v0.4.0

CHANGELOG.md
is the readable account of what changed and why. The commit list below is
the complete one.

Changelog

• 8c6946e perf: probe a target in one round trip on one connection
• 6313926 release: prepare 0.4.0

Verifying this release

Every archive ships reach plus the helper binary for each target platform.
At the helper tier reach copies that binary onto your target, so it is worth
knowing where it came from.

Check the contents against checksums.txt:

sha256sum -c checksums.txt --ignore-missing

And check that checksums.txt itself came from this repository's tagged CI
run. The release is signed with cosign keyless
signing, so there is no public key to fetch — the identity is the workflow
that built it:

cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github.com/bojieli/agentreach/\.github/workflows/release\.yml@refs/tags/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Each archive also ships with an SBOM (.sbom.json, SPDX) listing everything
compiled into it.

Container image

The same build is on GitHub Packages for amd64 and arm64:

docker run --rm -v "$HOME/.ssh:/root/.ssh:ro" \
  ghcr.io/bojieli/agentreach:0.4.0 version

Nothing was published here until CI was green on this tag — every test on
every platform, the linters, the fuzz runs, govulncheck, the cross-compiles
and a full release dry run.

v0.3.0

CHANGELOG.md
is the readable account of what changed and why. The commit list below is
the complete one.

Changelog

• 16684ed feat!: read target paths the way scp and docker cp read them
• 0eebeff release: prepare 0.3.0

Verifying this release

Every archive ships reach plus the helper binary for each target platform.
At the helper tier reach copies that binary onto your target, so it is worth
knowing where it came from.

Check the contents against checksums.txt:

sha256sum -c checksums.txt --ignore-missing

And check that checksums.txt itself came from this repository's tagged CI
run. The release is signed with cosign keyless
signing, so there is no public key to fetch — the identity is the workflow
that built it:

cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github.com/bojieli/agentreach/\.github/workflows/release\.yml@refs/tags/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Each archive also ships with an SBOM (.sbom.json, SPDX) listing everything
compiled into it.

Container image

The same build is on GitHub Packages for amd64 and arm64:

docker run --rm -v "$HOME/.ssh:/root/.ssh:ro" \
  ghcr.io/bojieli/agentreach:0.3.0 version

Nothing was published here until CI was green on this tag — every test on
every platform, the linters, the fuzz runs, govulncheck, the cross-compiles
and a full release dry run.

v0.2.0

CHANGELOG.md
is the readable account of what changed and why. The commit list below is
the complete one.

Changelog

• eca8895 Merge origin/main into feature/grok-build-harness
• 6173e20 Merge origin/main into feature/grok-build-harness
• 9f606a1 Merge remote-tracking branch 'origin/main' into fix-relative-path-harness-lookup
• cec1549 feat: add Grok Build harness adapter
• f9374aa feat: add Grok Build harness adapter (#12)
• 54ce8bb feat: reach , with a session per target (#17)
• 2b41a0c fix: find a harness on PATH the way the shell does
• 9a7e0d1 fix: make the Grok adapter usable, and let its probe reach a verdict
• 8bdd8f6 fix: replace REACH_SESSION in harness environments rather than appending it (#16)
• abbc433 fix: resolve the grok binary the same way as every other harness
• 3742d6d fix: surface a working-directory failure instead of swallowing it
• 5c4ab11 refactor: remove --untrusted (#18)
• a343a44 release: prepare 0.2.0
• 8d6c342 release: prepare 0.2.0 (#21)
• 71bdc53 style: satisfy the linters in the grok shim path

Verifying this release

Every archive ships reach plus the helper binary for each target platform.
At the helper tier reach copies that binary onto your target, so it is worth
knowing where it came from.

Check the contents against checksums.txt:

sha256sum -c checksums.txt --ignore-missing

And check that checksums.txt itself came from this repository's tagged CI
run. The release is signed with cosign keyless
signing, so there is no public key to fetch — the identity is the workflow
that built it:

cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github.com/bojieli/agentreach/\.github/workflows/release\.yml@refs/tags/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Each archive also ships with an SBOM (.sbom.json, SPDX) listing everything
compiled into it.

