v0.8.0

0.8.0 (2026-10-22)

Features

• screens: build the README visuals from the chat model, and rewrite the README (#31) (1af8056)

Bug Fixes

• chat: show the resolved path in approvals and keep the debug log private (09ff234)
• config: refuse duplicate keys and reveal hidden text in ouija trust (66c104d)
• config: stop discovery at the home directory whatever its name (0d31c6e)
• engine: confine bash with seccomp and a PID namespace, and widen the git restore (6083b7c)
• engine: keep a confined git init quiet (19a54ce)
• engine: mark failed tool calls on their trace span (2046cc8)
• engine: open files through os.Root and show the real target in approvals (9ab96f5)
• engine: refuse a FIFO with the same error on every OS (0f67f3b)
• engine: refuse bash commands with tag and other format characters (02faa51)
• engine: resolve absolute paths inside the project (4d2b1a8)
• engine: stop npm and pip retrying in a closed sandbox (05b3e7f)
• install: pin provenance to main and make pre-releases opt-in (1f99ff1)
• mcp: count a root's depth before resolving its symlinks (8724ff7)
• mcp: refuse tool calls from a broad root (924f384)
• providers: refuse cross-host redirects and bound responses (b3bc83e)
• totems: pin the doc encoding and disable git filters in review (185a4d7)

Documentation

• assets: frame the demo GIF like the install GIF (fdee0b9)
• bring every page in line with the hardened sandbox and trust (04f0f6a)
• fix pages that disagreed with the code (4d1fc65)
• readme: put the quick start right after the demo and size every image alike (56a713e)
• security: describe absolute paths, the quiet git init and offline retries (08d9266)
• security: say what a Landlock ABI v9 kernel leaves open for UDP (f89c888)
• site: let the framed screenshots and demo carry their own title bar (92b218b)
• style: use one markup for images and make screens for screenshots (74fd59e)