ACS v0.6.0

ACS v0.6.0

ACS v0.6.0 is a breaking release on macOS 26 Apple Silicon (darwin/arm64)
with Seatbelt. It removes legacy Profile envelopes, hardens Session cleanup and
Codex credential handling, denies sandboxed access to host-local (loopback)
services by default, and lands the full Linux sandbox stack while production
Linux launches stay disabled.

Breaking changes

• Remove legacy Profile v1 and v2 envelopes and their migration path (#177).
  Stored Profiles must already use the single envelope. Readers still accept the
  previous envelope number 3 as an alias of version 1 (#178). Documentation no
  longer describes v1/v2/v3 wording (#179).
• Profiles that still use the old envelopes will not load. Recreate or rewrite
  them with the current Profile builder before upgrading.
• Sandboxed processes can no longer connect to host-local services over
  loopback (127.0.0.1, ::1, localhost) by default (#222). This blocks access
  to things like Ollama, Jupyter, local databases, dev servers and browser
  debugging ports. Profiles opt in per port with the new common.network
  capability (version 1), for example
  "network": {"version": 1, "selection": {"loopbackPorts": [11434]}}.
  Ports must be unique integers from 1 to 65535, at most 64. The ACS-managed
  Codex browser login alone still gets localhost:1455 for its callback;
  ordinary Codex sessions do not.
  Migration: for each Profile whose agent needs a local service, add the
  port with the Profile builder's Network editor (or the field above), then
  check acs explain/--dry-run, which lists the allowed loopback ports.
  Profiles saved by v0.6.0 with a network selection are rejected by older
  ACS builds. Other 127.0.0.0/8 aliases, LAN addresses and remote hosts are not
  covered; ACS is not a general egress firewall. On Linux the field is
  accepted but not yet enforced (#223).

Security and Session hardening

• Settle Seatbelt Session processes from the unsandboxed parent so agent
  processes do not survive the Session (#194).
• Verify the Codex id_token signature, issuer, audience, and account before
  persisting credentials projected from a Session (#195).
• Discard pending terminal input on exit (#181).
• Match absent exclusions without letter-case sensitivity (#182).
• Verify sandbox denials in macOS CI (#180).
• Deny loopback network access by default with explicit per-Profile ports
  (#222; see Breaking changes).

Profile and launch

• Unified Profile builder, filesystem exclusions, transaction recovery, and a
  unified launch check (#158, #163, #161, #159).
• Faster Session open and no 5 s exit hang on unproven cleanup (#173, #174).
• Run the Devin skills and authentication preflights concurrently, the
  authentication probe in its own tracked Session with identical isolation
  (#221). On the macOS benchmark the preflight phase dropped from about 270-280 ms
  to about 175-185 ms (median). ACS_DEBUG_TIMING reports each preflight plus the
  overall devin.preflights wall-clock time.
• Reviewed target versions and tested example Profiles (#160, #175).

Linux sandbox (production launch still disabled)

• Design and fail-closed Linux seams and portable Ubuntu 24.04 tests (#193,
  #196, #197).
• Kernel capability probe and bwrap provenance checks; filesystem and runtime
  authority compiled into a mount/Landlock plan; sealed Bubblewrap, Landlock
  and seccomp launcher (#205, #208, #209).
• Per-Session cgroup v2 containment with pidfds, authenticated cleanup,
  quarantine and recovery (#210, #211).
• Explicit credential providers and a hardened XDG 0600 file credential
  provider for Linux (#206, #207).
• Qualified shell and generic command recipes and locked Linux Devin and Codex
  CLI targets (#212-#214, landed via #224).
• Native Linux containment and denial gates on GitHub's ubuntu-24.04 runner
  (#215) and staged, unpublished linux/amd64 candidate artifacts (#219).
• Linux production launches remain disabled even when acs doctor --check-linux-capabilities probes pass. Ubuntu 24.04 also needs an AppArmor
  decision for unprivileged user namespaces before Linux can ship.
• Credential verification: Codex credentials from a Session are only persisted
  after id_token verification, which requires reaching auth.openai.com.

