v0.5.2 — Security hardening

Security hardening

• Require explicit trust for project configuration and permission files before they can affect startup or execute MCP commands. Approval is stored outside the project and invalidates when configuration changes.
• Limit inherited MCP environment variables; credentials must be configured explicitly.
• Reject symlink aliases in generic file writes and protect Git/Cleetus control files, including dangling private-state database links.
• Bind saved ACP shell approvals to the exact command and working directory.
• Restrict private state directories and sensitive files to owner-only permissions.
• Update six transitive dependencies with security advisories; the release dependency audit reported no known vulnerabilities.
• Gate signing/publication on quality and security checks, and add recurring dependency audits.

Upgrade notes

Review .cleetus/config.yaml and .cleetus/permissions.yaml, run cleetus trust to inspect their fingerprints, then explicitly approve with cleetus trust --yes. Use the same external --config-dir as your usual launch. Configuration changes require approval again, including noninteractive and ACP use.

MCP servers needing credentials must declare them in their env configuration. Prefer ${VARIABLE} interpolation rather than storing literal secrets. Trusted MCP servers still run outside the Bash sandbox; consult SECURITY.md for the trust boundaries and limitations.

v0.5.1 was superseded during validation and was never published as a binary release. Upgrade from v0.5.0 directly to v0.5.2.

Validation

4,235 local tests passed, with 6 environment-dependent skips. Lint, typecheck, license checks, dependency audit, and Git-history secret scanning passed. Release CI repeats the required checks on the tagged commit before signing.

Download the binary for your platform and verify it against checksums.txt. Both macOS architectures are Developer ID signed and notarized for CommonCosmo.