Skip to content

Agent Countercheck v0.5.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Oct 00:25
· 34 commits to PROD since this release
Immutable release. Only release title and notes can be modified.
v0.5.1
7ba455f

Upgrade: security fix. With v0.5.0 and earlier, an agent that changed settings in the project's own .git could
get VERIFIED for broken code with weakened tests. Found in an audit (docs/audit/2026-10-findings.md).

  • Fix: what changed is decided from the files themselves, and the base from checked git objects. Countercheck
    used git's index and git diff to find changed files, and trusted git to show the base revision. Settings in the
    worker's own .git could make an edited protected file look unchanged, or make the base show other content, and
    turn a FAILED into VERIFIED. Now the clean copy's bytes are compared with the base, and every git object read for
    the base is hashed again and must match its id (replace refs are ignored); a mismatch stops the run with an error.
    A protected file that differs only by CRLF line endings is not reported as changed and still runs with its base
    bytes. Protected files stored through a git filter (e.g. Git LFS) are compared as stored in git.
  • Fix: nothing is written or deleted through a symlinked folder in the clean copy. If the worker replaced a
    folder with a symlink out of the project, putting back its protected files wrote them through the link, and a
    golden check's old output file was deleted through it. Now such a link is replaced by a real folder in the copy
    before protected files are restored, a golden output behind it is left alone (and refused after the run), and a
    link folder behind it is not linked.
  • Docs fix: the README's "at least N tests" example could pass failing tests. Its exit code came from
    grep -q '^OK' on the output, so code that printed OK and a few ... ok lines passed while its tests failed. The
    example now keeps unittest's own exit code and counts tests from its Ran N tests line.

Install

You use Command
Python pip install -U agent-countercheck · uvx --from agent-countercheck countercheck verify
macOS / Linux, Homebrew brew trust --formula datacrate360/tap/agent-countercheck && brew upgrade agent-countercheck
macOS / Linux, any shell curl -fsSL https://raw.githubusercontent.com/datacrate360/agent-countercheck/PROD/install.sh | sh
Windows 10/11, PowerShell irm https://raw.githubusercontent.com/datacrate360/agent-countercheck/PROD/install.ps1 | iex
Assets 11
Loading