Skip to content

v0.3.9 — reliability: publish guards, workflow correctness, credential hygiene

Choose a tag to compare

View all tags
@kdr kdr released this 10 Jul 17:17
· 20 commits to main since this release
v0.3.9
d0449d4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

tinycloud 0.3.9 is a reliability release: publish-guard and workflow correctness fixes, security hardening around credentials, and a faster CLI path for scripted use. The command surface is unchanged from 0.3.8 — same verbs, flags, and capability ids — so agents and skills need no changes.

🛡️ Fixes & hardening

  • Publish guards catch string-built embeds. The pre-upload checks that reject a private-share <cg-video> embed (or a live-API component on a public site) now also detect embeds assembled as innerHTML/template strings — the common generator/LLM output shape — including escaped-quote variants. Previously only statically-written or createElement-built tags were caught.
  • Republish resolves real visibility. Republishing a site without --visibility no longer guesses when the stored visibility is unknown — it fetches the site's actual visibility so the embed guards check against reality (and persists it, sparing the lookup next time).
  • Workflow steps fail loudly on corrupt output. A step whose output can't be read back now fails that step instead of being treated as empty and silently cascading.
  • Background library sync actually runs. The background refresh of the file index and collection manifests never executed in packaged installs; it now runs in-process (self-throttled, off the startup critical path).
  • Credential hygiene. Secret-shaped text is scrubbed before session history is persisted, and bearer tokens, inline credentials, and userinfo-style URLs are redacted in string values. The agent's shell tool now enforces read-only execution via a command allowlist, and the artifact preview server is scoped to the artifact directory.

⚡ Performance

  • Ops verbs (--json scripting) skip loading the agent/TUI runtime entirely — noticeably faster startup for pipelines.
  • Streamed source fingerprinting with a stat-keyed digest cache, a memoized source index, and a cheaper session-listing path.
  • Arch-correct ffprobe resolution on darwin/arm64.

Install / upgrade

npm install -g @cloudglue/tinycloud@latest    # or: tinycloud update
# or
curl -fsSL https://app.cloudglue.dev/tinycloud.sh | bash

The launcher downloads and checksum-verifies the matching platform binary on first run (darwin-arm64/x64, linux-x64/arm64).

Assets 2
Loading