Skip to content

v0.4.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Aug 09:26
· 239 commits to main since this release
v0.4.2
This tag was signed with the committer’s verified signature.
meirka8
SSH Key Fingerprint: oToKgqkDyVREuw1bvYIgdQ2ywcrrn2GH1Rqh01iaEig
Verified
Learn about vigilant mode.
418ebc1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Volute CVC v0.4.2

Volute CVC v0.4.2 is the first public GitHub/Apache-2.0 OSS release of CVC (Cognitive Version Control). CVC keeps explicitly available AI-assisted development context alongside Git history: it uses a repository-local SQLite cache and can project content a user explicitly authorizes to refs/cvc/main.

This is not a claim to capture hidden model reasoning. CVC records only information exposed or supplied by its integrations; it neither retrieves hidden chain-of-thought nor promises a verbatim record of a black-box model's internal reasoning.

Full Changelog

Highlights

  • A public Apache-2.0 source release with release binaries, a VS Code extension, and an npm MCP launcher.
  • Local CVC workflows through cvc, including initialization, status, explicit command recording, local history, linking, and destination-specific sharing controls.
  • The supported VS Code workflow reads GitHub Copilot chat-session files stored locally by VS Code after the repository owner acknowledges local capture. This relies on VS Code/Copilot's locally stored, undocumented format, which may change.
  • cvc-mcp for MCP-compatible clients to submit concise interaction records and read local history. It cannot grant capture acknowledgement, sharing consent, or auto-push consent.
  • CVC Reviewer, a client-side React interface for GitHub-hosted CVC data. Its default local-PAT mode calls GitHub directly from the browser; hosted Reviewer mode is optional.

Included components

  • cvc-core — Rust library for local storage, Git integration, policy enforcement, linking, and sync data structures.
  • cvc-cli — the cvc command-line interface.
  • cvc-mcp — MCP server for explicitly submitted interaction records and local history access.
  • cvc-lsp — language server used by editor integrations.
  • cvc-plugin — VS Code extension for the supported local VS Code chat-session workflow.
  • cvc-reviewer — client-side React reviewer for GitHub-hosted CVC data.
  • @volute_cvc/cvc-mcp — npm launcher for released CVC binaries.

Install

GitHub release assets

Once the full release workflow completes, download an archive and SHA256SUMS.txt from the v0.4.2 GitHub release. Verify the archive against that manifest before extracting it, then put cvc (or cvc.exe) on PATH. Each archive includes cvc, cvc-mcp, and cvc-lsp.

Platform Archive
Linux x86-64 cvc-x86_64-unknown-linux-gnu.tar.gz
macOS x86-64 cvc-x86_64-apple-darwin.tar.gz
macOS ARM64 cvc-aarch64-apple-darwin.tar.gz
Windows x86-64 cvc-x86_64-pc-windows-msvc.zip

Expected additional release assets are LICENSE, THIRD-PARTY-NOTICES.md, install.sh, and install.ps1. Each native archive and VSIX also includes the mechanically generated third-party notice file. The standalone installer assets default to v0.4.2, select the matching supported archive, and verify its checksum; set CVC_RELEASE_VERSION to an explicit valid release tag to override that version. Review a script before running it.

From a Git working tree, get started with:

cvc init
cvc status

To record a command explicitly:

cvc run -- <command> [args...]
cvc log

VS Code Marketplace

After the full release workflow completes, Volute CVC (volute.cvc) is expected to be available from the VS Code Marketplace. The extension supports VS Code ^1.91.0 and uses the platform-specific bundled language server.

npm MCP launcher

After the full release workflow completes, the @volute_cvc/cvc-mcp launcher is expected to be available from npm:

npm install --global @volute_cvc/cvc-mcp@0.4.2

It provides cvc-mcp and cvc, downloads the matching release binary on first use, and verifies it against the release checksum manifest. Its published tarball includes THIRD-PARTY-NOTICES.md; the package stages an exact generated copy only while packing and cleans it afterward. Configure cvc-mcp in your MCP client as documented in the MCP setup guide.

Privacy and sharing

CVC is local-first, not local-only. Captures live under .git/cvc/ and are private by default. Remote publication is a separate, explicit action: sharing and sync can publish selected data through Git, while authentication and component-management commands can also use the network.

Review content before sharing and protect access to the repository and its .git directory. Built-in scrubbing and .thoughtignore are defense in depth, not a guarantee: they can miss credentials, personal data, encoded values, or provider-specific formats. Once published to Git, content may remain in objects, clones, forks, reflogs, caches, and backups. Rotate an exposed credential first; local deletion and tombstones are suppression mechanisms, not guaranteed physical erasure.

Release security and hardening

  • Release tags must exactly match the Rust, VS Code extension, and npm package versions before publishing.
  • Release archives include a SHA-256 manifest; the installer and npm launcher verify the selected archive and reject unsafe redirects or archive members.
  • The workflow pins its GitHub Actions by full immutable Git object SHA, uses scoped job permissions, and will publish GitHub build provenance attestations for workflow assets. After downloading an asset, verify its provenance with GitHub CLI: gh attestation verify <asset> --repo meirka8/volute.
  • npm publishing is configured to use npm trusted publishing.

The same-release SHA-256 checksums are corruption/integrity checks, not independent signatures: because the archive and manifest are both hosted in the same GitHub release, they do not independently protect against a compromised release account. Download only from this repository and review installers before running them.

Upgrade notes

From npm 0.4.1

Upgrade npm users to @volute_cvc/cvc-mcp@>=0.4.2. The npm 0.4.1 package carried UNLICENSED and legacy repository metadata; use >=0.4.2, which declares Apache-2.0 licensing, public npm publish configuration, and public Volute repository metadata. v0.4.2 is the first public GitHub release; do not treat v0.4.1 as a public GitHub release.

VS Code users should also ensure VS Code meets the new ^1.91.0 engine requirement.

Known limitations

  • Linux ARM64 is not released. The shell installer, PowerShell installer, and npm launcher support the same platform matrix and reject unsupported platforms before downloading an asset.
  • Sharing is explicit. Capture acknowledgement, destination sharing consent, conversation sharing, manual publication, and auto-push are distinct consent boundaries. Auto-push is off by default.
  • Hosted Reviewer requires deployment configuration. The default Reviewer mode is local PAT mode. Hosted Reviewer integration works only when a deployment explicitly sets VITE_HOSTED_MODE=true and provides VITE_PLATFORM_API_URL.

Trademarks and affiliation

GitHub, Copilot, and Visual Studio Code are trademarks of their respective owners. Volute is not affiliated with, sponsored by, or endorsed by GitHub, GitHub Copilot, or Visual Studio Code.

Learn more and contribute

Known issue: headless shell installer

In a process with no controlling TTY, install.sh can exit nonzero at its optional PATH prompt after the verified binaries were installed successfully. Interactive installs are unaffected. For unattended installation, use a native archive or the npm launcher, or add the displayed install directory to PATH manually. This is tracked in #16 and will be repaired forward; the signed v0.4.2 tag and assets will not be changed.

Assets 15
Loading