v0.48.0

v0.48.0

Introduces an optional native command sandbox for hoisted bash (beta, off by default), plus a Windows background-bash correctness fix and a search cache-key fix. Safe drop-in upgrade from v0.47.x — no behavior changes unless you explicitly opt into the sandbox.

Native command sandbox (beta, opt-in)

AFT can now confine the commands it runs through hoisted bash using the operating system's own sandbox, so a command cannot write outside your project or read your credentials even if it tries. It is off by default; enable it per-user or per-project with "sandbox": { "enabled": true } in aft.jsonc. This is a beta: we want real-world feedback before considering it a default.

What it enforces when enabled:

• Writes are confined to your project, the per-task temp directory, and toolchain caches; everything else on disk is read-only. rm -rf outside the project is refused by the kernel, not by a heuristic.
• A credential floor is never readable or writable — ~/.ssh, ~/.aws, ~/.gnupg, ~/.config/gcloud, ~/.azure, and ~/.config/cortexkit — and on Linux this floor extends to systemd and container secret directories (/run/credentials, /run/secrets).
• Git metadata is protected: .git/hooks cannot be written (so a command cannot plant a hook), while ordinary git operations keep working.
• A first-party command can request a one-time escape with sandbox: "host", which prompts you for approval and runs that single command unconfined.

Platform coverage is stated honestly rather than overpromised:

• macOS (Seatbelt): full profile — read floor, write confinement, and the credential/hooks denials above.
• Linux (Landlock, kernel 5.13+ with ABI ≥ V3): read floor and write confinement enforced from held file descriptors, with the secret floor denied by omission. Documented limits, closed later by a container tier: nested write-denies inside a writable tree, AF_UNIX socket connects, and pre-existing hard-link/bind-mount aliases are not fully constrained; /proc is readable (same-UID process visibility depends on your ptrace_scope). If the kernel cannot enforce the required rights, execution fails closed rather than running unconfined.
• Windows: not supported; enabling the sandbox there fails closed instead of running unconfined.

Full details and the platform matrix are in the sandbox section of docs/config.md.

Correctness fixes

• Windows background bash tasks now record completion after a detach/rebind. A detached task whose output was correct could report failed with no exit code, because the exit marker was only written by the still-attached daemon; the command now records its own exit code, so detached completion survives losing the daemon handle. (Unix was unaffected.)
• Search cache keys are stable for repositories with grafted history. Repos with multiple root commits could re-derive a different artifact cache key across runs (triggering a full index rebuild) because the root-commit set was hashed in git's traversal order; it is now canonicalized before hashing.

Under the hood

• The macOS local test gate signs and warms every test binary up front to avoid the first-exec assessment tax, instead of relying on an ineffective scanner kill.