Skip to content

v0.11.0 — one-command onboarding + Codex guard client

Choose a tag to compare

View all tags
@Mickdownunder Mickdownunder released this 10 Jul 17:12
v0.11.0
e4b7373
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • safeinstall init is now one-command onboarding. Starter policy config → guard hooks for the agents actually present (.claude/, CLAUDE.md, .codex/, AGENTS.md, .cursor/, .cursorrules, or explicit --client claude,codex,cursor) → trust-surface lock over the result. Idempotent and fail-closed: an existing lock is never re-baselined — drift aborts init instead of blessing a tampered surface. New flags: --client, --no-guard, --no-lock, --mode warn|strict.
  • Codex is a first-class guard client. safeinstall guard install --client codex registers a PreToolUse hook in .codex/hooks.json; installs are rewritten through SafeInstall, unanalysable commands and registry runners fail closed (Codex has no ask decision yet). Users review the project hook once via /hooks.

Security

  • .codex/hooks.json and .codex/config.toml join the Agent Trust Surface enforcement zone.
  • E2E tests are isolated from host repo state (guard hooks spawn in fresh temp dirs).

Published to npm with Sigstore provenance from CI; the tarball reproduces byte-identically from the v0.11.0 tag.

Assets 2
Loading