codex-sync-kit v0.1.7

Security hardening release after repository security scan and targeted pentest.

Fixes:

• Reject restore targets that are symlinks, hardlinks, non-regular files, or path escapes before applying a snapshot.
• Always push vault commits explicitly to origin HEAD:main instead of any existing branch upstream.
• Redact GitHub fine-grained PAT values and pat-style keys in config.toml snapshots.
• Block top-level obvious secret filenames such as .env, token.txt, secret.txt, and password.txt even in risky/full mode.
• Install from pinned release tag v0.1.7 by default and support optional SHA256 archive verification.

Security validation included pytest, ruff, bandit, pip-audit, installer dry-run, direct redaction/blocklist harnesses, Windows hardlink restore harness, plugin validation, and Codex Security report generation.

Codex Sync Kit v0.1.6

TOML redaction correctness patch. Preserves quoted path and plugin keys while recursively redacting secret values, keeping sanitized config.toml parseable for restore. Includes all v0.1.5 hardening: symlink/path-boundary enforcement, stronger secret filename blocking, configured-vault remote validation, manifest-checked restore, safer plugin prompts, private-vault validation, and automatic Codex plugin registration.

Codex Sync Kit v0.1.5

Security-hardened Windows release. Adds recursive TOML secret redaction, stronger secret filename blocking, symlink and path-boundary enforcement, configured-vault remote validation, manifest-checked restore, safer plugin prompts, robust first-push handling for empty private vault repositories, automatic local Git identity setup for vault commits, and automatic Codex plugin registration in the installer.

Codex Sync Kit v0.1.4

First practical Windows release. Adds robust first-push handling for empty private vault repositories, automatic local Git identity setup for vault commits, automatic Codex plugin registration in the installer, private-vault validation, safe/full/custom scan profiles, private GitHub vault support, restore flow, and Codex plugin/skill integration.

Codex Sync Kit v0.1.3

First practical Windows release. Adds automatic local Git identity setup for private vault commits, automatic Codex plugin registration in the installer, private-vault validation, safe/full/custom scan profiles, private GitHub vault support, restore flow, and Codex plugin/skill integration.

Codex Sync Kit v0.1.2

Security patch for the first practical release. Existing GitHub vault repositories are now rejected unless they are private. Includes the Windows installer, automatic Codex plugin registration, safe/full/custom scan profiles, private GitHub vault support, restore flow, and Codex plugin/skill integration.

Codex Sync Kit v0.1.1

Patch release for the Windows 1-click path. The installer now registers the Codex plugin automatically after installing the CLI and plugin source. Includes the codex-sync CLI, safe/full/custom scan profiles, private GitHub vault support, restore flow, Codex plugin/skill integration, and PowerShell installer.

Codex Sync Kit v0.1.0

Initial Windows-first release. Includes the codex-sync CLI, safe/full/custom scan profiles, private GitHub vault support, restore flow, Codex plugin/skill integration, and a PowerShell installer.