v0.14.1

[0.14.1] - 2026-11-05

0.14.1 fixes problems found after the 0.14.0 upgrade, mostly in repositories with several worktrees or branches. The vault format is unchanged, so 0.14.1 and 0.14.0 read each other's vaults.

Upgrade notes

• Upgrade the vault on your default branch first. All worktrees of a repository share one trust record on each machine. In 0.14.0, the first 0.14 save on any branch made every other branch refuse its pre-0.14 vault, with the message "rolled back: generation 0". In 0.14.1 each branch is judged on its own:
  • A branch that has not taken the upgrade yet can still read its pre-0.14 vault.
  • Writing to that vault needs murk trust --vault .murk once, on that branch. After that, the next write upgrades it.
  • The simplest route is still to make the first 0.14 save on the default branch, commit it, and merge it into each branch.
• New message. A refusal of this kind now says the vault "is in the pre-0.14 format, but this repository's vault has already been upgraded on this branch", instead of "rolled back: generation 0".
• CI. Runners need MURK_TRUSTED_SIGNERS (murk-action: trusted-signers), as in 0.14.0. murk trust --print-key prints the entry for each signer.

Trust

• Another vault's pre-0.14 file is refused once this machine has pinned a vault id. This holds on every branch, and for loads, merges, murk diff and murk trust.
• A pre-0.14 vault on a branch without the upgrade is read-only until you accept it with murk trust. This covers every write command and keyed merges. A refused merge writes nothing.
• Accepting an older copy never removes anyone. murk trust on an older pre-0.14 copy records that copy as accepted for the branch. It never records a current member as removed. Real removals still come only from a vault this machine accepts as current.
• murk init with a key that cannot sign (ssh-rsa, hardware and plugin keys) now records the new vault as unsigned, so the next command loads it with the usual warning instead of refusing it.
• Repositories that use git's reftable ref format keep a separate trust mark per branch.
• Branch names that differ only in case map to the same branch on case-insensitive filesystems.

Fixes

• rotate --values-from, circle revoke and agent revoke refuse a values file that contains a line they cannot read, such as an unquoted multi-line key, and write nothing. Before this fix, rotate could save only the first line of a private key and exit 0.
• murk diff applies the agent read policy. Under an agent grant, it shows keys the policy forbids as changed but never prints their values.
• edit, rotate, circle revoke and agent revoke refuse to save when the vault changed on disk while they waited for input.
• "unsupported vault version" names the component and its version: the murk CLI, the Node binding or the Python binding.

Known limits

• Read side of the pre-0.14 rule. On a branch without the upgrade, another vault's pre-0.14 file whose created and vault_name were copied from this vault is still read as this vault. The pre-0.14 format does not sign those two fields, so anyone with write access to the repository can copy them. Writes over that file are refused until you run murk trust, so new secrets can't reach the other vault's recipients. Merge the upgrade into each branch to close this.
• An agent can fall back to your stored key. If an agent unsets MURK_AGENT, MURK_KEY and MURK_KEY_FILE in its own shell, murk finds your stored key from the vault's path. A grant doesn't stop an agent running as your OS user. See AI agents for isolation options. A change to the stored-key lookup is planned for 0.15.

bb plugin 0.1.1 (separate tag)

• bb murk grant mint refuses to upgrade a pre-0.14 vault on a feature branch unless you pass --upgrade. Upgrade on the default branch instead.
• When the vault format is newer than the loaded binding, the error names the loaded version and says to restart bb. A plugin reload does not replace a loaded native binding.
• Requires @interrupted/murk-secrets 0.14.0 or later.

All changes

Documentation

• docs: use one grant key file secret with murk-action v1.2
• docs: show the whole grant key file in the ci grant demo
• docs: warn that an agent can fall back to the owner's stored key

Fixed

• fix: auto-merge a grouped dependabot update only when every dependency is a patch
• fix: refuse a save that would push the vault past its generation limit
• fix: update block-buffer to fix a panic-corruption advisory
• fix: let the bb plugin read format 3 vaults
• fix: judge a pre-0.14 vault per branch and keep it read-only until trusted
• fix: stop partial secret files, agent diff leaks, prompted overwrites and vague version errors
• fix: keep grant mints from upgrading a vault on a feature branch and say when bb needs a restart

