Security release. If you use 0.1.0, upgrade.

This release fixes the issues in GHSA-xhg7-866f-6fcp, which were reported privately and reviewed by @crenshawdev. Thank you for the careful report, and for reviewing the fix twice.

In 0.1.0, analyzing a repository you don't trust, or visiting a malicious website while ARS was running, could run commands or read files on your machine. 0.1.1 closes those paths.

What changed

• Analysis treats a repository as data. Prettier configs are read as JSON, YAML or TOML and never executed. Git no longer runs inside an analyzed folder, so a repository's .git/config can't run commands.
• The local API is locked down. Every request needs a session token that the UI fetches automatically, and requests from other websites are refused.
• Only regular files inside the repository are read. Symlinks, special files and paths that lead outside the repository are skipped.
• Lab agents are confined. File tools stay inside the run's workspace, and Bash runs sandboxed. If the sandbox can't start (on Linux it needs bubblewrap and socat), the run fails instead of running unsandboxed. Agents get a minimal environment and no MCP servers.
• Pattern rules run with a time limit, so a bad regex can't freeze the server.
• Git URLs with credentials in them are refused. ARS clones with your machine's own git credentials.

SECURITY.md describes every protection and the risks that remain.

Upgrading

git pull
npm install
npm run dev

Stop any ARS server that is still running from 0.1.0 first, or the new one can't use port 4317.

Also in this release

• The docs say that ARS supports React projects only (TypeScript or JavaScript).
• The docs explain the goal: install your skills into new projects, so Claude Code builds them your way from the first file.