Skip to content

v2026.4.1

Choose a tag to compare

View all tags
@hex hex released this 04 Apr 19:40
· 4044 commits to main since this release
v2026.4.1
7edc1f2

What's Changed

Security

  • Drop Windows support entirely — removes PowerShell injection vulnerability in credential backend, install.ps1, and cs.ps1 completions. Windows users should use WSL.
  • Fix grep -P portability — invisible unicode detection in memory scanning was silently failing on macOS (BSD grep lacks PCRE). Now uses perl for cross-platform support.

Testing

  • Add 102 new tests (132 → 234 total, 15 test suites)
  • artifact-tracker.sh (31 tests): path rewriting, secret detection, content redaction, MANIFEST updates
  • cs-secrets (28 tests): encrypted backend store/get/delete/purge/export, session isolation, file permissions
  • sync functions (19 tests): push/pull with local bare repos, config, auto-toggle, clone, memory scan blocking
  • session hooks (24 tests): discoveries archiver/reminder, auto-approve, subagent context, failure logger
  • Extract shared test_lib.sh from 11 test files (-573 lines of duplicated boilerplate)

Code Quality

  • Deduplicate CLAUDE.md session template into write_session_claude_md() (was copy-pasted in 2 functions)
  • Deduplicate script-finder logic (run_secrets() now delegates to find_secrets_script())

Other

  • Add staleness warning to commands.md import in CLAUDE.md
  • TUI: hide Remote and Github columns when preview pane is open

Full Changelog: v2026.3.13...v2026.4.1

Full Changelog: v2026.3.13...v2026.4.1

Assets 14
Loading