Sidelight v0.6.1 is a security-hardening release for hostile or unusually structured local repositories and files. It preserves the local-first, read-only product model while tightening Git authority, preview identity, search parsing, process lifecycle, and resource limits.
Highlights
- Constrains Git operations to validated local repository layouts and disposable metadata views.
- Prevents repository-selected helpers, filters, lazy fetching, and untrusted Git executable substitution from expanding Sidelight's authority.
- Adds finite Git deadlines, cancellation, process cleanup, serialized panel refreshes, stale-result suppression, and shutdown disposal.
- Binds preview validation and reads to one acquired regular-file descriptor, with nonblocking special-file handling and fail-closed platform policy.
- Parses raw NUL-delimited Git search identities and applies path denial before retaining matching content.
- Bounds tree construction, Git status models, streamed search results, terminal sanitization, highlighting, and rendered frames before amplification.
- Adds a public security reporting policy.
Assessment and validation
The hardening work included an AI-assisted source-security assessment using the OpenAI Codex Security plugin, followed by maintainer triage, targeted remediation, rewritten local regression tests, and bounded independent revalidation.
Release checks:
- TypeScript: passed.
- Test suite: 199 total; 198 passed; 0 failed; 1 expected platform-conditional skip.
- Production and full npm audits: 0 vulnerabilities.
- Package dry run, content inspection, disposable global install, all three binaries, hook configuration printers, and PI extension loading: passed.
- Integrated public candidate package: 60 expected files; no tests, private audit material, node_modules, secrets, or install lifecycle scripts.
- Maintainer manual TUI smoke test: passed.
This process is not a certification or penetration test and is not a claim that Sidelight is free of vulnerabilities. Sidelight remains a local application rather than an operating-system sandbox and continues to rely on the local Node.js runtime, Git executable, filesystem, terminal, and operating system.
Compatibility
Ordinary repositories, selected subdirectories, registered linked worktrees, registered submodules, file previews, Git status/diffs, search, optional session integrations, and operation outside Git repositories retain explicit compatibility coverage.
Reporting security issues
Please use the private reporting instructions in SECURITY.md rather than opening a public issue with exploit details.
Release identity
- Public release commit:
3933517 - Tag:
v0.6.1 - npm:
sidelight@0.6.1 - Tarball SHA-256:
45b9749f05dde4c1540067ba908e589a97fdc0a8e2bccbd12c65a56d02a50b26 - The npm registry tarball is byte-identical to the reviewed package produced from the tagged release commit.