Skip to content

v0.1.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Jul 20:23
v0.1.2
dd1849c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.1.2 (2026-07-20)

Security

  • cli: workspace trust gate. Project-scope executables (MCP stdio servers, hooks, plugins) loaded from .splice/ are no longer spawned automatically when the workspace is untrusted. Trust is resolved from CLI flags (--trust / --no-trust), the SPLICE_TRUST_WORKSPACE env var, the persisted ~/.config/splice/trust.json store (ancestor lookup, parent trust covers children), and the defaultProjectTrust setting (ask / always / never, default ask). Untrusted workspaces skip project resources and print a warning; this closes a remote-code-execution vector where cloning a malicious repository and running splice would execute configured commands. (2479d6a)
  • secrets: credential environment variables are now scrubbed from child processes (bash, exec, hooks, MCP stdio, plugins, sandbox runner). Known credential names (OPENAI_API_KEY, ANTHROPIC_API_KEY, AWS_SECRET_ACCESS_KEY, etc.) and suffix patterns (_API_KEY, _TOKEN, _SECRET, _PASSWORD) are stripped before spawn, with SPLICE_CHILD_ENV_ALLOWLIST for explicit passthrough. Prevents prompt-injected env / printenv from exfiltrating provider keys. (2479d6a)
  • sandbox: unparseable / obfuscated shell commands now force an explicit approval prompt instead of being auto-allowed under an active native sandbox. (2479d6a)
  • sandbox: the safe-git command classifier now rejects --git-dir, --work-tree, and -c (global and inline) so an approved command prefix cannot be used to operate on an arbitrary repository outside the workspace. (2479d6a)
  • dtools: the deterministic-tool path resolver now calls filepath.EvalSymlinks and rejects symlinks pointing outside the workspace. Git preserves symlinks on clone, so a repository could previously ship a symlink to a file outside the workspace and have the security scanners read it. (2479d6a)
  • sandbox: the opt-in seccomp Unix-socket block now fails closed (exit 125) instead of running the command without the filter. (2479d6a)
  • mcp: plaintext http:// MCP server URLs now emit a warning at config load (loopback / localhost excepted). (2479d6a)

Bug Fixes

  • update: correct the npm package name from @gitlawb/splice to @taf0711/splice. The npm update path referenced a package name the maintainer does not own; if unregistered, npm self-update would break, and if registered by a third party it was a supply-chain takeover vector. (#5)
  • cli: the mcp tools list command now resolves workspace trust instead of unconditionally loading project MCP servers, closing the last gate gap. (2479d6a)
  • tui: setup pipeline stage picker shows discovered models, count, scroll indicator, and current mark (a1676dd)
  • tui: setup pipeline picker shows selected model detail line (b3b9872)
  • tui: pipeline picker shows discovered models, not just the catalog (15e9a9b)
  • tui: pipeline picker detail line shows the model name (96131d7)
  • tui: Enter opens pipeline stage picker, Right advances to Safety (fa8166b)
  • ci: npm trusted publishing needs Node 24 (npm CLI 11.5.1+) (c5c6fd7)
  • tui: setup wizard per-stage model picker uses search and filtered list (#3) (da9f47a)
Assets 14
Loading