is never treated as written.
  • A vault on a filesystem that cannot lock says so at once.
  • Above 20,000 records the exact index stays when usearch has no SIMD (as inside a sandbox). Rebuilding HNSW there took 50 s at 25,000 records on every open.
  • A Python whose SQLite lacks FTS5 gets a clear message.
  • COMPARTMENT_PASSPHRASE is still tried when the boot-session lookup fails.

For maintainers

  • Release workflow: a tag now builds every download, Intel included, and drafts the release. Publishing it uploads those same files to PyPI, then builds and attaches the Claude Desktop extension.
  • CI coverage:
    • Every declared Python (3.11-3.14) on Windows, macOS and Linux, plus ARM64 Linux, Windows on ARM and an Intel Mac.
    • The macOS app on both architectures.
    • The built wheel installed with pipx and driven over MCP on each system.
    • The suite at the lowest dependency versions the bounds allow.
    • A weekly wheel-coverage check.
  • Failure reports: a red job states its failing tests on the run page.
  • One-time store submissions that need an account: listed in docs/PLUGINS.md.
Assets 10
Loading