v1.6.2

Full Changelog: v1.6.1...v1.6.2

v1.6.1

Full Changelog: v1.6.0...v1.6.1

v1.6.0

v1.6.0

Orchestration architecture and multi-agent lifecycle hardening, native Windows Terminal integration and input console pump, quadrant canvas TUI view with opening animation, terminal paste placeholders, and critical security remediations across filesystem, network, installer, and sandboxing subsystems.

Changes

• Orchestration Architecture & Lifecycle Hardening: Execution identity tracking, strict parent-child event isolation, adversarial queue and batching resilience, cross-field CUE configuration validation, and bounded total turn budgets.
• Windows Terminal & Console Input: Native Win32 console input event pump, terminal fragment profile integration, Forcefield branding assets, and high-fidelity keycode translation.
• TUI Quadrant Canvas & Opening Animation: Split quadrant visualization for multi-agent orchestration, progressive opening rail animation, responsive viewport layouts, and seamless terminal paste placeholders.
• Security Remediations:
  • NTFS Alternate Data Stream (ADS) sensitive-path traversal remediation.
  • IPv4-mapped IPv6 address normalization preventing private network and metadata endpoint bypass.
  • Official installer script (install.sh, install.ps1) checksum verification failing closed by default with explicit override flags.
  • TUI terminal escape injection sanitization for untrusted tool output and arguments.
  • Landlock isolated execution sandbox sterile Git environment isolation (GIT_CONFIG_GLOBAL=/dev/null, GIT_CONFIG_NOSYSTEM=1).
• Configuration & Documentation: Updated orchestration testing guides, provider configuration schemas, and PEM key ignore rules.

Full Changelog: v1.5.2...v1.6.0

What's Changed

• Potential fix for code scanning alert no. 15: Off-by-one comparison against length by @fabledruns in #15

v1.5.2

v1.5.2

Opt-in Linux filesystem isolation for shell commands: sandbox.mode: isolated runs commands under a Landlock ruleset (read-write workspace and private temp directory, read-only system paths, /proc and $HOME denied) plus no_new_privs. Commands refuse to run where Landlock is unavailable. Shell and job children also no longer inherit the provider credential variables Forcefield itself reads. A new sandbox-probe CI job reports the Landlock ABI per runner and enforces boundary tests in required mode.

Changes

• Isolated execution mode (Linux only, opt-in via sandbox.mode: isolated): Landlock filesystem confinement with always-pinned working directory, per-execution private TMPDIR, credential stripping, and fail-closed setup; refuses to construct on Windows/macOS. Optional sandbox.isolated.read/write extras.
• Credential environment filtering: provider api_key_env names (plus legacy key) removed from shell/job child environments; explicit per-command env still applies.
• Sandbox boundary-test harness with FF_REQUIRE_BOUNDARY fail-closed gating, Landlock ABI probe reporting, spawn-site audit, and a three-OS sandbox-probe CI job with required-mode checks.

Limitations

• Isolated mode confines filesystem access only: host networking, process groups, and resource use are unchanged, and it is not malware containment.
• Shell writes to .git/hooks and similar paths inside the workspace are not blocked; macOS has no isolation backend.

Full Changelog: v1.5.1...v1.5.2

v1.5.1

v1.5.1

Benchmarking moves out of the main tree: HPOV is now a standalone repository with launch, startup, and memory benchmarks plus calibration and methodology docs. The TUI gains a Crush-style status strip, a version row on the splash, and an interactive command palette. File close errors are reported instead of dropped.

Changes

• HPOV benchmark suite: core measurement infrastructure, launch/startup/TUI-timeline/memory/baseline benchmarks, tail-behavior calibration, and methodology docs, extracted into its own repository.
• Command palette: typing / filters commands, arrow keys move with wraparound, Enter or Tab confirms, second Enter runs. Active row in Forcefield pink with one-line descriptions, no borders.
• Splash: left-aligned rail, pink (#ED2663) to off-white (#F2F2F2) gradient wordmark, binary version row under the art. Release builds embed the version through Makefile ldflags.
• Bottom status strip in the Crush style: full-width green/yellow/red band for notices.
• WriteFile and filesystem reads report close errors instead of dropping them.

Full Changelog: v1.5.0...v1.5.1

What's Changed

• fix(filesystem): handle file close errors by @fabledruns with @Copilot in #14

v1.5.0

v1.5.0

Full Sandbox: the execution boundary is now enforced where possible and stated honestly everywhere else. Filesystem tools are confined to the workspace through one hardened path, Git and search helpers run neutralized under the full process lifecycle, and WSL network isolation says exactly what it covers. "Full Sandbox" means complete and documented, not airtight. The limitations below are part of the release.