Tooling and repository hygiene

• OpenSSF Scorecard, pinned staticcheck and actionlint, CODEOWNERS, issue forms,
  SECURITY.md, and macOS Session benchmark workflow (#199–#203, #171, #176, #184).

Upgrade and compatibility

Existing installations in the supported direct, user-owned regular-file layout
can use acs update --check and then acs update v0.6.0 after confirming every
stored Profile uses the current envelope. This release does not ship a v1/v2
migration. For other layouts, follow the manual upgrade and recovery guide on
the v0.6.0 tag once published.

ACS remains unsigned and unnotarized. The installer does not require sudo, edit
shell startup files, or change Gatekeeper settings.

ACS v0.5.2

ACS v0.5.2

ACS v0.5.2 improves installation guidance. The supported runtime remains
macOS 26 on Apple Silicon (darwin/arm64) with Seatbelt.

Installation

• Reject unsupported or undetectable macOS versions before downloading release
  assets. The installer accepts macOS 26 and still checks the OS and architecture.
• Suggest acs update when the installation destination already exists.
  The installer preserves the existing entry and refuses to overwrite it.
• Simplify the README installation command and keep installer inspection as an
  optional procedure.

Documentation

Consolidate user procedures, reference contracts, and contributor documentation.
Current guides use stable release links and operator-supplied version and digest
inputs instead of tracking the latest release number.

Upgrade and compatibility

Existing installations in the supported direct, user-owned regular-file layout
can use acs update --check and then acs update v0.5.2. This patch does not
change Profile, exchange, or Session formats or add a stored-data migration.
For other layouts, follow the
manual upgrade and recovery guide.

ACS remains unsigned and unnotarized. The installer does not require sudo, edit
shell startup files, or change Gatekeeper settings.

ACS v0.5.1

ACS v0.5.1

ACS v0.5.1 is a security and maintenance update to v0.5.0. The supported runtime
remains macOS 26 on Apple Silicon (darwin/arm64) with the system Seatbelt
backend. This release does not introduce a new Profile or exchange format.

Security and correctness

• Upgrade golang.org/x/text from v0.30.0 to v0.42.0. This includes the
  v0.39.0 fix for
  GO-2026-5970 / CVE-2026-56852. The advisory
  describes an infinite loop when Unicode normalization handles invalid UTF-8.
  The Go vulnerability scanner found an affected symbol reachable through ACS
  common Skill destination validation; that finding does not establish a
  demonstrated end-to-end exploit. The same release-target scan passes after
  the dependency update.
• Build with Go 1.27.1 instead of the Go 1.25.0 toolchain embedded in v0.5.0.
  This removes the known standard-library advisory matches reported against
  the older binary. Binary scans cannot establish that every reported
  vulnerable function was reachable.
• Update github.com/klauspost/compress to v1.20.1, including the v1.18.7 fix
  for GO-2026-5841, and select
  golang.org/x/mod v0.41.0 through the updated dependency graph for
  GO-2026-6179 and
  GO-2026-6180. These were dependency
  metadata findings: the affected packages were not imported by ACS or its
  tests, and neither module is included in the release executable.
• Restrict terminal device grants to the PTYs attached to the Session and the
  controlling-terminal alias, while preserving ownership-tracked child PTYs.
  Retain private close-on-exec descriptor pins until cleanup is proven;
  unrelated terminals receive no blanket device or ioctl permission.
• Traverse selected Skill material using pinned directory descriptors and
  no-follow child opens, validate opened objects, and create output files
  exclusively. Preserve descendant symlinks as links. The allowlisted Devin
  credential copy also validates its opened input before creating output.
  This hardening does not authenticate the initial root, snapshot concurrent
  edits, or change runtime access to copied links.
• Recover current Profile Builder callback panics through orderly terminal
  shutdown, avoiding the confirmed concurrent reader-close path. Preserve
  unknown/recovery-required save outcomes and independently confirmed commits,
  and report sanitized errors after restoring the terminal. Native race stress
  covers the reproduced panic path; this is not a guarantee about every
  internal failure in the terminal framework.
• Preserve Session recovery evidence when private finalization is incomplete
  or cannot be verified, even after the 720-hour retention window. Prune
  eligible completed metadata only after private capability/root-binding
  cleanup and directory synchronization. Existing recovery proof requirements
  and retention limits remain unchanged.
• Report accurate capability selection counts during Profile inspection,
  including a clear configured summary when a count is unavailable.
• Validate portable Profile syntax and relationships before resolving local
  bindings, so malformed intent is not reported merely as a missing binding.
• Share strict JSON scanning while preserving the separate validation policies
  of Profile inspection, portable exchange, and MCP intent.

