Skip to content

v0.1.2

Choose a tag to compare

View all tags
@longevityboris longevityboris released this 12 May 01:18
· 6 commits to main since this release
v0.1.2
c3292fb

Tightening pass on the v0.1.1 adversarial review.

Real fixes (Codex pass 2)

  • push redactor was matching the formatted stdin payload, not the raw value. Fly's NAME=secret\n and Vercel's secret\n would not match if the upstream printed secret bare in an error. Redactor is now built from raw value (plus NAME=VALUE for fly).
  • vercel env add becomes interactive when the env var exists. Always passes --force now.
  • Keychain error mapping is status-aware. Only errSecItemNotFound maps to exit 6; other Security framework failures stay Internal.

Audit + tests

  • Each run/push records a run_id so paired started/ok entries are unambiguous under concurrency.
  • Honest atomicity comment in audit.rs (PIPE_BUF is for pipes, not regular files).
  • Test run_writes_started_audit_entry_before_child_exits now uses a long-lived child + mid-flight inspection; the redactor test asserts the redaction token appears too.

Known limitations (deferred)

  • SIGINT forwarding to child for kill -INT akm-pid. Ctrl-C already works via shared process group.
  • ANSI-coloured / encoded secret forms in child output (literal match only).
  • security dump-keychain enumeration → ItemSearchOptions migration (0.2.0).

Tests: 12 unit + 16 integration.

Assets 2
Loading