Other

• chore(deps): bump astral-sh/setup-uv from 10.3.0 to 10.3.1
• chore(deps): bump astro in /docs-site in the docs-site-minor-patch group
• chore(deps): bump the codeql-action group with 3 updates
• chore(deps): bump rust-lang/crates-io-auth-action from 1.0.5 to 1.0.6
• chore(deps): bump pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3
• ci: ignore the crypto-bigint timing advisory that murk cannot reach
• ci: keep dependabot from narrowing the bb plugin's murk-secrets range
• ci: drop the crypto-bigint ignore only once a patched version resolves
• chore(deps): bump actions/setup-python from 7.0.0 to 7.1.0
• ci: run every test and build every crate before a release
• chore(deps): bump libc from 0.2.190 to 0.2.191
• chore(deps): bump @astrojs/starlight
• chore(deps): bump libc from 0.2.190 to 0.2.191 in /fuzz
• chore(deps-dev): bump the bb-plugin-minor-patch group
• chore(deps): bump rmcp from 3.5.1 to 3.8.0 in /fuzz
• ci: group dependabot updates so each crate opens one pull request
• chore(deps): bump napi-derive in /
• chore(deps): bump the actions-patch group with 2 updates
• chore(deps): bump napi in /
• chore(deps): bump tokio in /
• chore(deps): bump ureq in /
• chore(deps): bump rmcp in /
• chore(deps-dev): bump the node-minor-patch group across 1 directory with 2 updates
• chore(deps-dev): bump @get-bb/plugin-sdk
• chore(deps): bump astro in /docs-site in the docs-site-minor-patch group
• test: keep the vault-truth check on the per-key read path
• chore: release 0.14.1
• style: format the node binding version test

v0.14.0

[0.14.0] - 2026-10-22

0.14.0 is a security release. It changes how murk decides whether to trust a
vault, and it changes the vault format. Read Upgrade first before you
install it.

Upgrade first

• The vault format is now 3.0, and murk 0.13 can't read it. The first save
  by murk 0.14 rewrites the vault as 3.0, and 0.13 then refuses it as an
  unsupported version. Upgrade every teammate and every CI runner together.
  A 2.x vault still loads in 0.14 and is upgraded on its first 0.14 write.
• On each machine, the first load of an existing vault is refused once.
  Review it (git log -p -- .murk, or murk diff 'HEAD@{1}' after a pull),
  run murk trust, then make the first 0.14 save.
• Give CI the MURK_TRUSTED_SIGNERS variable (see below).
• Run murk setup-merge-driver again in each clone.
• Upgrade guide: teams and
  CI/CD.

Trust

A .murk file lists its own recipients, so a valid signature alone doesn't
tell you whether to trust the person who signed it. murk 0.14 checks every
vault against a trust record kept on your machine, outside the repo.

• Trust is pinned per vault on each machine. On a fresh clone or a new
  laptop, run murk trust once. It shows the vault id, each signer and its
  signing-key fingerprint, and asks you to accept them. When a newly added
  teammate with an age key writes for the first time, each other machine
  refuses that write once. Compare the fingerprint they give you
  (murk trust --print-key) over a channel other than the repo, then run
  murk trust. Teammates on ssh-ed25519 keys skip this step.
• An unsigned vault is refused when your key can sign. Keys that can't
  sign (hardware, plugin and ssh-rsa keys) still load it, with a warning.
• Signatures are verified strictly, and weak signing keys are refused.
• Removing someone is permanent on every machine that sees the removal.
  Their signature is refused on every branch from then on. The only exception
  is their own vault from before the removal, at the commit where this machine
  recorded the removal or an earlier one. Even then, it never makes them
  trusted again.
• A revoke on a branch only takes effect where it is merged. Until then,
  the member is still a recipient on main and on every other branch the
  revoke hasn't reached, and can read any secret added or rotated there.
  Merge the offboarding change into main before you add or rotate secrets
  anywhere else. A --rotate on that branch protects only the values it
  rotated.
• Reviewing an unmerged branch never adds trust. A branch this machine has
  never accepted, such as a PR checked out for review, can only narrow what
  this machine trusts.
• Rollbacks are refused. Each vault carries a save counter. murk refuses
  an older revision on a branch where it has seen a newer one, and it refuses
  a jump of more than 1,000,000 saves until you run murk trust.
• CI uses MURK_TRUSTED_SIGNERS. A runner has no trust record, so list
  the people who write the vault. Each person runs murk trust --print-key
  to get their entry. With the variable set, an unsigned vault is refused for
  every key.