Maintenance

• Decouple common capability descriptors and Profile exchange codecs from
  provider-specific adapters without adding target activation or host access
  to syntax-only operations.
• Build with pinned Go 1.27.1 and GoReleaser 2.18.2. Contributors building from
  source need Go 1.27.1 or later; reproducing release artifacts requires the
  exact repository toolchain.
• Remove the unsupported Linux sandbox backend and its private helper path.
  This does not remove a supported release target: v0.5.0 already supported
  only macOS 26 Apple Silicon. Linux compilation remains a non-blocking source
  portability check, not a runtime support guarantee.
• Add pinned Go vulnerability checks and weekly Dependabot configuration for
  Go modules and GitHub Actions. These checks do not establish that native
  GitHub Dependabot alerts or security updates are enabled.
• Check both tagged source and the exact installed candidate with the pinned
  Go vulnerability scanner before release promotion. Scanner or database
  errors, reachable source findings, and binary advisory matches block the
  relevant gate.
• Update the pinned artifact upload/download Actions and repair Dependabot
  selection for the untagged github.com/charmbracelet/x/vt submodule using
  a narrow exception for the nonexistent exact v0.1.0 submodule version.
  The dependency remains covered by vulnerability scanning.
• Reorganize the contributor, architecture, CLI, Profile, diagnostics, security,
  and recovery documentation around current behavior.

Upgrade and compatibility

Existing v0.5.0 installations in the supported direct, user-owned regular-file
layout can use acs update --check and then acs update v0.5.1. The updater
verifies release assets and replaces only the ACS executable. It does not
migrate or downgrade Profiles, history, Sessions, or named authentication.
No automatic stored-data migration is added by this patch.

Fresh installations use the release-specific install.sh and
acs_0.5.1_darwin_arm64.tar.gz with SHA256SUMS. The installer refuses to
overwrite an existing executable and does not require sudo or edit shell
startup files. Keep a known-good compatible binary and follow the
manual upgrade and recovery guide
when the updater's layout requirements are not met. Binary rollback is separate
from stored-data recovery.

Integrity and validation boundary

The release pipeline scans the tagged source, builds one candidate, then scans
and validates the exact installed bytes on native macOS 26 Apple Silicon. It
attests the archive and checksum manifest before immutable publication. The
installer is byte-matched to that artifact set; it is not an attestation subject.

The scanner is pinned, but the advisory database is live. A clean result is
point-in-time evidence for the selected source/build configuration and embedded
binary versions. It does not cover unknown vulnerabilities, all external target
executables, or every possible security issue. Stripped binaries are checked
conservatively using embedded dependency/toolchain versions when symbols cannot
be recovered.

ACS remains unsigned and unnotarized. Checksums and provenance are not Apple
approval or malware review. Do not remove quarantine, disable Gatekeeper,
ad-hoc sign the binary, or weaken Seatbelt to make it run. Native automated
gates use synthetic authentication and local fixtures; their success does not
establish real-account login, hosted inference, or sustained daily use.

ACS v0.5.0

ACS v0.5.0

ACS v0.5.0 adds the Profile lifecycle, contained Codex and Devin capabilities,
and explicit stable-release updating described below. It supports macOS 26 on
Apple Silicon (darwin/arm64) only. The immutable v0.4.0 Intel artifact and its
historical evidence are unchanged; they do not extend Intel support to v0.5.0.