Container image

The same build is on GitHub Packages for amd64 and arm64:

docker run --rm -v "$HOME/.ssh:/root/.ssh:ro" \
  ghcr.io/bojieli/agentreach:0.2.0 version

Nothing was published here until CI was green on this tag — every test on
every platform, the linters, the fuzz runs, govulncheck, the cross-compiles
and a full release dry run.

v0.1.1

CHANGELOG.md
is the readable account of what changed and why. The commit list below is
the complete one.

Changelog

• 7c203af fix: stop the shim from disarming itself for the harness it launches (#10)
• 6644c8c release: prepare 0.1.1, and read the canary the way harnesses actually print it (#11)

Verifying this release

Every archive ships reach plus the helper binary for each target platform.
At the helper tier reach copies that binary onto your target, so it is worth
knowing where it came from.

Check the contents against checksums.txt:

sha256sum -c checksums.txt --ignore-missing

And check that checksums.txt itself came from this repository's tagged CI
run. The release is signed with cosign keyless
signing, so there is no public key to fetch — the identity is the workflow
that built it:

cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github.com/bojieli/agentreach/\.github/workflows/release\.yml@refs/tags/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Each archive also ships with an SBOM (.sbom.json, SPDX) listing everything
compiled into it.

Container image

The same build is on GitHub Packages for amd64 and arm64:

docker run --rm -v "$HOME/.ssh:/root/.ssh:ro" \
  ghcr.io/bojieli/agentreach:0.1.1 version

Nothing was published here until CI was green on this tag — every test on
every platform, the linters, the fuzz runs, govulncheck, the cross-compiles
and a full release dry run.

v0.1.0

CHANGELOG.md
is the readable account of what changed and why. The commit list below is
the complete one.

