Skip to content

v2.1.0

Choose a tag to compare

View all tags
@Minitour Minitour released this 21 Aug 12:12
· 221 commits to main since this release
v2.1.0
3c042e6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

Security-focused release: secrets encrypted at rest, safer installs/upgrades, hardened loopback API, and verifiable release artifacts.

Security

  • Secrets at rest — variables, OAuth tokens, and git credentials are encrypted with AES-256-GCM; master key prefers the OS keyring with a permissioned file fallback
  • On-demand secret sources — MCP env/headers support fromEnv, f romCommand, and fromFile (user-authored config only; plugin manifests reject non-string secret objects)
  • Install path guards — refuse symlink escapes, path traversal, and Windows cross-drive writes; validate wrap shadow workspaces
  • Loopback API hardening — token auth + CSRF/same-origin gates, Host allowlist (DNS rebinding), tighter CORS, CSP + osniff on HTML
  • Safer execution — no registry adapters or stdio MCP spawns from HTTP configure; formatters/command tools avoid shell; capa sh unknown tokens no longer fall through; shell+placeholder templates fail closed unless opted in
  • SSRF / supply chain — guard remote installs, verify lock body hashes, keep git tokens out of clone URLs/argv/cache config
  • Install confirmation — print executable surface (stdio MCP, hooks, formatters, plugins) and require confirmation (--yes / --dry-run for CI)
  • TLS — CAPA_DISALLOW_TLS_SKIP_VERIFY fail-closed override for managed images

Install & upgrade

  • Pin installs with CAPA_VERSION
  • Upgrades use checksum-verified tagged installers
  • Release assets include SHA256 checksums, install scripts, and build provenance attestations (verify with gh attestation verify when available)
  • Global --headless flag so credential/auth flows never block on a browser in CI/cloud sandboxes

Product & UX

  • Activity tracing improvements (generation-scoped traces, process diagram export, live feed)
  • MCP servers auto-enabled after configure/install/wrap
  • Plugin OAuth \client_id\ preserved during discovery sync
  • Wrap: shadow-only artifact sync, agent instruction hardening, removed-skill cleanup scoped to shadow workspaces

Tooling

  • Qlty smells gate in CI (block new code smells)
  • CodeQL action bump
  • TypeScript boundary cleanup and large-file splits for maintainability

Upgrade

capa upgrade

or pin:

CAPA_VERSION=v2.1.0 curl -fsSL https://github.com/infragate/capa/releases/download/v2.1.0/install.sh | bash

Full Changelog: v2.0.3...v2.1.0

What's Changed

  • chore(deps): bump github/codeql-action from 4.37.3 to 4.37.6 by @dependabot[bot] in #174
  • chore(deps): bump github/codeql-action from 4.37.3 to 4.37.6 by @dependabot[bot] in #181
  • Add --headless flag so browser launches never block in cloud/CI sandboxes by @Minitour in #177
  • Prevent capa install from escaping shadow workspaces via symlinks by @Minitour in #175
  • security: harden local API, install, registries, and credentials by @Minitour in #182
  • feat: MCP server toggles, activity UX, and process mining diagram by @Minitour in #184
  • Remove activity commands pane by @Minitour in #185
  • feat: improve activity tracing, OAuth sync, and server toggle UX by @Minitour in #186
  • fix: preserve plugin OAuth client_id during discovery sync by @Minitour in #187
  • refactor: TypeScript boundaries, dead UI cleanup, and Qlty smell gate by @Minitour in #188
  • refactor: split large server and activity files into focused modules by @Minitour in #189
  • feat: on-demand MCP secrets and OS keyring master key by @Minitour in #190
  • fix: shadow-only artifact sync, agent instruction hardening, MCP auto-enable by @Minitour in #192
  • Security Update by @Minitour in #191

Full Changelog: v2.0.3...v2.1.0

Contributors

Minitour and dependabot
Assets 15
Loading