v0.1.5

• Security: the install scripts check the release signature before trusting anything. install.sh read the version for "latest" from an unsigned SHA256SUMS, skipped the signature for v0.1.0/v0.1.1, and skipped it entirely without OpenSSL 3 (as on stock macOS); install.ps1 never checked it. Both now verify the signature first, with OpenSSL 3 or, from this release on, with ssh-keygen against a new SHA256SUMS.sshsig, and stop if neither tool is available. They refuse releases before v0.1.2, which aren't signed, and refuse a "latest" older than v0.1.5. See Verifying a release.
• Terminal: fix “The cursor position could not be read within a normal duration” on startup, focus restoration, and return from an external editor. Fullscreen redraws no longer require a cursor-position response from the terminal.

v0.1.4

• Security: commands could slip past the permission check. A heredoc closed by a marker bash doesn't accept (such as one indented with spaces), or characters that ended a word for Chanto's check but not for bash, let a command after them run without a prompt. Chanto now ends heredocs and words exactly where bash does. Please update: chanto upgrade, brew upgrade chanto, npm i -g @chanto/cli or cargo install chanto --locked.
• Security: the cloud metadata address could skip its approval. 169.254.169.254 written with a tab, %-escapes, a trailing dot or control characters wasn't recognised, so a request to it went through without asking. Chanto now checks the address as the URL parser reads it.
• Security: hosts like localhost.evil.com no longer count as local for plain HTTP, and GitLab, Slack, Google and SendGrid tokens ending in - are now redacted whole. These and the fixes above were found by fuzzing, which now runs on every pull request.
• Faster and lighter. About a third less CPU per turn and about 15% less peak memory in our overhead benchmark: Chanto no longer starts helper processes it doesn't need (defaults, caffeinate, git outside a repository), stops rewriting and re-reading files on every model call, sends requests without building a copy of the conversation first, and skips work whose result hasn't changed.
• Releases now carry each build's SLSA provenance as a .intoto.jsonl file next to the archive.