ContextVeil 1.1.0

[1.1.0] - 2026-09-16

Added

• Add project INI discovery, exact section/key enrollment, and opt-in protection
  of one key across all current and future sections.

Fixed

• Fixed crashes when reading certain UTF-16 properties files that could interrupt
  setup, diagnostics, or runtime redaction. (#36)

Install

curl -fsSL https://raw.githubusercontent.com/daniel-sc/contextveil/v1.1.0/install.sh | bash

See the README, limitations, and qualification record for details.

ContextVeil 1.0.0

[1.0.0] - 2026-09-10

Added

• Published the first stable V1 release with deterministic local redaction,
  guided source enrollment, and checksummed installers for Linux and macOS on
  x86_64 and arm64.
• Added bounded Known Source Rules for environment and dotenv values, JSON5,
  Java properties, npmrc credentials, and supported coding-agent credential
  documents.
• Added Claude Code production integration plus opt-in experimental adapters for
  OpenAI Codex CLI, GitHub Copilot CLI, and OpenCode.

Changed

• Simplified first-run setup and status output, added explicit post-setup
  guidance, and limited new integration choices to detected harnesses.
• Setup now omits common literals from automatic suggestions, reports collisions,
  and presents masked previews while preserving manual enrollment.
• Runtime source resolution follows current environment and file-backed values
  without storing resolved credentials in configuration.

Install

curl -fsSL https://raw.githubusercontent.com/daniel-sc/contextveil/v1.0.0/install.sh | bash

See the README, limitations, and qualification record for details.

ContextVeil 1.0.0-alpha.5

[1.0.0-alpha.5] - 2026-09-08

Changed

• Excluded common literals from automatic setup suggestions while preserving
  manual enrollment. (#27)
• Bounded collision analysis and limited binary scanning to textual regions.
• Improved setup guidance, masked previews, installer instructions, and harness
  integration documentation. (#24, #25, #29)

Fixed

• Avoided repeated collision scans for ordinary setup selection changes. (#28)

Install

The installer selects stable releases automatically. Install this prerelease by naming it:

curl -fsSL https://raw.githubusercontent.com/daniel-sc/contextveil/v1.0.0-alpha.5/install.sh | bash -s -- --version 1.0.0-alpha.5

See the README, limitations, and qualification record for details.

ContextVeil 1.0.0-alpha.4

[1.0.0-alpha.4] - 2026-08-31

Added

• Added exact npmrc secret sources and bounded npmrc Known Source discovery. (#13)

Fixed

• Improved malformed npmrc candidate handling and preserved valid discovery entries.

Install

The installer selects stable releases automatically. Install this prerelease by naming it:

curl -fsSL https://raw.githubusercontent.com/daniel-sc/contextveil/v1.0.0-alpha.4/install.sh | bash -s -- --version 1.0.0-alpha.4

See the README, limitations, and qualification record for details.

ContextVeil 1.0.0-alpha.3

ContextVeil 1.0.0-alpha.3

ContextVeil keeps enrolled local secrets out of coding-agent model context
through deterministic local redaction. Runtime resolution and redaction make no
network calls, and no value is ever written into ContextVeil configuration.

Install

curl -fsSL https://raw.githubusercontent.com/daniel-sc/contextveil/v1.0.0-alpha.3/install.sh | bash

The installer verifies the release checksum before replacing anything, installs
into ~/.local/bin/contextveil by default, and never runs setup or changes
coding-agent configuration. Rerunning it upgrades within the installed major
version; crossing a major version needs --allow-major-upgrade.

Then, in a project:

contextveil setup
contextveil doctor

Setup guides enrollment from environment variables, dotenv files, exact
properties keys, manual exact
JSON fields, and maintained Known Source Rules. These rules are advisory and
version-sensitive, not adapter coverage guarantees, and every applicable rule
runs independently of selected integrations. Rule applicability is binary and
unweighted; matching more rules does not select or order a candidate.

Support matrix

Integration	Tier	Covered model-bound content	Failure behavior
Claude Code	Production	String values in successful, replaceable PostToolUse tool responses	Fail open
OpenAI Codex CLI	EXPERIMENTAL	Supported PostToolUse results, replaced as sanitized text with possible loss of structure	Fail open
GitHub Copilot CLI	EXPERIMENTAL	userPromptTransformed and successful textResultForLlm text	Fail open
OpenCode	EXPERIMENTAL	New V1 chat.message user text and successful standard tool.execute.after text	Abort when the executing plugin detects a covered malfunction

Experimental integrations are functional and fixture-tested, but outside the
production support promise, and always require an affirmative choice during
setup. Coverage applies only where a local harness loads and honors the installed
integration.

