v0.2.1

What's Changed

• feat(guard): Laya judge lane (CoreML) + guard observe mode by @christopherkarani in #423
• feat(onboarding): rv init, secrets fast path, mcp onboard, guided fixes by @christopherkarani in #424
• docs(readme): short, developer-first README by @christopherkarani in #427
• fix(secrets): deny instead of skip on operand overflow in SecretPathGuard by @christopherkarani in #421
• feat(hook): mutual daemon authentication for C and Swift hook clients by @christopherkarani in #428
• feat(mcp): hard-flip tool defaults to deny and require sandboxes by @christopherkarani in #429
• feat(mcp): fail closed on same-user key custody; direct never passes check by @christopherkarani in #431
• Ship Laya judge weights via Hugging Face, fetch in curl installs by @christopherkarani in #430
• feat(release): Linux release builds with per-target assets by @christopherkarani in #432
• fix(secrets): resolve symlink aliases through the secret path guard by @christopherkarani in #422
• Fix one-line installer (unsigned-era verify), install smoke gates, v0.2.1 by @christopherkarani in #433
• Fix release Linux smoke host (claude-code renamed to claude) by @christopherkarani in #434
• Ship Swift runtime libs with Linux releases (fix install smoke) by @christopherkarani in #435

Full Changelog: v0.2.0...v0.2.1

0.2.0

Hook-grade shell guard for Pi, Grok, OpenCode, Claude, Codex, Cursor, Hermes, and OpenClaw.

What's new since 0.1.5

• Phase 8 secrets UX parity: Varlock schema import, secret provider CLIs (Infisical, Bitwarden, cloud CLIs) behind typed no-output errors, and an rv-secrets pre-commit hook that honors core.hooksPath and preserves foreign hooks
• Phase 7 enterprise hardening: MCP tool argument rules with exact-integer preservation, organization keys, a hash-chained audit log with at-least-once forwarding, and remote MCP upstreams with OAuth, revalidated tokens, and per-owner request binding
• Phase 6 security blockers: unforgeable approvals, cage tests, release signing plumbing, and CI hygiene
• Egress policy revisions with sealed-log crash atomicity and fail-closed workspace teardown
• Binaries now report 0.2.0 (rvd and rv-cli --version)

Note: this build is ad-hoc signed; the release runner reported "signing secrets are not configured; this release stage is unsigned", so Gatekeeper notarization does not apply.

0.1.5

Hook-grade shell guard for Pi, Grok, OpenCode, Claude, Codex, Cursor, Hermes, and OpenClaw.

What's new since 0.1.4

• Isolation: compile a contained IsolationPlan and apply it through Seatbelt (macOS) and Landlock (Linux) so outside writes fail closed
• LocalExecutor.perform runs an already-decided authorization once; pending cannot spawn
• launchContainedHost starts OpenCode under a contained plan with inherited stdio
• Unquoted newlines are command separators, so a later-line printf of .env is not a pipe operand
• Repeat denials reuse the same allow-once code instead of minting a treadmill
• Doctor pack health reads from config, not a stale rvd catalog
• Host Ask resolve is pause then grant; leftover hookWire adapter retired
• Typed AgentRequest, IsolationPlan, ExecutableAction, and IPC helper boundaries

Install:

curl -fsSL https://rykanv.com/install | sh

0.1.4

Hook-grade shell guard for Pi, Grok, OpenCode, Claude, Codex, Cursor, Hermes, and OpenClaw.

What's new since 0.1.3

• install.sh accepts macOS 26 or newer on Apple Silicon (27.0 was refused by an exact 26.* match)
• Package tools pin is Swift 6.4 RELEASE

Install:

curl -fsSL https://rykanv.com/install | sh

0.1.3

Hook-grade shell guard for Pi, Grok, OpenCode, Claude, Codex, Cursor, Hermes, and OpenClaw.

What's new since 0.1.2

• Linux aarch64/x86_64 is a supported install platform (Darwin remains Apple Silicon)
• File-tool Read / Edit / Write of catalog secret paths is denied on Grok, Claude, and Cursor
• Host Ask: Claude and Hermes confirm-then-spend; OpenClaw spend-first Ask via plugin-owned wait
• Hosts that cannot pause quiet-allow gray-area / mandatoryHuman; unlockable pack deny still denies
• Hook deny mints allow-once; redeem with rv allow-once; default day-one includes system.disk
• Deeper unwrap (pipes, stdin, process substitution; timeout/nice/mise/ssh prefixes)
• Typed policy predicates and English compile (rv policy); --help / --version documentation flags are allowed
• Setup-written host adapters are proven in CI on an isolated HOME

Install:

curl -fsSL https://rykanv.com/install | sh

0.1.2

Hook-grade shell guard for Pi, Grok, OpenCode, Claude, Codex, Cursor, Hermes, and OpenClaw.

What's new since 0.1.1

• Host Ask pause owned in Swift; adapters honor decision:ask only (Pi/OpenCode no longer infer Ask from deny + rule id)
• BoundReview carried from apply*Semantics through the hook door so spend-first hosts can pause on mandatoryHuman
• Session scan pipeline moved into SessionScan; CLI ScanRun is a thin wrapper
• Pending-approval consume folded into PendingApprovalState
• ReviewBind kept as a pure Result bind
• Doctor snapshot reports keepAlive on Darwin

Install:

curl -fsSL https://rykanv.com/install | sh

0.1.1

Hook-grade shell guard for Pi, Grok, OpenCode, Claude, Codex, Cursor, Hermes, and OpenClaw.

What's new since 0.1.0

• Host-native Ask on Pi, OpenCode, and Claude
• Codex and Cursor hosts (block + reason)
• Hermes and OpenClaw hosts (host only)
• Stronger git and filesystem matching, including wrappers and repo-boundary / secret-path protection
• Always-allow pins with hard-stop reject, plus pending-approval IPC
• rv scan session forensics for more host stores

Install:

curl -fsSL https://rykanv.com/install | sh

0.1.0

Hook-grade shell guard for Pi, Grok, and OpenCode.