Trust in murk is flat. Every recipient except an agent grant can add or remove
recipients and change values, and murk accepts those changes from anyone you
trust. It checks who made a change, not whether the change was a good one,
so review vault changes like code.

Merges

• The merge driver checks the common ancestor and both sides the way a load
  does. A rollback hidden in a merge is refused, including one that uses
  0.13-era history.
• When both sides re-key a vault, the merge no longer drops the other side's
  value changes.
• The merge driver refuses a side signed by a removed member, and a side that
  adds a removed recipient back. If a removed member wrote to main before
  the removal was merged, merge the branch that removed them, keep its side,
  and make the trusted members' changes again. The SPEC describes the steps
  under "Merging a removal into a branch the removed member wrote to".

Agent grants

• Grants are read-only. A grant key can't write the vault, and murk
  refuses a vault signed by a grant key.
• A grant gets less of the vault. It reads only its own record and the
  values it was granted, not the shared metadata.
• Grant key files carry their own trust. murk agent grant writes the
  trusted signers into the key file, with the grant's name and expiry. A grant
  trusts a vault only if one of those signers signed it. It stops at the
  earlier of the two expiries, the one in its key file and the one in the
  vault.
• Revoking a signer revokes the grants that trust it.
• Grant TTLs are capped at 365 days.
• murk agent exec refuses any key that is not a grant, including your own
  key in MURK_KEY or MURK_KEY_FILE, unless you pass
  --allow-operator-key.

Behaviour changes

• Breaking: export, exec and agent exec refuse to set reserved environment
  names (PATH, LD_*, GIT_*, *_PROXY, MURK_* and others) unless you
  pass --allow-reserved. The MCP murk_exec tool always refuses them.
• Breaking: murk diff --json now prints an object, {"secrets": [...], "changes": [...]}, instead of an array. changes lists recipient, signer,
  policy and grant changes.
• murk diff verifies the revision it compares against, and fails if the
  verification fails.
• murk edit, murk import and other writes refuse new or changed header text
  that contains control characters, bidi controls, zero-width characters or a
  byte-order mark. Text that is already in the vault still loads.
• install.sh installs a release when gh can verify its build provenance.
  When it can't (gh is missing or not logged in), it asks before it installs
  on a terminal and refuses without one. Set MURK_SKIP_ATTESTATION=1 to skip
  the check. A failed verification is always refused.
• Breaking: the Python and Node bindings apply the same trust check as the CLI. A
  refused vault raises murk.TrustError in Python and throws an Error with
  code 'MURK_TRUST' in Node.

Known limits

The threat model lists
what 0.14 doesn't protect against. In short:

• A copied grant key file. Revoking a signer deletes murk's own copy of
  each affected grant key file. A copy somewhere else, such as one handed to
  an agent host, still trusts that signer until the grant expires. A grant key
  passed as a bare key line (which is how murk-action passes it today) has
  none of the key file's trusted-signer, grant-id or expiry lines. It relies
  on MURK_TRUSTED_SIGNERS and on the expiry recorded in the vault.
• Trust is per machine. Each laptop and runner keeps its own record, so
  each one makes its own first trust decision.
• The first murk trust on a fresh clone is trust on first use. murk
  shows you the fingerprints, but you have to check them.
• Five narrower cases:
  • Two vaults that were copied from one 0.13 vault (for example, staging
    copied from prod) share a vault id, so murk's id check can't tell them
    apart. If one vault's file is swapped in for the other's and has a higher
    save counter, murk accepts it, serves its values, and murk verify
    reports it as ok. The file still has to be signed by someone this machine
    trusts for that vault. The merge driver accepts the other vault's content
    whenever a trusted signer signed it.
  • Until a machine sees the vault's first 0.14 save, its merge driver can't
    tell an older 0.13 revision from a newer one. Make the first 0.14 save
    before you merge branches that still carry 0.13 vaults.
  • A crafted unsigned pre-0.14 vault used as a merge ancestor can let a merge
    revert values to an older signed revision. Someone with write access to
    the repo can introduce one without holding a key.
  • The save counter has a hard cap. A vault pushed past it is refused
    everywhere, and a machine that accepted the cap recovers only by deleting
    its trust record and trusting a restored vault again.
  • A machine that learned about a removal late (for example, only from a
    merge) can still read a vault the removed member wrote after their
    removal, if that vault's save counter is not above the removal's and a
    new branch is deliberately placed at an older commit. It can only read it
    there: a save that keeps the member is refused, and the member is not
    trusted again. A vault they wrote with a higher counter is refused
    everywhere.

murk-action

murk-action v1.2.0
supports murk 0.14. Pass the whole grant key file as murk-key, or use its new
trusted-signers input. Anyone on @v1 already gets it.