Known Source Rules

Supported setup-time rules admit candidates from secret-like names,
credential-bearing URLs, and bounded recognized credential document rules. Manual
additions and filesystem enumeration are not rules. JSON source documents use
the full JSON5 grammar, so common comment-bearing Copilot configuration is
supported; duplicate members remain invalid.

New automatic suggestions are selected by default unless a collision is found;
review masked candidates before saving because rules are advisory.

Relevant bounded fields admit independently without unrelated sibling-schema
validation. Missing or unusable fields silently no-match; malformed matched JSON
sources are shown as unavailable. Default and valid override roots are both
inspected. Override values resolve during setup, relative overrides use the
invocation directory, changes require a rerun, and no shell or tilde expansion
occurs. Raw sidecars, OS keychains, and credential helpers are not covered. See
the exact rule inventory and
LIM-023.

Tested host versions

Protocol behavior was verified against these host versions. V1 performs no host
version checks (LIM-018), so these are evidence rather than a supported range:
run contextveil doctor after upgrading a coding agent.

Host	Verified against
Claude Code	Adapter: 2.1.233 live qualification. Known Sources: 2.1.238 and public release commit 8a8e81d098cbd0fae4ee5b9c853542945fe87016
OpenAI Codex CLI	Adapter: openai/codex commit c6058cca. Known Sources: ff0e95007cca1edfc0877bbbbfaeb9eb77ed92b3 (also issue-time d9fd91edab298c2423c0c82526513e4e000284cf)
GitHub Copilot CLI	Adapter and Known Sources: 1.0.80 release commit ef627e1baad937d3c8da45f8a5541c6fc3c97b6a and official docs commit 838d18789ba2c51cfe5544b3e5bf1ca3168c2795
OpenCode	Adapter and Known Sources: 1.18.18 commit 31406ccc51b4bd2a4e1e086b2bcaa5f7f804f26d

Platforms

Linux and macOS on x86_64 and arm64. Each asset is listed in
contextveil-1.0.0-alpha.3-SHA256SUMS.

Known boundaries

ContextVeil is a model-context safety primitive, not a guarantee that credentials
cannot leave the machine. Read limitations.md before relying on it. The
most important entries:

• LIM-001: model
  context only, not credential use or egress.
• LIM-002: unknown
  and transformed values are not recognized.
• LIM-003: string values only,
  not object keys or binary content.
• LIM-004:
  enrolling a short or common value can replace unrelated text.
• LIM-012: process hooks
  fail open when a host crashes, times out, disables, or bypasses them.
• LIM-013 through
  LIM-016: per-host coverage
  gaps.
• LIM-023: Known
  Source Rules are advisory; raw sidecars, keychains, helpers, and unknown or
  changed locations or fields remain outside coverage.

Reporting a vulnerability

See SECURITY.md. Never include a real credential in a report.

This is a prerelease

The installer only selects stable releases on its own, so name this one:

curl -fsSL https://raw.githubusercontent.com/daniel-sc/contextveil/v1.0.0-alpha.3/install.sh | bash -s -- --version 1.0.0-alpha.3

ContextVeil 1.0.0-alpha.2

ContextVeil 1.0.0-alpha.2

ContextVeil keeps enrolled local secrets out of coding-agent model context
through deterministic local redaction. Runtime resolution and redaction make no
network calls, and no value is ever written into ContextVeil configuration.

Install

curl -fsSL https://raw.githubusercontent.com/daniel-sc/contextveil/v1.0.0-alpha.2/install.sh | bash

The installer verifies the release checksum before replacing anything, installs
into ~/.local/bin/contextveil by default, and never runs setup or changes
coding-agent configuration. Rerunning it upgrades within the installed major
version; crossing a major version needs --allow-major-upgrade.

Then, in a project:

contextveil setup
contextveil doctor

Support matrix

Integration	Tier	Covered model-bound content	Failure behavior
Claude Code	Production	String values in successful, replaceable PostToolUse tool responses	Fail open
OpenAI Codex CLI	EXPERIMENTAL	Supported PostToolUse results, replaced as sanitized text with possible loss of structure	Fail open
GitHub Copilot CLI	EXPERIMENTAL	userPromptTransformed and successful textResultForLlm text	Fail open
OpenCode	EXPERIMENTAL	New V1 chat.message user text and successful standard tool.execute.after text	Abort when the executing plugin detects a covered malfunction

Experimental integrations are functional and fixture-tested, but outside the
production support promise, and always require an affirmative choice during
setup. Coverage applies only where a local harness loads and honors the installed
integration.

Tested host versions

Protocol behavior was verified against these host versions. V1 performs no host
version checks (LIM-018), so these are evidence rather than a supported range:
run contextveil doctor after upgrading a coding agent.

