Skip to content

v1.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Oct 20:46
· 24 commits to main since this release
v1.0.0
d4b1e48
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The first stable release: the .cloudpin.yml format is stable from here on (later versions only add sections and
keys), and every agent hook except Gemini CLI's is tested inside the real agent.

Fixed

  • Variables an agent sets earlier in its command line now count (#86). export AWS_PROFILE=other; aws ... and
    PowerShell $env:AWS_PROFILE = 'other'; aws ... were checked against the default account and ran on another; and
    GH_TOKEN=$(cat other.token) gh ... read the token as empty. cloudpin now follows export, unset and $env:
    through the line, and stops a command whose account depends on a value only known when it runs, saying why. Found
    in the threat-model review.
  • Cursor: a command on your Cursor allowlist runs again when the account matches (#2). cloudpin answered ask, which
    stopped even allowlisted commands; it now answers allow, which Cursor treats exactly like having no hook (measured
    in Cursor CLI 2026.10.01: commands not on the allowlist still need your approval). Wrong accounts are still blocked.

Added

  • Antigravity hooks (#80): cloudpin install-hook antigravity guards Antigravity CLI, the IDE and Antigravity 2.0
    (.agents/hooks.json, or ~/.gemini/config/hooks.json with --user). Google replaced Gemini CLI with Antigravity
    CLI for free and consumer accounts on 2026-06-18. The hook checks run_command and text typed into a running
    terminal; it asks rather than allows when nothing is wrong, so Antigravity's own approvals still apply.
  • The Copilot CLI and Antigravity CLI hooks are tested inside the real agents (#3): a wrong pin blocks the command, a
    right one lets it run, and Antigravity's own approval still applies to commands you haven't allowed.

Verify this release

cloudpin-1.0.0.tgz is the exact file npm serves (npm packs reproducibly), built and signed by this repository's
release workflow. To check a download:

gh attestation verify cloudpin-1.0.0.tgz --repo paureis/cloudpin   # signed build provenance
sha256sum -c SHA256SUMS                                            # checksum
npm view cloudpin@1.0.0 dist.integrity                             # npm's sha512 for the same file
Assets 5
Loading