Security

This release fixes security issues in 0.13 and earlier. Details are in
GHSA-rcxf-7phg-x8w2.
Upgrade every machine and CI runner to 0.14.0.

All changes

Added

• feat: give agent grants their own record and trusted signers instead of the vault meta

Documentation

• docs: describe agent grant records and key-file trust anchors in the spec
• docs: correct factual errors in the spec
• docs: correct factual errors in security.md and suitability page
• docs: correct factual errors in readme
• docs: correct factual errors in concept pages
• docs: describe the grant layout in the concept pages
• docs: correct factual errors in cli help, generated references and the style guide
• docs: correct factual errors in python and node bindings docs
• docs: correct the ai agents and mcp docs
• docs: correct factual errors in guides: hardware keys, git merge and ssh, teams, worktrees
• docs: correct factual errors in ...

v0.13.0

[0.13.0] - 2026-10-20

Documentation

• docs: document governance, roles and the security assurance case
• docs: list the project's repositories and narrow the complete mediation claims
• docs: say grant ttls are enforced at read time
• docs: add agent connect, ci grant and worktree demos
• docs: install from the shared interrupted-sh homebrew tap
• docs: describe crates.io attestation in the threat model

Fixed

• fix: honor DESTDIR and PREFIX in the installer
• fix: sign every release channel and document verification
• fix: include the thread in grant mint hints
• fix: run every bb agent as a murk agent context
• fix!: refuse to run when both key variables are set
• fix: never leave murk edit plaintext on disk
• fix: never forward a child's own early signal back to it
• fix: report an in-repo key file from doctor even with loose permissions
• fix: validate every field of a vault on load
• fix: ignore the unmaintained basic-toml advisory pulled in by age
• fix: resolve the open dependabot and scorecard alerts
• fix: let EDITOR values start with a variable assignment
• fix: upgrade rustls-webpki and webpki-roots for two tls advisories
• fix: harden pin writes and keep the key out of git subprocesses

Other

• test: cover verify, git and recover command paths
• style: apply rustfmt
• style: apply rustfmt
• test: cover secret command paths
• style: apply rustfmt
• style: apply rustfmt
• chore: add spdx headers, a header check and a code review policy
• chore: merge main into the spdx header branch
• chore: cover lint fixtures, demo tapes and new files with spdx headers
• test: cover recipient, supervision and shared command paths
• style: apply rustfmt
• test: signal from a running child, not during startup
• chore: add the spdx header to the recipient tests
• test: drop a rotation case vault validation now refuses at load
• test: drop the source-scanning git spawn invariant in favour of the behavioural test
• chore: release 0.13.0

v0.12.0

[0.12.0] - 2026-10-19

Added

• feat: pre-commit hook for murk scan
• feat: type-aware secret-handling lints via dylint

Changed

• refactor: drop run-dylint.sh for native cargo-dylint discovery
• refactor: clear the code quality backlog

Documentation

• docs: state rustup as the dylint prerequisite, drop shim recipe

Fixed

• fix: harden merge conflict handling, secret redaction, and project hygiene
• fix: bump rustls to 0.23.45 for RUSTSEC-2026-0285
• fix: bump rustls in fuzz/Cargo.lock too
• fix: address dylint lint review feedback
• fix: run UI tests through the toolchain wrapper
• fix: use the renamed rmcp server config type
• fix: upgrade rustls for four tls advisories
• fix!: harden agent exec against secret exposure
• fix: reword a comment the local reference check flagged
• fix: run advisory checks when any crate manifest changes
• fix: fail the auto-merge check when the pr file list can't be read

