v0.4.0

Changelog v0.4.0

All notable changes to kprun are documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[0.4.0] - 2026-07-08

Added

• Core utility function vault_id extracts a stable, non-identifying digest
  from the vault database path. Used internally for audit logging and OS
  keyring account naming.

Security

• Audit log no longer records the vault path. The db field (full resolved
  path, which embedded the OS username on default installs) is replaced by
  db_id — the first 16 hex chars of the SHA-256 of the canonicalized db
  path, the same digest the OS keyring account name uses. Migration:
  consumers parsing db must switch to db_id. Lines written by older
  versions are left untouched; rotate or delete old logs if the embedded
  path matters to you.
• Hardened MCP transport and Windows ACL enforcement to prevent unauthorized
  access to the vault via side-channel attacks.

---

Full commit list

• fix(security): harden audit log, MCP transport, and Windows ACLs
• fix(security): log non-identifying db_id instead of vault path
• feat(core): extract shared vault_id derivation from db path
• docs: enumerate audit record fields; note db_id migration