Changelog

• ad6a93c Merge: connection reuse and handler resilience
• b302840 chore(deps): bump actions/checkout from 4 to 7
• fe9b45c chore(deps): bump actions/setup-go from 5 to 7 (#1)
• 11c83f6 chore(deps): bump actions/setup-node from 4 to 7 (#7)
• 549e0c9 chore(deps): bump actions/setup-python from 5 to 7
• 85ab401 chore(deps): bump actions/upload-artifact from 4 to 7
• 71acd8d chore(deps): bump golangci/golangci-lint-action from 7 to 9
• a3d9b4c chore(deps): bump goreleaser/goreleaser-action from 6 to 7 (#6)
• 18bd301 ci: add seam.yml — multi-version harness seam regression matrix
• b5dcb7d ci: get CI green again, and gate releases on it (#8)
• 126a44c ci: lint, cross-userland integration, and the gaps they exposed
• 13f08f3 ci: three jobs that had never verified anything, and one that failed on CRLF
• bdb1b89 contrib: add harness patch scripts and setup helpers
• cb7cefc docs(changelog): record tonight's user-facing changes
• 7dfb0c2 execserver: implement Codex's remote-environment exec-server protocol
• 4f82a2c feat(fs): add waldo fs mv, and diagnose a wrong subcommand as one
• 5748285 feat: Codex and Kimi PATH-shim adapters
• f2b43bf feat: add Claude Code seam guard (waldo harness verify claude)
• 3503b5a feat: add Goose, Crush, and Gemini CLI harness adapters
• 2e15eb4 feat: add contrib/kimi-install-and-patch.sh post-install verification
• b359f84 feat: add managed home isolation for Kimi, Goose, and Gemini
• aa81242 feat: argv[0] shim dispatch — harnesses need a bare program path, not a command line
• 085e449 feat: implement the sftp, pipe and agent file-operation tiers
• e53bfd2 feat: measure harness shell seams and refuse versions that bypass them
• 5ee2357 feat: mirror mode — native file tools act on the target via per-file materialization
• ad6c20a feat: native Windows support
• 35a828f feat: open another connection when the target refuses a channel
• 421fbb4 feat: opencode adapter (generated shadowing tools) + waldo fs verbs + mock model server
• 2f891c1 feat: session store, CLI, streaming exec, Claude Code shell-prefix adapter
• 188bccf feat: transports (ssh/local/container) and tier-0 POSIX file operations
• cc21dd6 fix(cli): make the commands accept a session name the way the help says
• 57fc29f fix(fileops): a target that cannot run the handler now says so every time
• 9f0dcbb fix(fs): clean resolved paths so matches come back without ./ noise
• d5859d1 fix(helper): report the footprint honestly, and take back what waldo rejects
• 99d156e fix(release): the release pipeline could not have produced a release
• 74f1ef4 fix(session): stop silently accepting sessions this build cannot honour
• 4239191 fix(tiers): derive every tier spelling from one list
• 9c7662e fix: allow interactive auth on first connect; clean session artifacts on down
• b347b37 fix: answer requests about one path or process in the order they were sent
• d42dd9c fix: answer to zsh in the PATH shell shim
• dffe646 fix: bound what the exec-server remembers about finished work
• 99849cd fix: code-review findings — comments, EvalSymlinks, HOME, cache race
• 4197e8d fix: correct and complete the Gemini CLI excludeTools deny-list
• a038c8a fix: extract cwd marker anywhere in a line, not only at line start
• ff033ab fix: give the agent the PATH the operator would have on that machine
• 77d3442 fix: harness tool-name audit — add Skill to Kimi deny list, fix Goose comment
• cb0cc94 fix: keep the connection reach up authenticated, and explain it when it goes
• 86f7bd3 fix: refuse native Windows instead of half-working there
• 8bc51e6 fix: remap harness-embedded 'cd ' prefix to the target path
• b94ecef fix: report a working directory reach could not record
• dec5576 fix: restart a broken file-operation handler instead of ending file access
• 321015d fix: say when a command reach gave up on may still be running
• 0355e0d fix: stop short-lived commands tearing down a connection a session is using
• eb79302 fix: the default tier wrote temporaries under reach's former name
• 73bc51c fix: three defects found auditing the project as a whole; add an audit log
• 2bfa090 fix: two bugs an agent would actually hit
• ac8809f fix: waldo status panicked on generated settings files
• 698d932 harnessprobe: add Anthropic Messages API dialect for Claude Code probe
• b53e1dc harnessprobe: schema-version cache, Goose/Gemini probes, CommandPrefix
• 4b34c69 perf: answer overlapping file operations on more than one handler
• 28f0618 perf: pipeline sftp writes; negotiate on real-network measurements
• 9cde0e3 perf: stop paying for base64 on links that do not need it
• 5ba2241 perf: the helper tier spent three round trips to answer one question
• fafc93f perf: verify mirrored files by digest instead of transferring them
• 6e1b0ac refactor!: delete the SFTP tier
• d7a378d refactor!: rename the agent tier to helper
• e24d360 refactor(envelope): delete a security function nothing called
• bc21af0 refactor: name temporary files in one place; halve sftp's read latency
• c5de449 rename: waldo → AgentReach (binary: reach, module: github.com/bojieli/agentreach)
• 7e734ce security: raise the Go floor to 1.25.8 for a reachable net/url defect
• 15f1ba2 security: refuse path traversal in the mirror
• 1d1415c test(cmd): cover flag parsing, cwd bookkeeping and exit status
• 016fde9 test(hook): cover the decisions that pick which machine a file comes from
• 3e03d09 test(transport): cover the arguments that decide where a command goes
• 9979cb8 transport: export sentinel helpers and add SSH ForwardLocal

Verifying this release

Every archive ships reach plus the helper binary for each target platform.
At the helper tier reach copies that binary onto your target, so it is worth
knowing where it came from.

Check the contents against checksums.txt:

sha256sum -c checksums.txt --ignore-missing

And check that checksums.txt itself came from this repository's tagged CI
run. The release is signed with cosign keyless
signing, so there is no public key to fetch — the identity is the workflow
that built it:

cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github.com/bojieli/agentreach/\.github/workflows/release\.yml@refs/tags/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Each archive also ships with an SBOM (.sbom.json, SPDX) listing everything
compiled into it.

Container image

The same build is on GitHub Packages for amd64 and arm64:

docker run --rm -v "$HOME/.ssh:/root/.ssh:ro" \
  ghcr.io/bojieli/agentreach:0.1.0 version

Nothing was published here until CI was green on this tag — every test on
every platform, the linters, the fuzz runs, govulncheck, the cross-compiles
and a full release dry run.