Other

• style: apply rustfmt
• ci: run the identity-parse fuzz target
• Hash-pin cargo-zigbuild and rustup in node.yaml cross-compile workflow
• build(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3
• build(deps): bump orhun/git-cliff-action from 4.8.0 to 4.9.0
• build(deps): bump rmcp from 3.1.4 to 3.2.0 in /fuzz
• build(deps): bump rmcp from 3.1.4 to 3.2.0
• build(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /integrations/bb
• build(deps-dev): bump better-sqlite3 in /integrations/bb
• build(deps-dev): bump the node-minor-patch group across 1 directory with 2 updates
• build(deps): bump the docs-site-minor-patch group across 1 directory with 3 updates
• build(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0
• build(deps-dev): bump @types/node in /integrations/bb
• build(deps): bump the bb-plugin-minor-patch group across 1 directory with 2 updates
• build(deps-dev): bump vitest from 3.2.7 to 5.0.0 in /integrations/bb
• build(deps): bump svgo from 4.0.2 to 4.1.0 in /docs-site
• build(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 in /node
• build(deps): bump js-yaml from 4.3.1 to 4.3.2 in /docs-site
• build(deps-dev): bump @biomejs/biome
• build(deps): bump ureq from 3.4.0 to 3.4.1
• build(deps): bump ureq from 3.4.0 to 3.4.1 in /fuzz
• build(deps): bump the codeql-action group with 3 updates
• build(deps-dev): bump @types/better-sqlite3 in /integrations/bb
• build(deps): bump astro in /docs-site in the docs-site-minor-patch group
• build(deps): bump the bb-plugin-minor-patch group across 1 directory with 4 updates
• test(connect): kill JSONC/TOML scanner and editor mutation survivors
• style: rustfmt the new connect.rs mutation tests
• build(deps): bump devalue from 5.8.2 to 5.9.2 in /docs-site
• build(deps): bump napi-derive from 3.6.3 to 3.6.7
• build(deps): bump napi from 3.12.2 to 3.12.6
• build(deps): bump ureq from 3.4.1 to 3.4.2 in /fuzz
• build(deps): bump ureq from 3.4.1 to 3.4.2
• build(deps): bump clap from 4.6.6 to 4.6.7 in /fuzz
• build(deps): bump clap_complete from 4.6.9 to 4.6.11 in /fuzz
• build(deps): bump clap_complete from 4.6.9 to 4.6.11
• build(deps): bump @astrojs/starlight
• build(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0
• build(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1
• build(deps): bump codecov/codecov-action from 7.0.0 to 7.1.1
• build(deps): bump docker/build-push-action from 7.3.0 to 7.4.0
• build(deps): bump the bb-plugin-minor-patch group
• build(deps): bump docker/setup-qemu-action from 4.3.0 to 4.4.0
• build(deps-dev): bump the node-minor-patch group in /node with 2 updates
• build(deps): bump rmcp from 3.2.0 to 3.4.0 in /fuzz
• build(deps): bump rand from 0.10.2 to 0.10.3 in /fuzz
• build(deps): bump rand from 0.10.2 to 0.10.3
• build(deps): bump clap from 4.6.6 to 4.6.7
• build(deps-dev): bump @napi-rs/cli
• build(deps): bump the docs-site-minor-patch group
• build(deps): bump the codeql-action group with 3 updates
• build(deps): bump napi-derive from 3.6.7 to 3.6.9
• build(deps): bump orhun/git-cliff-action from 4.9.0 to 4.9.1
• build(deps): bump bip39 from 2.2.2 to 3.0.0
