Skip to content

v0.6.0 — secret redaction, queue expiry, and two silent-failure fixes

Latest

Choose a tag to compare

@abhinaykrupa abhinaykrupa released this 05 Sep 17:01
30b06c2

35 commits since v0.5.1. Two of these fix failures that were silently live on real installs — the kind where every surface reports healthy and every task times out.

Fixed — silent failures

A BRIDGE_ROOT under ~/Documents bricked the daemon (#83). On macOS 13+ those directories are TCC-protected. A shell you type into inherits consent, so the daemon runs fine by hand — but launchd has none, cannot chdir into the working directory, and kills the job with EX_CONFIG (78) before Python starts. Nothing reaches daemon.log or daemon.err, and KeepAlive respawns it forever. launchctl list shows it registered the whole time.

Selfcheck now reads the root the daemon actually serves, names TCC as the cause, and install.sh refuses such a root up front.

The client wrote tasks where no daemon was watching (#84). A leftover ./bridge directory from an earlier install won over the installed daemon's real root, producing a 30-second timeout whose error message blamed the daemon. All three client copies now prefer the installed service's root; an explicit BRIDGE_ROOT still wins.

Added — security and durability

  • Secret redaction (#76) — output is scrubbed on the write path, covering the result file, progress log, and status line. The daemon's own token is redacted with certainty; vendor key prefixes, Authorization: headers, inline URL passwords and private-key blocks are matched heuristically. Best-effort by design; see SECURITY.md.
  • Queue-age expiry (#77)max_age_sec bounds how long a task may wait, not just run. A daemon that was asleep no longer executes an hours-stale backlog on wake.
  • Real cancellation — signals the whole process group instead of setting a flag nothing read.
  • Bounded output — capped while streaming, keeping the tail, with explicit truncation flags.

Added — docs

docs/WITHOUT_CLAUDE.md — the bridge driven with no Claude in the loop. 23 of the 25 bundled scripts have nothing to do with Claude, and the transport is a spool directory any language can write. Includes a working client in five lines of shell.

Install

curl -fsSL https://raw.githubusercontent.com/abhinaykrupa/cowork-to-code-bridge/main/install.sh | bash

Not on PyPI yet (#41) — for the package alone, pip install git+https://github.com/abhinaykrupa/cowork-to-code-bridge.

Full changelog: v0.5.1...v0.6.0