0.2.0-beta.18

RepoMagpie 0.2.0-beta.18

The nineteenth pre-release. It has security fixes: please update. They come from the second batch of a security audit of the CLI, the hooks, the MCP server and the app.

Two things work differently after you update:

• The link repomagpie ui prints works once.
• Outside a git repository, a project journal needs --project.

Install or upgrade

You need Node.js 22.12 or later.

npm install -g repomagpie@beta
repomagpie --version
repomagpie setup

repomagpie --version prints 0.2.0-beta.18. Your notes need no changes. repomagpie setup updates the skill's version, so repomagpie doctor stops reporting a skill older than the CLI. The skill's text is the same as in beta.17.

Security

• The link repomagpie ui prints works once. The first time you open it, the app opens and your browser gets a cookie. Reloads and new tabs in that browser keep working: open http://127.0.0.1:<port>/, as the CLI now says when it starts. If you open the link again, a page says it was already used. Go to http://127.0.0.1:<port>/ in the browser that has the app open, or start repomagpie ui again for a new link. A copy of the link, for example in the list of running processes, opens nothing once you have used it. The link, the app's cookie and the token for changes are now three different secrets. SECURITY.md says what this protects against and what it doesn't.
• More hidden characters show as markers. Tag characters (U+E0000 to U+E007F) and the supplementary variation selectors (U+E0100 to U+E01EF) in note text now show as markers such as <U+E0041>, like the other hidden characters. This applies in the terminal, in --json, in the hook's messages, in the app, and in notes made from GitHub. Tag characters can spell text you don't see while an agent still reads it. The app's warning about hidden characters covers them too. Emoji keep their variation selector (U+FE0F). Flag emoji built from tag characters, such as England's, now show markers after the black flag.

Changed

• Outside a git repository, a project journal needs --project. Before, RepoMagpie walked up from the current folder and took the first .magpie/ folder it found. Outside a repository, that could be a .magpie/ in a shared folder above yours, such as another user's folder or the drive's root. The hook, recall, search and suggest then read it as your project's notes. Now:

  • Inside a git repository, nothing changes: the repository's .magpie/ is found from any subfolder.
  • Outside one, the hook, recall, search, suggest and catalog read only your personal journal, unless you pass --project <path>.
  • repomagpie note --to project and repomagpie adopt outside a repository fail without --project. Before, they created .magpie/ in the current folder. The message is No project journal here: outside a git repository, use --project <path>.
  • repomagpie doctor's project line says none here; outside a git repository, use --project <path>.

  If you kept a project journal in a folder that isn't a git repository, pass --project <path> to the commands. The hook has no --project, so it reads that journal again only once the folder is a git repository. Decision 0051 has the reasoning.

Docs

• SECURITY.md describes the app's one-time link and its three secrets, and the new hidden characters.
• The spec and the glossary describe how the project journal is found. Decision 0051 replaces the old walk outside a git repository.

The full list is in the changelog.