Skip to content

v0.0.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Jul 13:25
· 51 commits to main since this release
v0.0.2
20802e1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Leash 0.0.2 — the npm path goes live, and brew install now works first-run on macOS.

# Homebrew — macOS
brew install hoophq/tap/leash
# npx — macOS / Linux, no install
npx @hoophq/leash

What's new

  • Smoother macOS install — the Homebrew cask now strips the quarantine attribute in a postflight, so the binary runs immediately after install instead of being killed by Gatekeeper (proper signing + notarization is on the roadmap).
  • Shell rc/profile files are treated as env-tier secrets — reading or exfiltrating ~/.zshrc, ~/.bashrc, ~/.profile and friends now gets the same scrutiny as .env files, since rc files routinely export API keys.
  • npm distribution — @hoophq/leash ships prebuilt binaries for macOS/Linux on x64/arm64 via the esbuild-style optionalDependencies pattern: no postinstall script, no runtime download.

Changelog

  • d034288 Classify shell rc/profile files as env-tier secrets
  • 18394a0 Strip quarantine in the cask postflight — Gatekeeper kills the unsigned binary
Assets 7
Loading