Profiles, history, and recovery

Compared with v0.4.0, v0.5.0 adds passive Profile listing,
inspection, validation, and host diagnostics; confirmed edit, clone, rename,
and delete operations; declarative Profile creation; revision-bound repository
transactions; and explicit interruption recovery.

Profile v3 provides common Skills and workspace authority shared by the Devin
and Codex overlays. Legacy Profiles remain readable and migrate only through an
explicit command. Portable exchange transfers sanitized logical intent with
explicit local bindings; it does not transfer local files, credentials,
history, Sessions, or readiness evidence. Bounded Profile history helps with
supported configuration rollback but is not a machine backup.

Durable Session commands list, inspect, and conservatively recover lifecycle
records. Recovery requires proof that ownership has settled; it never treats a
process lookup or elapsed time as cleanup proof and has no force-delete path.

Contained Devin and Codex operation

ACS uses one fail-closed contained-process lifecycle for the existing Devin
launcher, the fixed sandbox shell, interactive Codex, and literal-argument
generic commands. Effective-capability explanation reports sanitized authority
without exposing generated policies or private paths.

Interactive Codex uses the checksum-locked supported CLI and isolated named
ChatGPT authentication instead of ambient Codex credentials. Named identities
are stored separately in the macOS Keychain. ACS does not import global Codex
authentication, accept API-key identities, expose arbitrary target arguments,
or provide a less-restricted fallback.

Profiles can select bounded filesystem and executable grants, common
instruction references, scoped environment references, and reference-only
local STDIO MCP servers. Devin projects selected instructions as ACS-managed
always-on rules. Codex retains the common selections but does not activate them
as ACS-managed rules. Environment values are resolved at launch and are not
persisted in Profiles, exchange files, or history. A selected secret can be
read by the target, its local MCP servers, and descendants; it is not isolated
per server. MCP argv can resolve only from selected path references or selected
non-secret environment references.

MCP tool filtering is target behavior, not an ACS containment guarantee. ACS
does not manage remote MCP, plugins, hooks, agents, arbitrary target settings,
or destination-specific network policy. Target-owned project content can still
be discovered within the selected workspace.

Installation and update

The v0.5.0 release installer is an unsigned and unnotarized Apple Silicon
installer. It verifies the selected archive against SHA256SUMS, checks
the embedded version and archive structure, refuses to overwrite an existing
acs file, needs no sudo, and does not edit shell startup files.

Published v0.4.0 has no acs update command. Its users bootstrap v0.5.0 by
downloading and inspecting the release-specific v0.5.0 installer, then
installing into a new empty user-owned direct directory. They
must retain the previous executable, back up quiescent Profile files, verify
the new executable explicitly, and deliberately select it with PATH. The
migration guide
and manual recovery guide
keep binary selection,
Profile migration, data recovery, and rollback as separate decisions.
Direct Profile-file copies exclude history, Skills, Sessions, target state,
transaction evidence, and Keychain credentials; they are not an automatic
restore or data-downgrade mechanism.

After v0.5.0 is installed, acs update --check checks published stable release
metadata without downloading an archive or modifying user data. acs update
selects the latest published stable release, and
acs update vMAJOR.MINOR.PATCH selects a published stable version. The updater
can explicitly reinstall or downgrade a selected published version. It accepts
only its supported direct, user-owned regular-file layout and replaces
only the running ACS executable after release-asset verification. It does not
migrate or downgrade Profiles, identities, history, or Sessions.

Binary rollback does not downgrade stored data. v0.4.0 cannot safely own the
newer formats added after that release, so retain a compatible v0.5.0 binary for
inspection and supported recovery after any newer-state write.

Platform, integrity, and trust boundary

The release target is macOS 26 Apple Silicon (darwin/arm64) with the system
Seatbelt backend. Linux compilation remains a non-blocking portability
observation, and the historical v0.4.0 Intel asset does not extend Intel support
to v0.5.0. ACS is not an egress firewall and does not make target output or
third-party services trustworthy.

v0.5.0 is unsigned and unnotarized; it has no Apple Developer ID signature or
notarization ticket. SHA-256 checksums prove byte identity relative to a trusted
manifest, and GitHub build-provenance attestations provide separate origin
evidence. Neither is Apple approval, notarization, malware review, or a promise
that Gatekeeper will accept the archive. Users must not remove quarantine,
disable Gatekeeper, ad-hoc sign the binary, or weaken Seatbelt to make it run.

