Skip to content

CroCode v0.3.0

Choose a tag to compare

View all tags
@kacigaya kacigaya released this 02 Nov 16:43
· 22 commits to main since this release
v0.3.0
594efa6

Agent fallback

  • Set CROCODE_FALLBACK_AGENT=auto for Claude/Codex fallback in both directions. Both agents must be enabled. Each attempt can switch once; the fallback uses its default model.
  • Keep a fixed fallback by setting an agent name. Fallback remains disabled when unset.
  • Use a dedicated ChatGPT login directory for Codex subscription access. Credential refreshes are serialized and tokens are redacted from review output.
  • Run Codex under gVisor with a pinned Bubblewrap loopback compatibility patch. Filesystem and network isolation remain enabled.

Rebuild the API, worker, and sandbox image before enabling these options. See configuration and sandbox checks.

Validation

  • All 50 Rust tests, including 11 database tests, passed with format and Clippy checks.
  • Web lint, type checks, 33 tests, production build, standalone smoke tests, docs export, and Compose checks passed.
  • PR CI built server and sandbox images on AMD64 and ARM64. Local ARM64 isolation probes and a live Claude-to-Codex review passed.
  • Bubblewrap build tests: one passed; five namespace tests skipped in the build environment. The compatibility patch is proposed upstream.

Existing dependency advisories

The scan checked 807 public package versions. These documented advisories remain:

  • unsafe-libyaml 0.2.11: RUSTSEC-2024-0449, unmaintained. OSV provides no CVE alias, severity, or fixed version.
  • Development lint dependency minimatch 3.1.5 and 10.2.6: GHSA-g3hv-75wg-m249, CVE-2026-118764. Affected range: 0 to before 11.0.1; fixed in 11.0.1. Supplied severity: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N.

The scan excludes container OS packages and dependencies embedded in agent binaries.

Assets 2
Loading