Skip to content

v2.9.1

Choose a tag to compare

View all tags
@coz-a coz-a released this 26 Oct 00:34
· 13 commits to main since this release
v2.9.1
3f2837b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Credential reads are better protected for Codex and OpenCode consultations.

  • Codex now denies the default .codex credential directory as a whole when its executable lives elsewhere. Existing, replaced, and newly created children stay denied in the Linux checks. Canonical-root deduplication avoids sandbox startup failures caused by mounting the same directory through aliases.
  • OpenCode receives a local pre-read guard in its synthetic HOME. Each read checks its requested path, real path, and the current targets of protected roots. Allowed reads use canonical paths; unresolvable or protected paths are refused. No user plugins are inherited.
  • Installer status and version-mismatch hints point to GitHub Release archives.
  • Regression coverage includes both hook interfaces, alias swaps, protected roots created or retargeted after launch, and the guard emitted by the bundled server. English and Japanese installation and protection guides are synchronized and reviewed; Japanese prose is checked with yomiyasu.

Install or update:

npx -y severally-mcp@2.9.1 install

Restart clients after installation. See the installation guide for options.

Validation on 2026-10-26: local formatting, lint, strict type checks, build, and package-content tests passed on Linux/Node.js 24.20.0; the suite passed 567 tests with 10 platform-specific skips and no failures. PR CI passed on Linux (Node.js 22 and 24), macOS and Windows (Node.js 24). This is offline test coverage, not a claim of live CLI enforcement on those operating systems. Synthetic probes used Codex 0.164.0 and OpenCode 2.0.24 on Linux. An authenticated Codex consultation completed with the configured and launched gpt-6.1-sol model and low effort; the provider's effective model and effort were not independently observed. OpenCode read probes used a localhost mock model, not a real model.

Release-time Codex diagnostics: the direct sandbox probe refused the protected-root read, and the normal live-check consultation completed. The model-driven doctor checks were inconclusive because no tool calls or control-file quotation were observed; they are not counted as passed.

Known limits remain: Codex cannot deny arbitrary .env filenames, and individual-file rename replacements, executable-containing root snapshots and future legacy job homes retain their documented gaps. OpenCode's hook and file open are separate operations, so replacing canonical paths between them remains outside the guard's guarantee. The guard requires a CLI that loads its plugin. Actual OpenCode V1 loading and macOS/Windows CLI enforcement have not been verified.

Assets 3
Loading