Release evidence and daily-use boundary

The release workflow builds one candidate, installs and exercises those exact
bytes on native macOS 26 Apple Silicon, attests the archive and manifest, and
publishes the same bytes.

Release publication and the week-long daily-use observation with Devin and
Codex in two real projects are separate evidence categories. CI, exact-artifact
validation, and release publication do not establish elapsed daily use, hosted
provider experience, or real-account behavior. Those claims require their own
sanitized observation record.

ACS v0.4.0

ACS v0.4.0

ACS v0.4.0 adds a credential-free interactive sandbox shell and narrows the
supported release surface to macOS 26.

Sandbox shell

Use a named Profile without starting an AI CLI:

acs sandbox --profile PROFILE

ACS creates an ephemeral Session, materializes the selected Skills, and starts
the fixed system /bin/zsh -f inside Seatbelt. The shell does not consult
$SHELL, load user startup files, invoke Devin, copy a Devin credential, or run
Devin preflights.

The shell receives the invoking terminal and preserves input/output, resize,
signals, interactive line editing, and ordinary exit status. The minimal
system-read policy includes the macOS terminfo database required to redraw
Backspace correctly without granting the rest of /usr/share. Its descendants
share the Seatbelt policy and must settle before the Session can be removed.
Cleanup that cannot prove settlement remains quarantined.

Inspect the plan without creating a Session:

acs sandbox --profile PROFILE --dry-run

The dry run reports materialized Profile content and native backend readiness.
It excludes repository-local Skill inheritance that belongs specifically to
the Devin adapter.

Shared Session boundary

Session creation and Profile materialization are now target-independent. Devin
adds its allowlisted credential and performs Skill/authentication verification
only after the generic Session exists. The sandbox shell uses the same selected
Skills and lifecycle without receiving those Devin-specific capabilities.

macOS-only support

The supported v0.4.0 matrix is:

OS	Target	Backend
macOS 26	darwin/arm64	verified system Seatbelt
macOS 26	darwin/amd64	verified system Seatbelt

v0.3.3 is the final release with Linux support. Bubblewrap source remains in the
repository without v0.4.0 Linux binaries, installer support, native gates, or a
support commitment. A non-blocking Linux compile observation may expose obvious
portability breakage but is not release evidence.

Isolation boundary

The Seatbelt policy permits the workspace, leased Session, required macOS
runtime, terminal, and outbound IP/DNS. It denies tested unrelated host paths,
external writes, symlink escapes, arbitrary environment values and descriptors,
and unrelated Unix sockets. ACS is not an egress firewall, and there is no
unsandboxed fallback.

Release evidence installs the exact candidate bytes on macOS 26 arm64 and Intel
and exercises Skills, credential absence, filesystem allow/deny behavior,
terminal lifecycle, descendants, and cleanup before attestation and immutable
publication.

Compatibility

Existing Profile files remain compatible. The Devin commands are unchanged.
The new public grammar is:

acs sandbox --profile <name> [--dry-run]

Arbitrary command execution, shell selection, network filtering, additional
adapters, and additional Profile categories remain out of scope for v0.4.0.

ACS v0.3.3

ACS v0.3.3

v0.3.3 is the corrected process-isolation candidate for the existing Devin
and Skills Profile model. Existing Profile files and selections remain
compatible, while every launch still requires a certified host and a ready
native backend. There is no unsandboxed fallback.

Relationship to unpublished candidates

The v0.3.0, v0.3.1, and v0.3.2 tags were pushed but never published as
GitHub Releases because required native gates failed. They remain immutable,
unpublished, and non-authoritative. If publication succeeds, v0.3.3 is the
first published process-isolation release and supersedes all three candidates.

