v0.1.1

Declawd v0.1.1 is a patch release for the bare output-path defect in v0.1.0.

Install from crates.io:

cargo install declawd --version 0.1.1 --locked

Changes:

• Bare filenames such as --output cleaned.txt now work. All four output-parent checks use the current directory when Path::parent() returns an empty path.
• Regression coverage now includes bare text and C2PA outputs and canonical input/output aliases.
• The UTF-16 wording now states the detectable boundary precisely: UTF-16 with a BOM is refused; BOM-less NUL-bearing valid UTF-8 is not guessed.
• Release assets now include a reproducible CycloneDX 1.5 SBOM and checksum. Both are included in GitHub build-provenance attestations.

The v0.1.0 binaries remain immutable. Their safe workaround is to write ./cleaned.txt or an absolute path; affected commands fail closed with exit 2 and do not write output.

The C2PA and Unicode contracts are unchanged. See the README for checksum, attestation and SBOM verification commands.

Full Changelog: v0.1.0...v0.1.1

Declawd v0.1.0

Declawd v0.1.0 publishes the frozen declawd-v1 educational watermark reference, its Python implementation and reproducibility vectors, plus an inspect-first Rust CLI.

Known issue: v0.1.0 rejects a bare output filename such as --output cleaned.txt with exit code 2. No output is created and the input is untouched. Use --output ./cleaned.txt or an absolute or directory-qualified path. This is corrected in v0.1.1.

The CLI can:

• inspect an explicit, versioned registry of Unicode structures;
• remove or replace only code points selected by the user; and
• remove an embedded C2PA/JUMBF store from PNG or JPEG while verifying that bytes outside the carrier are unchanged.

This project does not detect or remove Claude's undisclosed text watermark. Unicode findings do not prove AI involvement, and their absence does not prove human authorship. Statistical token-choice and pixel-level marks are not tested.

Release archives include SHA-256 checksums and GitHub build-provenance attestations. The macOS and Windows binaries are not platform code-signed or notarised; see the README for verification commands and build-from-source guidance.

The C2PA dependency's Rust-native backend currently includes rsa 0.9.10. The documented RUSTSEC-2023-0071 exception is limited to unused private-key operations and expires on 12 September 2026.