v0.5.10

What's changed

• Add explicitly configured vLLM providers with served-context discovery, optional Bearer authentication, and the shared streaming, tool-calling, reasoning, structured-output, and embedding paths. Includes a Qwen2.5/Hermes tool-calling server example and verification steps. vLLM is not autodetected, and the port-8000 probe no longer misidentifies it as oMLX. (#20)
• Reduce unnecessary project-trust prompts: comments, YAML formatting, and allowlisted presentation/tuning changes preserve approval. Security-relevant settings and external permission edits still require review. Explicitly saved permission decisions remain trusted across restarts. (#19)
• Add cleetus trust --global --yes and --directory recovery commands, improve trust-error formatting, and stop global/scratch launches from checking the launch directory's project configuration. Terminal and ACP launches use the same behavior. (#19)

Upgrading

Run the installer to upgrade:

curl -fsSL https://raw.githubusercontent.com/commoncosmo/cleetus/main/install.sh | bash

Existing exact-byte trust approvals remain valid for unchanged files. Run cleetus trust --yes once (or cleetus trust --global --yes for the global workspace, preserving any custom --config-dir) to adopt the new comparison policy.

For vLLM configuration and server startup, see the provider guide.

Full changelog: v0.5.9...v0.5.10

v0.5.9 — ACP permission control

ACP permission control

cleetus acp --fuckit now skips ordinary tool permission prompts instead of silently ignoring the flag. In JetBrains Air or another ACP client's agent configuration, use:

"args": ["acp", "--fuckit"]

The explicit launch flag also permits file writes outside the session's project directory. Explicit permission denials, Plan mode, secret-path and control-metadata guards, and sandbox restrictions remain enforced. Workflow authorization and client-managed job consent can still prompt. ACP does not inherit permissions_disabled from configuration.

Includes full-process regression coverage for Bash execution, outside-project writes, session reload, permission denials, Plan mode, and protected metadata.

Command editing and broader approval scopes are being explored in #16.

Implemented in #17.

v0.5.8 — oMLX provider support

Cleetus 0.5.8 adds first-class support for oMLX, an inference server for Apple Silicon.

• Configure type: omlx with the server root URL, without /v1. Optional API keys use Bearer authentication.
• Supports model discovery, streamed text and reasoning, native tool calls, structured output, and embeddings across CLI, TUI, and ACP sessions.
• Reads effective model context windows from max_model_len when available, and detects local oMLX servers on port 8000 during first-run setup.
• Updates the README and provider guide with local and remote setup, authentication, context limits, and embedding configuration.
• Updates the MCP TypeScript SDK from 1.29.0 to 1.31.0, addressing GHSA-6qxp-vccf-f47h, and refreshes the dependency lockfile and license notices.

providers:
  mac:
    type: omlx
    base_url: http://localhost:8000
    # api_key: ${OMLX_API_KEY}
default_provider: mac
# default_model: your-model-id

Validated with 4,347 passing tests (6 skipped), lint, typecheck, dependency audit, license checks, a compiled CLI smoke test, and a live oMLX streaming tool-call round trip.

v0.5.7

Dependency security updates

This release updates pinned transitive dependencies to resolve the scheduled vulnerability audit findings:

• fast-uri: 3.1.6 → 3.1.8
• ip-address: 10.3.1 → 10.7.1
• hono: 4.13.5 → 4.13.7
• proxy-addr: 2.0.7 → 2.0.8, resolving GHSA-jqcg-44mw-7w3h, identified during release validation.

The release dependency audit reports no vulnerabilities. Linux x64/arm64 and macOS x64/arm64 binaries are included, with Developer ID signing and Apple notarization for both macOS builds.

What's Changed

• Add security persona by @ccbiff in #10
• Add reusable security evidence and client job contracts by @ccbiff in #11
• Update vulnerable transitive dependency overrides by @ccbiff in #12
• Release 0.5.7 with patched dependencies by @ccbiff in #13

Full Changelog: v0.5.6...v0.5.7

v0.5.6

What's Changed

• Fix macOS release installer signing by @ccbiff in #9

Full Changelog: v0.5.5...v0.5.6

v0.5.5

What's Changed

• Refresh the README introduction and add a TUI screenshot by @ccbiff in #3
• Fix orchestration UI surface counting by @ccbiff in #4
• Defer GitHub CLI checks until PR creation by @ccbiff in #5
• Fix plan approval and repeated probe loops by @ccbilliebob in #6
• Add dedicated Git bootstrap tools by @ccbiff in #7
• Release v0.5.5 by @ccbiff in #8

New Contributors

• @ccbilliebob made their first contribution in #6

Full Changelog: v0.5.2...v0.5.5

v0.5.2 — Security hardening

Security hardening

• Require explicit trust for project configuration and permission files before they can affect startup or execute MCP commands. Approval is stored outside the project and invalidates when configuration changes.
• Limit inherited MCP environment variables; credentials must be configured explicitly.
• Reject symlink aliases in generic file writes and protect Git/Cleetus control files, including dangling private-state database links.
• Bind saved ACP shell approvals to the exact command and working directory.
• Restrict private state directories and sensitive files to owner-only permissions.
• Update six transitive dependencies with security advisories; the release dependency audit reported no known vulnerabilities.
• Gate signing/publication on quality and security checks, and add recurring dependency audits.

Upgrade notes

Review .cleetus/config.yaml and .cleetus/permissions.yaml, run cleetus trust to inspect their fingerprints, then explicitly approve with cleetus trust --yes. Use the same external --config-dir as your usual launch. Configuration changes require approval again, including noninteractive and ACP use.

MCP servers needing credentials must declare them in their env configuration. Prefer ${VARIABLE} interpolation rather than storing literal secrets. Trusted MCP servers still run outside the Bash sandbox; consult SECURITY.md for the trust boundaries and limitations.

v0.5.1 was superseded during validation and was never published as a binary release. Upgrade from v0.5.0 directly to v0.5.2.

Validation

4,235 local tests passed, with 6 environment-dependent skips. Lint, typecheck, license checks, dependency audit, and Git-history secret scanning passed. Release CI repeats the required checks on the tagged commit before signing.

Download the binary for your platform and verify it against checksums.txt. Both macOS architectures are Developer ID signed and notarized for CommonCosmo.