Host	Verified against
Claude Code	2.1.233, by inspecting the shipped binary's own hook protocol strings, and by the live intervention-and-resume qualification recorded in docs/qualification.md (REL-008)
OpenAI Codex CLI	openai/codex source at commit c6058cca, codex-rs/hooks and codex-rs/config
GitHub Copilot CLI	1.0.80, against the published hooks reference
OpenCode	1.18.18, by inspecting the installed plugin API types and runtime call sites

Platforms

Linux and macOS on x86_64 and arm64. Each asset is listed in
contextveil-1.0.0-alpha.2-SHA256SUMS.

Known boundaries

ContextVeil is a model-context safety primitive, not a guarantee that credentials
cannot leave the machine. Read limitations.md before relying on it. The
most important entries:

• LIM-001: model
  context only, not credential use or egress.
• LIM-002: unknown
  and transformed values are not recognized.
• LIM-003: string values only,
  not object keys or binary content.
• LIM-004:
  enrolling a short or common value can replace unrelated text.
• LIM-012: process hooks
  fail open when a host crashes, times out, disables, or bypasses them.
• LIM-013 through
  LIM-016: per-host coverage
  gaps.

Reporting a vulnerability

See SECURITY.md. Never include a real credential in a report.

This is a prerelease

The installer only selects stable releases on its own, so name this one:

curl -fsSL https://raw.githubusercontent.com/daniel-sc/contextveil/v1.0.0-alpha.2/install.sh | bash -s -- --version 1.0.0-alpha.2

SecretSieve 1.0.0-alpha.1

SecretSieve 1.0.0-alpha.1

SecretSieve keeps local credentials out of coding-agent context using
deterministic exact-value redaction. Runtime resolution and redaction make no
network calls, and no value is ever written into SecretSieve configuration.

Install

curl -fsSL https://raw.githubusercontent.com/daniel-sc/secretsieve/v1.0.0-alpha.1/install.sh | bash

The installer verifies the release checksum before replacing anything, installs
into ~/.local/bin/secretsieve by default, and never runs setup or changes
coding-agent configuration. Rerunning it upgrades within the installed major
version; crossing a major version needs --allow-major-upgrade.

Then, in a project:

secretsieve setup
secretsieve doctor

Support matrix

Integration	Tier	Covered model-bound content	Failure behavior
Claude Code	Production	String values in successful, replaceable PostToolUse tool responses	Fail open
OpenAI Codex CLI	EXPERIMENTAL	Supported PostToolUse results, replaced as sanitized text with possible loss of structure	Fail open
GitHub Copilot CLI	EXPERIMENTAL	userPromptTransformed and successful textResultForLlm text	Fail open
OpenCode	EXPERIMENTAL	New V1 chat.message user text and successful standard tool.execute.after text	Abort when the executing plugin detects a covered malfunction

Experimental integrations are functional and fixture-tested, but outside the
production support promise, and always require an affirmative choice during
setup. Coverage applies only where a local harness loads and honors the installed
integration.

Tested host versions

Protocol behavior was verified against these host versions. V1 performs no host
version checks (LIM-018), so these are evidence rather than a supported range:
run secretsieve doctor after upgrading a coding agent.

Host	Verified against
Claude Code	2.1.233, by inspecting the shipped binary's own hook protocol strings, and by the live intervention-and-resume qualification recorded in docs/qualification.md (REL-008)
OpenAI Codex CLI	openai/codex source at commit c6058cca, codex-rs/hooks and codex-rs/config
GitHub Copilot CLI	1.0.80, against the published hooks reference
OpenCode	1.18.18, by inspecting the installed plugin API types and runtime call sites

Platforms

Linux and macOS on x86_64 and arm64. Each asset is listed in
secretsieve-1.0.0-alpha.1-SHA256SUMS.

Known boundaries

SecretSieve is a safety primitive, not a guarantee that credentials cannot leave
the machine. Read limitations.md before relying on it. The
most important entries:

• LIM-001: model
  context only, not credential use or egress.
• LIM-002: unknown
  and transformed values are not recognized.
• LIM-003: string values only,
  not object keys or binary content.
• LIM-004:
  enrolling a short or common value can replace unrelated text.
• LIM-012: process hooks
  fail open when a host crashes, times out, disables, or bypasses them.
• LIM-013 through
  LIM-016: per-host coverage
  gaps.

Reporting a vulnerability

See SECURITY.md. Never include a real credential in a report.

This is a prerelease

The installer only selects stable releases on its own, so name this one:

curl -fsSL https://raw.githubusercontent.com/daniel-sc/secretsieve/v1.0.0-alpha.1/install.sh | bash -s -- --version 1.0.0-alpha.1