Patch correction

The v0.3.2 native macOS gate exposed a process-table race while a descendant
was becoming a zombie. The supervisor could enumerate the process as still
addressable and then fail to reread its identity immediately before cleanup,
causing exit 125 and withholding publication.

v0.3.3 treats that unreadable identity as an unstable snapshot. It sends no
signal without successful identity revalidation and retries a fresh snapshot
only within the existing bounded settlement deadline. Persistent ambiguity
still fails closed. A deterministic unit regression and concurrent native
stress on both supported macOS architectures cover the transition.

Installation

After the immutable GitHub Release is public, download and inspect the
release-specific installer. Do not pipe network content into a shell.

release_version=v0.3.3
release_url="https://github.com/alcimerio/ai-config-selector/releases/download/$release_version"
curl --fail --location --proto '=https' --tlsv1.2 \
  --output install.sh "$release_url/install.sh"
less install.sh
sh ./install.sh
"$HOME/.local/bin/acs" version

The final command must print acs v0.3.3. The installer binds the selected
archive to SHA256SUMS, validates its version and structure, and does not use
sudo, replace an existing acs, or edit shell startup files.

Supported release matrix

Host	Download target	Required backend
macOS 26	darwin/arm64	verified system Seatbelt
macOS 26	darwin/amd64	verified system Seatbelt
Ubuntu 24.04 LTS	linux/amd64	verified signed-system Bubblewrap
Ubuntu 24.04 LTS	linux/arm64	verified signed-system Bubblewrap

Windows, WSL, other Linux distributions, and other OS/architecture pairs are
not supported by this release. A source build reports acs devel and is not
release evidence.

Protection and evidence contract

Configuration isolation remains owned by the synthetic Session; process
isolation remains owned by the native Process Sandbox. The sandbox exposes the
workspace, leased Session, and Session temporary directory as writable,
provides only required system/runtime inputs, rebuilds the environment, and
supervises descendants through authenticated cleanup. Unsupported or unsafe
hosts, backends, paths, environments, descriptors, policies, and preflight
state stop before Devin starts.

Every public protection claim is limited to the four-target native evidence
contract in issue #62,
the native candidate tests,
the candidate lifecycle tests,
and the release workflow. The optional
authenticated smoke never replaces this credential-free gate.

Limitations

ACS is not an egress firewall; outbound IP remains available. Repository-local
Skills remain controlled by Devin. Signed-system Bubblewrap verification does
not protect against a compromised administrator. macOS binaries are unsigned
and unnotarized. The broad Seatbelt prototype remains feasibility history and
is not a production policy claim.

See the architecture,
contributor release procedure, and
README limitations for the maintained
contract.

ACS v0.2.0

ACS v0.2.0

ACS v0.2.0 adds downloadable, release-pinned binaries for macOS 26 and Ubuntu
24.04 LTS while preserving the v0.1.0 Profile and launch contracts.

Installation

Download the release-specific installer, inspect it, and execute the local
file. Do not pipe the download into a shell.

release_version=v0.2.0
release_url="https://github.com/alcimerio/ai-config-selector/releases/download/$release_version"
curl --fail --location --proto '=https' --tlsv1.2 \
  --output install.sh "$release_url/install.sh"
less install.sh
sh ./install.sh
"$HOME/.local/bin/acs" version

The version command must print exactly acs v0.2.0. The default destination
is ~/.local/bin; pass --bin-dir with a user-writable absolute directory to
choose another destination. The installer prints PATH guidance when needed but
does not edit shell files, invoke sudo, or replace an existing binary.

Supported Platforms and Release Targets

• macOS 26: darwin/arm64 and darwin/amd64
• Ubuntu 24.04 LTS: linux/amd64 and linux/arm64

Windows, WSL, other Linux distributions, and other target pairs are not
supported. The Release Artifact Set contains exactly four target archives,
SHA256SUMS, and the release-specific install.sh.

Verification

The installer independently verifies the selected archive against
SHA256SUMS. README.md documents manual SHA-256 commands and
gh attestation verify for the four archives and checksum manifest. GitHub
build provenance identifies the repository and workflow that produced the
attested bytes; it does not establish source safety, malware absence, or an
Apple developer identity.