• build(deps-dev): bump the bb-plugin-minor-patch group
• build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0
• build(deps): bump cloudflare/wrangler-action from 4.0.0 to 4.1.2
• build(deps): bump napi from 3.12.6 to 3.13.0
• build(deps): bump undici from 8.10.1 to 8.11.2 in /docs-site
• build(deps): bump bip39 from 2.2.2 to 3.0.0 in /fuzz
• test: satisfy clippy 1.99 assert_is_empty lint
• build(deps): bump cloudflare/wrangler-action from 4.1.2 to 4.1.3
• build(deps): bump zeroize from 1.9.0 to 1.9.1
• build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2
• build(deps): bump libc from 0.2.189 to 0.2.190 in /fuzz
• build(deps): bump libc from 0.2.189 to 0.2.190
• build(deps-dev): bump the node-minor-patch group across 1 directory with 2 updates
• build(deps): bump devalue from 5.9.2 to 5.9.4 in /docs-site
• build(deps): bump zeroize from 1.9.0 to 1.9.1 in /fuzz
• build(deps): bump tokio from 1.53.1 to 1.53.2 in /fuzz
• build(deps): bump napi-derive from 3.6.9 to 3.6.12
• build(deps): bump tokio from 1.53.1 to 1.53.2
• build(deps): bump the docs-site-minor-patch group across 1 directory with 3 updates
• build(deps): bump the codeql-action group across 1 directory with 3 updates
• build(deps-dev): bump source-map-js in /integrations/bb
• build(deps-dev): bump the bb-plugin-minor-patch group across 1 directory with 4 updates
• build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2
• build(deps): bump rmcp from 3.4.0 to 3.5.1 in /fuzz
• build(deps): bump actions/setup-node from 7.0.0 to 7.1.0
• build(deps): bump rmcp from 3.2.0 to 3.5.1
• build(deps): bump serde_json from 1.0.151 to 1.0.154
• build(deps): bump the bb-plugin-minor-patch group across 1 directory with 5 updates
• build(deps): bump sha2 from 0.11.0 to 0.11.1
• build(deps): bump sha2 from 0.11.0 to 0.11.1 in /fuzz
• build(deps): bump tokio from 1.53.2 to 1.53.3 in /fuzz
• build(deps): bump tokio from 1.53.2 to 1.53.3
• build(deps): bump schemars from 1.2.2 to 1.2.3 in /fuzz
• build(deps): bump serde_json from 1.0.151 to 1.0.154 in /fuzz
• build(deps): bump @astrojs/starlight
• build(deps): bump schemars from 1.2.2 to 1.2.3
• ci: move intel mac builds off the retiring macos-14 runner
• ci: pin the rust toolchain and let dependabot bump it
• build(deps): bump ziglang from 0.16.0 to 0.17.0 in /.github/requirements
• build(deps): bump napi-build from 2.5.0 to 2.6.0
• build(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0
• build(deps): bump astral-sh/setup-uv from 10.2.0 to 10.3.0
• build(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0
• build(deps): bump rust-toolchain from 1.99.0 to 1.99.1
• build(deps): bump pyo3 from 0.29.2 to 0.30.1
• build(deps): bump proptest from 1.11.0 to 1.12.0
• build(deps): bump napi from 3.13.0 to 3.14.2
• build(deps): bump the codeql-action group with 3 updates
• ci: publish demo gifs only from release tags
• test: restore the weekly mutation run and cover key file selection
• chore: release 0.12.0
• chore: move references to the interrupted-sh org
• ci: open fix prs for new rustsec advisories automatically
• chore: point package homepages at the docs site

