Skip to content

Reroute 0.3.1 preview patch

Pre-release
Pre-release

Choose a tag to compare

View all tags
@onedotmint onedotmint released this 23 Oct 12:14
v0.3.1
6753ffd

Reroute 0.3.1 preview patch

A Modal reliability and dependency-security maintenance patch for @onedotmint/reroute. The CLI command remains reroute.

Install / update

Use a security-patched Node.js release satisfying ^22.23.4 || ^24.22.1 || >=26.12.1 and restart Pi after updating its runtime or extensions.

# Recommended: project-local Pi extension
pi install -l npm:@onedotmint/reroute@0.3.1

# Optional standalone CLI for masked setup and diagnostics
npm install -g @onedotmint/reroute@0.3.1

Review and approve project trust, then run /reroute. The standalone CLI does not install the Pi extension or change Pi settings. Do not install the unrelated unscoped reroute package. Updating this npm package does not update the Node process running Pi or existing cloud images.

Changes

  • Accept the narrowly validated Modal Volume mount alias while retaining archive/member/source/artifact symlink checks. Download archives can persist across fresh Sandbox lifetimes.
  • Use a non-login Modal shell so login profiles do not discard image-supplied Rust/toolchain PATH. The image recipe and Daytona provider implementation are unchanged.
  • Update Daytona SDK 0.223.1 → 0.226.0, removing the known vulnerable fast-glob/micromatch/braces chain through upstream's tinyglobby replacement. Update Modal 0.11.0 → 0.11.1, ignore 7.0.12 → 7.0.13 and the compatible transitive Undici patch.
  • Require patched supported Node lines, align doctor checks, pin the development runtime and CI versions, and add dependency/runtime-policy regressions.

The dependency refresh recorded zero known npm vulnerabilities at verification time, 279 verified registry signatures and 95 verified attestations. These are point-in-time findings, not a complete code, host or supply-chain audit.

Exact source and verification

  • Source/tag target: 6753ffd4c25b909c5fc085256f3aba7e1d852c2a on rebuild/0.3-native, not the repository's older main branch.
  • Fresh full CI re-verification: https://github.com/onedotmint/Reroute/actions/runs/39942759623/attempts/2
  • Node 22.23.4 and 24.22.1 each passed strict typecheck/build, 204 tests / 0 failures / 0 skips, real localhost OpenSSH/rsync acceptance, offline CLI smoke, benchmark and clean-prefix package installation.
  • Actual pinned AFT coexistence tests ran; exact-commit Pi Git install/trust/load/remove passed on Node 22 (intentionally only that matrix).
  • Both Node jobs built identical npm tarballs from clean source. The attached Node 22 tarball's SHA-512/SHA-1 and size were independently recomputed and match the prior security candidate and package-verification receipt.
  • Package SHA-1: 85af6cb45b1e0d9c0d6d88fd4aabe6595427936e.
  • Package integrity: sha512-QNrxP68b7DJZmWF7HjUik1XxRj6I6hhwbgkO8qGBg10WS4LXUD3AG90XZ84DLk9nQHpMW22PVFgbcOlaTm/dmw==.

Use the attached COMMIT.txt, package-verification.json, ssh-verification.json and npm-registry-verification.json to check source identity, CI installation and post-publication registry installation. The attached tarball is an alternative to installing from npm.

Preview boundaries

This is a preview patch, not a production reliability, performance or billing certification. Modal default-toolchain and real-repository cold/warm acceptance passed on the preceding SDK tree; Daytona has historical live evidence. The updated SDK tree has full offline/SSH/Pi/package acceptance, but no renewed paid-cloud qualification. SkyPilot/E2B lack live qualification; E2B retains the documented unresolved auto-resume race and task inspection fails closed.

Manual user WSL2/TUI acceptance, broad real-model selection reliability, cross-machine interruptions, live fault recovery, actual billing and broad workload speedup are not certified. Existing npm-shrinkwrap cache-key/bootstrap limitations remain. Cloud operations can cost money, and retained storage/images may continue to incur charges. Review README, DELIVERY and docs/SECURITY-2026-10.md for the complete historical evidence and limits.

npm publication verification

Published publicly as @onedotmint/reroute@0.3.1 with npm latest set to 0.3.1. The registry SHA-512 integrity and SHA-1 match the attached exact-commit CI package. An isolated fresh public-registry install passed --version and CLI smoke; Pi project-local npm install/list/remove and published source-extension loading passed. Registered tools are only reroute_run and reroute_status, with /reroute management and no Bash override. See attached npm-registry-verification.json; no personal Pi configuration or paid cloud resource was used.

Assets 8
Loading