Compatibility

v0.2.0 reads existing v0.1.0 Profiles without migration and preserves Profile
envelopes, category schemas, commands, accepted messages, permissions, atomic
persistence, Profile Builder behavior, Devin Adapter behavior, signal and exit
handling, Session isolation and cleanup, and ACS Home at ~/.acs. Local
checkout builds remain development builds and report acs devel; downloadable
release binaries are the Supported Install Path.

Relevant changes

• Added Linux runtime support without creating a platform-specific product
  mode.
• Added four reproducible CGO-disabled release archives and a pinned installer.
• Added exact promoted-artifact validation on all four native targets.
• Added an optional risk-triggered real-Devin smoke procedure for the
  maintainer's macOS arm64 host.
• Added build-once provenance attestation and forward-only immutable Release
  publication.

Known limitations

The macOS binaries are unsigned and unnotarized. Gatekeeper may warn about or
block them because they have no Apple Developer ID signature or notarization
ticket. SHA-256 and GitHub attestations do not provide signing, notarization,
Apple malware review, or Gatekeeper trust, and users should not weaken host
security on the assumption that they do.

ACS supports only Devin and Skills, does not filter repository-local Skills,
and provides configuration isolation rather than an OS sandbox. It has no
package-manager distribution, automatic update, self-update command, or
uninstaller.

ACS v0.1.0

ACS v0.1.0 is the first public release of AI Config Selector, a macOS launcher for reusable Devin capability Profiles.

Install

go install github.com/alcimerio/ai-config-selector/cmd/acs@v0.1.0
acs version

The version command must print acs v0.1.0.

Highlights

• Build named Profiles with a keyboard-driven editor, fuzzy Skill search, retained category state, lazy discovery, and recoverable save and cancellation flows.
• Persist strict versioned Skill selections, inspect launch plans with --dry-run, and load version-1 Profiles without rewriting them.
• Launch authenticated Devin sessions with selected global Skills, preflight verification, terminal forwarding, and automatic Session cleanup.

Supported scope

• macOS 26 on Apple Silicon
• Devin as the only production CLI Adapter
• Skills as the only production Profile Component Category

Known limitations

ACS does not support Linux, Windows, or Intel Mac. It does not list, edit, delete, import, or export Profiles through the CLI. Repository-local Skills remain under Devin control. The synthetic home isolates configuration discovery but does not provide an OS sandbox or restrict network and absolute host-path access.

Compatibility

Releases before v1.0.0 may change CLI or Profile compatibility in a new minor release. Patch releases within the same minor line are intended to remain backward compatible. ACS v0.1.0 writes Profile envelope version 2 and loads version-1 Profiles through in-memory normalization without rewriting their files.

What's Changed

• Document ACS MVP architecture decisions by @alcimerio in #1
• Document modular interactive Profile creation by @alcimerio in #8
• Add versioned Profile category envelope by @alcimerio in #17
• docs(contributing): prepare repository for contributions by @alcimerio in #18
• docs(readme): document project usage and scope by @alcimerio in #19
• ci: add Linux and macOS validation workflows by @alcimerio in #20
• ci: run macOS validation on public changes by @alcimerio in #21
• feat(profile): route execution through category registry by @alcimerio in #25
• feat(builder): add interactive profile builder by @alcimerio in #26
• feat(skills): add searchable retained editor by @alcimerio in #27
• feat(builder): load skills lazily by @alcimerio in #28
• feat: make profile saves and cancellation recoverable by @alcimerio in #29
• feat: harden profile builder terminal behavior by @alcimerio in #30
• feat(builder): add visual editor registry by @alcimerio in #33
• test(builder): complete multi-category acceptance coverage by @alcimerio in #34
• feat(cli): add version reporting by @alcimerio in #35
• docs: document v0.1.0 installation and validation by @alcimerio in #36

New Contributors

• @alcimerio made their first contribution in #1

Full Changelog: https://github.com/alcimerio/ai-config-selector/commits/v0.1.0