Skip to content

IntelyIDE 1.1.1

Choose a tag to compare

View all tags
@ferencfarkas09 ferencfarkas09 released this 10 Oct 04:11
· 68 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.1.1
75d411c

IntelyIDE 1.1.1

The stable release of IntelyIDE, a desktop Git client for several repositories at once, with coding agents that can edit but never commit or push.

Download

File What it is SHA-256
IntelyIDE_1.1.1_x64.dmg The app for Intel Macs (it also runs on Apple Silicon under Rosetta 2), 16.2 MiB cef2acce5b08374d5928c82b97ed180561e6282d028b65354a995dc6113ba346
IntelyIDE_1.1.1_x64.sbom.cdx.json Software bill of materials (CycloneDX) of what is inside the disk image 4ad1be6db0bbe46d805da7765446072ee678b37a7793c55937fde62d3686c9df
SHA256SUMS The checksums of the files above

Install

  1. Open IntelyIDE_1.1.1_x64.dmg, drag IntelyIDE to Applications, eject the image and open the app from Applications.
  2. The app is signed ad hoc and is not notarized, so macOS refuses the first launch. On macOS 15 and later open System Settings > Privacy & Security, scroll to the message about IntelyIDE, choose Open Anyway and confirm. On macOS 13 and 14 right-click the app and choose Open. Do this only for a file you downloaded from this repository's Releases page.
  3. Agent runs also need Node.js 24 or newer, your own Claude Code login and the Claude Agent SDK, which you install once with the installer inside the app: node '/Applications/IntelyIDE.app/Contents/Resources/sidecar/sdk-install.js' --yes (run it with --plan first to see what it would download). The Git features work without any of this. Details: docs/install-macos.md and docs/getting-started.md.

Verify the download

In the folder with the files: shasum -a 256 -c SHA256SUMS. This detects a damaged download. The checksums come from the same page as the files, so they cannot prove who made them.

What's changed

Fixed

  • Agents could not read or write although their role allowed it. Replaying the 431 shell commands of the recorded runs through the policy showed two causes, both fixed.
  • Plan mode and the read-only roles (reviewer, researcher, manager) can read. 208 of the 431 commands that only read were refused as "not a read-only command" because the allow-list was too narrow: sed -n 140,175p file, grep ... 2>/dev/null, uniq, cut, tr, awk '{print $1}', echo "--- label", ls dir/*, cd a && ...; cd ../b; ls, git branch --show-current, git remote -v, git stash list, git reflog, and a find with -o (its -o was taken for an output option, which even hard-stopped Automatic). They run now without a card in Plan and Accept edits; 11 of the 208 remain refused, and they are the right ones (a folder outside the run, inline node -e, git add). sed stays a viewer (no -i, no w, e or r), awk only prints fields, uniq keeps one operand, and only /dev/null is a harmless redirect target.
  • Automatic mode no longer refuses the commands developers write every day. 22 of the 289 shell calls of the biggest run (most of them reads and edits by developer sub-agents) were refused as "outside the run's folders" or "not known statically" although every path stayed inside the folders. The analyser now judges each operand where it really points, from the directory an earlier cd of the same command moved to; a search pattern or a sed or awk program is not a path; a variable the command assigns from literal words (f=src/a.js; git status $f) and a for loop over literal words are judged on the words the shell will see; a helper script kept in /tmp is scanned like one in a repository; and a git hidden behind a variable is found (g=git; $g commit is a hard stop).
  • A value is read only when the command makes it certain: a quoted "$c" stays one word, a brace list or $(...) in a for list stays unknown, an assignment that may not have run (after ||, in a pipe, in the background) or that a loop leaves early is not followed, and read, printf -v, let, eval, mapfile, getopts, declare -n and IFS end the following.
  • A glob is expanded and every match is judged like an operand, in every mode: cat .e* or ls ../* is refused when it names a secret or something outside the run's folders (before, nothing looked at it). Independent reviews of the new code (six rounds) closed the holes they found: option bundles that hid a file as the pattern (sed -nes/a/b/p .env) or carried a program (git grep -nOpager, git grep --op=cmd, git difftool -x cmd, git clone -u cmd and --up=cmd, git clone -c core.fsmonitor=cmd), options that follow links (grep -rS, rg -L, find -L, ls -LR, rsync -L, tar -h), a cd to a folder that does not exist, a .. after a link the same command makes (also behind env, xargs or find -exec, or made by tar x, unzip or code that says symlink), ~user, ~+ and ~-, which are not folders of the run, a command substitution inside ${...} (echo ${x:-$(git push)}), zsh forms (*(D), .e(n)v, ***/, setopt GLOB_DOTS, =git, $x[1,4], noglob git push, emulate zsh -c, a lone -, ${(e)x}, zmodload, autoload, functions[f]=..., the brace body of if cond { ... }), here-strings with environment variables, and a test of a path outside the run.
  • The Claude CLI's own safety prompts for a redirect it cannot split, a skipped parse and the braces of a Python or Node program fed through a quoted heredoc are answered from the policy's verdict instead of ending the call; a sed program with a template literal stays a refusal that points to the Edit tool.

Changed

  • The transcript says why a call was refused: one line under the refusal (the full reason on hover), "Declined by the run's rules" or "Denied by the role" instead of always the role, and a localized sentence for the Claude CLI's own prompt. A read-only role is told which commands run, and a call whose agent the Claude CLI did not name is told to run again.
  • A few shapes that were allowed by accident are refused now: a path after a cd to a folder that does not exist (or after a cd that may not have run) that leaves the run's folders from the place the shell may really be in, a parenthesis stuck to a word that zsh reads as part of a glob (*(D), .e(n)v), a cd in a pipe or in the background, and a glob that matches more than 5000 files. zsh's =git is read as git, so the git hard stops apply to it.

Known limitations

  • The static check still does not see the files a recursive search (grep -r ., rg --hidden) touches inside the folder it starts in, the names xargs hands to a program, a link that a script or a build tool makes (bash x.sh, make, npm install), or a secret that was once committed and is read from the history.

More

Assets 6
Loading