Skip to content

SiteCMD 1.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Aug 17:46
· 41 commits to main since this release
v1.1.0
This tag was signed with the committer’s verified signature.
kpiontek Kyle Piontek
SSH Key Fingerprint: bdE9YyvO4lOjUzH9Ws+8eIuEqsRSXR0Ch2D7hNt1mJs
Verified
Learn about vigilant mode.
d63a9d8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • The MCP server can now drive the whole fix loop: start_fix opens a fix
    attempt, run_scan triggers a scan, and a desktop heartbeat tells the agent
    whether the app is running. request_scan is now how_to_rescan (the old
    name still works).
  • The CLI gained unified gate flags across audit, scan, check, and
    gate, SARIF output for code-scanning integrations, and audit baselines.
  • A false-positive report form and accuracy labels, so a wrong finding can be
    reported from the issue itself.
  • Every release now publishes signed checksums and build provenance: a
    minisign-signed SHA256SUMS beside the artifacts and on the GitHub
    Release, with verification steps in the README.
  • The first run walks through connecting an AI editor, with manual MCP setup
    instructions for every supported editor.
  • The Issues page explains how each issue affects the SiteCMD Score.

Changed

  • Backend errors shown in the app are now plain-language messages with a next
    step, instead of raw error text.
  • Fix guides and first screens open with plain-English leads.
  • Dialogs, toasts, and navigation follow accessibility expectations: correct
    focus handling, screen-reader announcements, visible focus rings, and
    reduced-motion support across the app.

Fixed

  • The installer script refuses truncated downloads and version downgrades,
    and compares release versions strictly.
  • Scan traffic is harder to abuse: the analyzer blocks private-network
    subresources, API responses are size-bounded, git metadata is read with
    hostile repository configuration neutralized, and credentials that never
    migrated to the OS keychain are refused instead of silently used.

Verify

Installers and CLI archives are served from https://releases.sitecmd.com/v1.1.0/. The attached SHA256SUMS and SHA256SUMS.minisig are signed with the SiteCMD updater key; verification steps are in the README section https://github.com/brambleworks/SiteCMD/blob/main/README.md#verify-your-download.

Assets 4
Loading