Changes

• Filesystem reads, writes, listings, search, and secret scans share one hardened access path: workspace resolution, no-follow opens, descriptor checks (regular file, size cap, single link for writes), bounded context-aware I/O, and fchmod instead of path chmod. FIFOs, sockets, and devices are refused without blocking.
• Git runs under the full process lifecycle with a minimal environment, -c core.fsmonitor= on every invocation, --no-textconv/--no-ext-diff on all diffs, and per-repository content-filter neutralization (filter drivers are replaced with a pass-through instead of repo binaries).
• Windows children start suspended and resume only after Job Object assignment, closing the Start to Track race; output lines cap at 256 KiB; Runtime.Close reaps jobs then MCP servers; TUI quit waits bounded; headless runs close on exit. taskkill.exe resolves via System32.
• Sandbox enforcement is structured data: ff doctor renders facts as info and limits as warnings, names the configured WSL distribution, and runs a safe interop canary (command -v only, no traffic).
• Permission precedence is pinned by tests: boundary denial outranks every allow, session Deny outranks persisted Allow, sensitive paths escalate even under dual Allows, headless Ask fails closed.
• MCP stays UNSANDBOXED by decision (warn, never refuse): doctor, both approval prompts, and /mcp list say so from one shared notice.

Fixes

• WSL network: disabled no longer reads as complete egress denial: approval and doctor qualify it to Linux sockets. Windows .exe interop executes inside the namespace on the host stack (verified with an empty environment) and is refused lexically (curl.exe, explorer.exe, .exe catch-all) plus reported by the canary.
• Refused file writes no longer truncate before validation; a denied multi-link or special-file write leaves existing content intact.
• Stale process claims corrected (pre-Track coverage, PATH taskkill); loopback wording qualified; lifecycle tests made hermetic (effect-based setsid proof, backend-independent doctor test, live-backend gating).

Limitations

• Windows has no O_NOFOLLOW/link-count equivalence; MkdirAll TOCTOU residual; setsid/SIGHUP bypass teardown (use tmux); WSL Linux-side processes may outlive the relay; staged WSL scripts are visible via /mnt; no CPU/memory/PID limits; no Linux/macOS isolation backend. Full list in docs/Sandbox.md.

Full Changelog: v1.4.2...v1.5.0

v1.4.2

v1.4.2

Follow-up to v1.4.1. This release closes four audit findings around permissions, secrets, and provider reliability, plus two smaller fixes found by testing.

Changes

• Provider configs now reject Authorization, x-api-key, x-goog-api-key, and api-key headers in any casing. The adapters set these from the resolved API key, so allowing them meant a config value could silently replace the real credential and store a live key in config.yaml.
• Sensitive-path escalation now covers foreground shell commands and MCP tool arguments, using the same sensitive-path definition as the file tools. An allow-ruled shell can no longer read credential files without prompting, and neither can an allowed MCP tool through path arguments.
• Shell env keys are validated ([A-Za-z_][A-Za-z0-9_]*) before process setup on every backend. Malformed keys such as -u or A=B are rejected instead of reaching /usr/bin/env on WSL.

Fixes

• Provider streams now time out after 60 seconds without body data. Active streams run as long as data keeps arriving; a stalled stream fails as a retryable timeout instead of holding the turn forever.
• Headless ff run prints MCP warnings (dead servers, missing tools) to stderr. Previously these only showed in /mcp and the status file.
• MCP server shutdown drains unread stderr before closing the pipe, fixing lost diagnostics from fast-exiting servers (seen as a CI-only failure on ubuntu).

Improvements

• New bench/startup.ps1 measures cold/warm startup latency with no inference. Measured here: 44.8 ms cold p50, 43.0 ms warm p50 (n=15 each).
• Every change above ships with regression tests proven to fail against the old behavior.

Full Changelog: v1.4.1...v1.4.2

v1.4.1

v1.4.1

Patch release closing the three confirmed P1 reliability gaps from the paranoid maintainer audit, plus two secret-display fixes and their regression tests.

Fail-closed session persistence

• A failed session save mid-run is now a first-class condition: the driver latches a sticky degraded state and cancels the run context, so no further side-effecting tools execute against a stale file.
• The run exits terminal (non-zero) instead of pretending state is durable, including when adoption writes (heal/agent alignment) or supervisor bookkeeping fail.
• Supervisor restart accounting is verified against the session file: an unverified mirror write stops supervision instead of spending budget the file cannot account for.