v0.11.0

[0.11.0] - 2026-09-01

Added

• feat: enforce agent grant TTLs and add one-command renewal
• feat: discover vault keys across git worktrees of the same repo
• feat: allow setting an example when creating secrets
• feat: add a write API to the Node binding

Changed

• refactor: split the CLI and vault-core monoliths into cohesive modules

Documentation

• docs: drop the unenforced short-lived claim from agent copy
• docs: document the git worktree workflow
• docs: add a 0.x suitability matrix and release contract
• docs: document delegating-host MCP wiring and an agent allow/ask matrix
• docs: document the Node binding write API on the library bindings page
• docs: cover tier aliases and the self-scope policy opt-in for bindings

Fixed

• fix: wrap key error guidance into short hint lines
• fix: keep worktree paths in one coordinate system on windows

Other

• chore: pin ci build dependencies and refresh the fuzz lockfile
• build(deps): bump pyo3 from 0.29.1 to 0.29.2
• build(deps): bump clap from 4.6.5 to 4.6.6
• build(deps): bump rmcp from 3.1.1 to 3.1.2
• build(deps): bump clap_complete from 4.6.8 to 4.6.9
• build(deps): bump Swatinem/rust-cache from 2.9.1 to 2.9.2
• build(deps): bump ureq from 3.3.0 to 3.4.0
• build(deps): bump constant_time_eq from 0.4.2 to 0.5.0 in /fuzz
• build(deps): sync the root lockfile with constant_time_eq 0.5
• Revert "build(deps): sync the root lockfile with constant_time_eq 0.5"
• Revert "build(deps): bump constant_time_eq from 0.4.2 to 0.5.0 in /fuzz"
• build(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2
• build(deps): stop constant_time_eq bumps that outrun our msrv
• build(deps): bump blake3 from 1.8.5 to 1.8.6
• build(deps): bump clap_mangen from 0.3.1 to 0.3.2
• build: keep the fuzz lockfile in step with the workspace version
• ci: record the toolchain the msrv job actually runs
• ci: note why the msrv job records its toolchain
• build(deps): bump napi from 3.12.0 to 3.12.1
• build(deps): bump napi-derive from 3.6.2 to 3.6.3
• build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0
• chore: fix a lint from the new stable clippy
• build(deps): bump clap_mangen from 0.3.2 to 0.3.3
• build(deps): bump rmcp from 3.1.2 to 3.1.4
• build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1
• build(deps): bump rmcp from 3.1.2 to 3.1.4 in /fuzz
• build(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0
• build(deps): bump the codeql-action group across 1 directory with 3 updates
• ci: fuzz pull requests and persist the fuzz corpus across runs
• build(deps): bump napi from 3.12.1 to 3.12.2
• build(deps): bump blake3 from 1.8.6 to 1.8.7 in /fuzz
• build(deps): bump the codeql-action group with 3 updates
• build(deps): bump blake3 from 1.8.6 to 1.8.7
• build(deps): bump actions/cache/restore from 4.3.0 to 6.1.0
• build(deps): bump actions/cache/save from 4.3.0 to 6.1.0
• chore: release 0.11.0

v0.10.3

[0.10.3] - 2026-08-12

Added

• feat: add an agent demo and fix the grant handoff output

Documentation

• docs: link murk-action's marketplace listing
• docs: regenerate man pages for clap_mangen 0.3.1
• docs: split semicolon clauses into plain sentences
• docs: unpin example versions from the release verification steps
• docs: document required scopes for the automation secrets

Fixed

• fix: include scoped-only keys in recipient-revoke exposure report

Other

• ci: fix npm publish by skipping napi gh-release and add manual dispatch
• ci: fix npm publish and add manual dispatch
• ci: distribute native artifacts into npm dirs before publish
• ci: distribute native artifacts into npm dirs before publish
• ci: publish npm via OIDC trusted publishing, drop bootstrap token
• ci: publish npm via OIDC trusted publishing, drop bootstrap token
• build(deps): bump rmcp from 3.0.0 to 3.1.0
• build(deps): bump napi-build from 2.3.2 to 2.4.0
• build(deps): bump clap from 4.6.4 to 4.6.5
• build(deps): bump actions/setup-node from 6.4.0 to 7.0.0
• build(deps): bump the codeql-action group with 3 updates
• build(deps): bump napi from 3.11.0 to 3.12.0
• build(deps): bump postcss from 8.5.21 to 8.5.25 in /docs-site
• build(deps): update js-yaml in node bindings
• ci: pin build image and toolchain dependencies
• build(deps): bump i18n-embed-fl to drop proc-macro-error2
• ci: make Linux and Windows release builds reproducible
• ci: verify reproducibility across separate build trees
• ci: handle Windows paths in reproducibility check
• ci: align release path remapping with reproducibility check
• ci: fix fuzz target and gate reproducibility check to main
• ci: make the reproducibility check compare two fresh builds
• build(deps): bump js-yaml from 4.3.0 to 4.3.1 in /docs-site
• test: mutation-cover env, export, and agent-connect config generation
• test: mutation-cover agent grant creation and revoke scope
• test: mutation-cover recipients, policy, and merge vault modules
• test: mutation-cover strict-mode and agent gates in hardening
• ci: add manual fuzz-coverage report workflow
• test: mutation-cover secret add, rotate, and group-scoping
• ci: add tracked fuzz seed corpus for the coverage workflow
• test: mutation-cover the plugin decrypt and meta-resolve paths
• build(deps): bump pyo3 from 0.29.0 to 0.29.1
• build(deps): bump napi-derive from 3.6.1 to 3.6.2
• build(deps): bump base64 from 0.23.0 to 0.23.1
• build(deps): bump rmcp from 3.1.0 to 3.1.1
• build(deps): bump the codeql-action group with 3 updates
• build(deps): bump clap_mangen from 0.3.0 to 0.3.1
• chore(deps): bump nanoid in the docs site
• test: cover SSH key rejection and commit-signature paths
• chore: release 0.10.3