Verification-aware exit status

• New ExitUnverified (5): EventDone exits 0 only with a verified status; partial/unverified completions exit non-zero while still printing their output.
• Plain chat is unaffected (zero tool calls report verified, as before).
• ff supervise parks on unverified completions instead of treating them as success, and the exit-code contract is documented in docs/Recovery.md.

Bounded live shell output

• Live onChunk stream output now shares the tool byte budget: the first line past the cap is replaced by a single truncation marker, then the stream goes quiet.
• Shell is the only production streaming tool, so this closes the channel end to end; normal small output streams byte-identical with no marker.

Secret-display fixes

• The headless permission prompt no longer prints raw arguments (including env objects) to stdout.
• The TUI approval modal now scrubs non-string argument values the same way it already scrubbed strings.

Correctness

• Portable MCP cwd assertion in tests; gitleaks ignore for a flagged false positive.
• Full test suite and go vet pass; every new behavior above is pinned by regression tests proven to fail against the old behavior.

Full Changelog: v1.4.0...v1.4.1

v1.4.0

v1.4.0

Forcefield v1.4.0 adds local MCP server support and cuts startup time roughly in half on the measured development machine.

MCP servers

• Connect to local MCP servers over stdio; their tools show up as mcp__<server>__<tool> alongside native tools.
• /mcp lists servers and tools, and ff doctor reports last-known MCP state without starting anything.
• A server that fails to start never fails the run: healthy servers keep working and the failure surfaces as a warning.
• Status persists to .forcefield/mcp-status.json (temp file plus rename, mode 0600); a failed write leaves no partial file behind.

Startup performance

Measured with the unchanged benchd harness methodology on the development machine (Windows, Ryzen 7 7435HS); treat these as reference numbers, not guarantees:

• ff --version: ~66 ms → ~39 ms median.
• Cold ff run launch: ~164 ms → ~62 ms median.
• Warm ff run launch: ~142 ms → ~44 ms median.
• Binary size: 19,205,120 B → 19,214,848 B (+0.05%).

Two changes do most of the work. Cobra's Windows Explorer check walked the full OS process list on every invocation (~19 ms); it is now off, since Forcefield is a terminal tool. Project-root detection no longer spawns git rev-parse (~75 ms per spawn on Windows) in the clear cases: a pure-Go upward .git search answers, and anything ambiguous — worktree/submodule links, GIT_* overrides, cross-filesystem walks, unreadable paths — still goes through git exactly as before.

The rest is duplicate work removed: the config file is parsed once (permissions and provider resolution reuse the loaded config), capability probes and context-limit tables are computed once per process, and the sessions directory skips redundant create/chmod calls on every save.

Runtime hot paths

• The system prompt base is built once per run instead of on every model turn.
• Streamed text accumulates in a builder rather than reallocating per chunk; provider event channels are buffered.
• Search resolves symlinked files once instead of twice; wheel scrolling no longer re-scans the transcript per notch.
• None of these change output, file formats, error messages, or sandbox, permission, recovery, and redaction behavior.

Correctness

• Fixed the MCP status failure test on Linux, where stat through a blocked path returns ENOTDIR rather than ENOENT.
• Added Git parity coverage (plain, nested, worktree, submodule, symlinked, and malformed layouts) asserting byte-identical answers with the git subprocess on Windows and Linux.
• Full test suite and go vet pass on both platforms.

Full Changelog: v1.3.1...v1.4.0

v1.3.1

Performance Patch

Forcefield v1.3.1 is a performance-focused patch release centered on startup responsiveness.

Startup

• Introduces TUI-first startup so the interface can render before the full runtime finishes initializing.
• Moves non-essential runtime initialization behind the first frame.
• Initializes the runtime in the background while preserving startup ordering and error handling.
• Keeps interactive input gated until the runtime is ready while allowing quit during initialization.

Performance

• First-frame startup was reduced substantially from the previous ~170–180ms range to roughly ~53ms in the measured development environment.
• Runtime initialization continues in the background and reaches runtime-ready at roughly ~120ms in the same measurements.
• The optimization does not remove runtime initialization work or functionality. It changes when that work occurs.

Reliability

• Added startup ordering and lifecycle tests.
• Added coverage for initialization failure and slow initialization.
• Preserved quit behavior during startup.
• Preserved existing synchronous construction behavior for callers that require it.

Notes

Performance measurements are environment-dependent. The reported timings were measured on the development benchmark environment and should be treated as reference measurements rather than universal guarantees.

Full Changelog: v1.3.0...v1.3.1