v0.10.2

[0.10.2] - 2026-08-04

Other

• build(deps): bump clap from 4.6.2 to 4.6.4
• build(deps): bump clap_complete from 4.6.7 to 4.6.8
• build(deps): bump schemars from 1.2.1 to 1.2.2
• build(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2
• build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4
• build(deps): bump base64 from 0.22.1 to 0.23.0
• build(deps): bump rmcp from 2.2.0 to 3.0.0
• chore: migrate repo and npm scope to interrupted-inc
• ci: build aarch64-unknown-linux-musl target
• ci: grant contents:read to npm publish job
• ci: bootstrap npm publish with token for interrupted-inc scope
• ci: make aarch64-musl cross-compile find zig reliably
• chore: migrate repo and npm scope to interrupted-inc
• chore: bump version to 0.10.2
• chore: release 0.10.2

v0.10.1

[0.10.1] - 2026-07-29

Added

• feat: add agent connect/disconnect to wire murk mcp into AI editors
• feat: expand agent connect editor support

Documentation

• docs: add brand guide, align assets to brand purple, and refine agent positioning

Fixed

• fix: realign napi-derive with napi 3.11 to restore the Node build

Other

• test: assert crypto invariants with property tests and add mutation testing
• test: exercise agent connect/disconnect end-to-end
• build(deps): bump serde_json from 1.0.150 to 1.0.151
• build(deps): bump libc from 0.2.186 to 0.2.189
• build(deps): bump the codeql-action group with 3 updates
• build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1
• build(deps): bump tokio from 1.53.0 to 1.53.1
• build(deps): bump serde from 1.0.228 to 1.0.229
• build(deps): bump napi from 3.10.5 to 3.11.0
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1
• build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0
• build(deps): bump actions/setup-python from 6.3.0 to 7.0.0
• chore: bump version to 0.10.1

v0.10.0

[0.10.0] - 2026-07-24

Added

• feat: enforce signature continuity and surface unanchored signatures

Documentation

• docs: clarify the MAC's role and signing canonicalization
• docs: add documentation site served at murk.interrupted.sh
• docs: correct deprecated command surfaces and target label
• docs: refresh site branding and humanize copy
• docs: highlight murk column in comparison table
• docs: round and tint inline code
• docs: add robots.txt and pages security headers
• docs: unbox inline code inside headings
• docs: add social share image and Open Graph metadata
• docs: add agent workflow demo tapes and gifs
• docs: document the python and node library bindings
• docs: separate the bindings API tables into labelled sections

Fixed

• fix!: rename bindings identity check and add memory disclosure

Other

• build: bump spin and anyhow to clear cargo-deny advisories
• chore: track uv.lock
• build(deps): bump napi-derive from 3.5.9 to 3.5.10
• build(deps): bump napi from 3.10.3 to 3.10.5
• build(deps): bump the codeql-action group with 3 updates
• build(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2
• build(deps): bump clap from 4.6.1 to 4.6.2
• build(deps): bump age from 0.11.3 to 0.12.1
• build(deps): bump EmbarkStudios/cargo-deny-action from 2.0.20 to 2.1.1
• build(deps): bump tokio from 1.52.3 to 1.53.0
• build(deps): bump actions/setup-node from 6.4.0 to 7.0.0
• ci: deploy docs previews on pull requests
• chore: ignore wrangler cache directory
• ci: extend the docs demo pipeline and check guide examples
• chore: keep local-only reference IDs out of committed files
• chore: bump version to 0.10.0

v0.9.1

[0.9.1] - 2026-07-16

Added

• feat: warn when a restored phrase yields a non-recipient identity

Changed

• refactor: reorganize CLI commands into a shared module

Documentation

• docs: align security claims with actual behavior
• docs: regenerate cli reference for restore --vault

Fixed

• fix: build the python extension as an abi3 wheel
• fix: prevent panic on adversarial recipient strings during merge
• fix: hold the init-discovered key in a zeroizing wrapper
• fix: interpolate the entry kind in scoped merge conflict messages

Other

• chore: guard against release version drift
• build(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.2
• chore: generate the CLI reference and guard it against drift
• build(deps): bump rmcp from 2.1.0 to 2.2.0
• build(deps): bump ed25519-dalek from 2.2.0 to 3.0.0
• build(deps): bump the codeql-action group with 3 updates
• ci: verify the python wheel imports on 3.13
• chore: release v0.9.1