ReproCrate v0.9.0 (CLI and Desktop release candidate quality preview)

ReproCrate v0.9.0 — release quality and security hardening (developer pre-release)

Candidate until the full guarded release workflow and GitHub Releases API verify publication. v0.9.0 is a pre-release preparing for a future stable milestone, not a certified v1.0.0.

Changes

• Literal Markdown metadata: report title, command metadata, failure summary and warnings no longer render untrusted inline Markdown links/images as active URLs. HTML delimiters remain encoded. Fenced stdout/stderr are separate and do not execute.
• Safer CLI report imports: imports reject non-regular files and symbolic links before attempting to read, including named pipes that may otherwise block indefinitely. Opening checks confirm a regular file, enforce the existing 4 MiB budget and on Unix compare the selected file identity with the opened handle.
• Core and CLI regressions: crafted malicious Markdown/HTML metadata tests, symlink/non-regular path tests, and existing privacy behaviors.
• Real CLI smoke tests: a portable Python standard-library harness tests the actual release-built CLI against temporary inert fixtures; verifies version, offline environment summary, log analysis, checksum matches, checksum tampering and no-overwrite behavior.
• Stronger release gating: published-archive SHA-256 is verified by the just-built CLI before uploading; a separate strict GitHub Releases manifest validator requires exactly six nonempty CLI/desktop archives and six size-bounded uploaded sidecars with expected platform names and a draft prerelease target.
• QA evidence: an explicit cross-platform release-candidate checklist separates CI-evidenced verification from unperformed clean-machine GUI, accessibility, signing, license and supply-chain checks.
• Synced Rust workspace, desktop/Tauri, npm package and corresponding lockfiles to v0.9.0, preserving the previous report schema and all offline CLI/desktop capabilities.

Limitations

No sandboxing of intentionally captured commands, no guarantee that masking detects every secret, no third-party tracker upload, no signed installers/notarization, and no clean-machine GUI QA certification. A successful SHA-256 match is integrity only, not authentication or malware scanning. GitHub Pages requires repository-level enablement and must be independently verified before claiming a live site.

The generated RC test matrix is documented in QA checklist. See security policy, distribution, and handoff.

Release requirements

Run complete Rust tests/Clippy/rustfmt and locked dependency inventory validation. Build and smoke-test actual CLI binaries plus compile/test real desktop executables on Ubuntu Linux x86-64, Windows x86-64 and macOS ARM64. Stage unsigned native archives and SHA-256 sidecars, verify package digests, require exactly 12 uploaded assets in the GitHub Releases API, and only then change the release from draft to public pre-release.

ReproCrate v0.8.0 (CLI and Desktop distribution and integrity pre-release)

ReproCrate v0.8.0 — distribution and integrity (developer pre-release)

Candidate until the gated release workflow completes and GitHub Releases confirms publication. This is not a stable v1.0.0 release and does not provide signed installers.

What's new

• Offline SHA-256 verification in the Rust core and CLI using reprocrate verify-download ARCHIVE --checksum ARCHIVE.sha256. The verifier streams archives instead of loading them entirely, refuses symlinks/nonregular files, enforces exact filenames, accepts only a single strict checksum record and fails on corruption.
• Static documentation website in site/ with responsive design, keyboard skip link, no runtime JavaScript, restrictive CSP and no third-party CDN or hosted font requirements.
• GitHub Pages delivery workflow, isolated from CLI/desktop features. Deployment requires Pages to be enabled for the repository; a workflow file alone is not proof of live site availability.
• Dependency inventory generator using only the Python standard library to enumerate locked Cargo and npm packages without declaring unknown licenses. Includes deterministic tests and machine-readable CI artifact.
• Weekly/manual advisory workflows to check both Rust lockfiles against RustSec and the npm desktop lockfile against npm advisories. Failing scans require review; no vulnerability-free or license-compliance claims.
• Cross-platform distribution reference and verified download procedures with real-world limitations about unsigned preview binaries, code signing and OS dependencies.
• Preserves local-only CLI and desktop behavior, previous report schema and existing v0.7.0 commands.

Security limits

Checksum equality is integrity only: sidecars are not signed, and matching bytes do not prove trusted origin. A dependency inventory is not a verified SBOM, vulnerability scan or license clearance. Scans can miss future or unpublished issues. Web documentation being published does not cause the desktop/CLI to send telemetry or diagnostic data online.

Release gate

Publish genuine unsigned CLI/desktop artifacts for Linux x86-64, Windows x86-64 and macOS ARM64 only if all three-OS build-upload jobs, validation and the final publication checks pass, and every archive has its own SHA-256 file. Confirm the non-draft, pre-release status and all 12 real assets via GitHub Releases API before advertising publication.

See the download verifier, distribution guide, dependency audits, security policy and handoff.

ReproCrate v0.7.0 (CLI and Desktop offline issue-drafts pre-release)

ReproCrate v0.7.0 — offline issue drafts (developer pre-release)

Candidate until cross-platform release workflow and GitHub Releases API confirm publication. This is not a stable v1.0.0 release.

The v0.7.0 milestone adds privacy-first local issue drafting across CLI and desktop using the same tested Rust core, preserving the existing report schema and previous CLI workflows.

New in v0.7.0

• Offline issue adapters: GitHub, GitLab, Gitea and generic Markdown formats. No network client, authentication or automatic issue submission.
• Private by default: generated drafts omit report title, captured commands/arguments, raw stdout/stderr, paths and finding messages. Only a structural execution status and truncation indicators are included.
• Explicit review approval: optionally include shortened masked title, OS/architecture and a capped list of heuristic failure categories; opt-ins require --acknowledge-reviewed.
• CLI: reprocrate issue export --report reviewed.json --target github --output issue.md with no-overwrite output and private Unix permissions.
• Desktop: dedicated issue drafting screen with optional disclosures, user consent, complete Markdown preview and explicit save-new action.
• Shared Rust core: schema-validated, size-capped Markdown rendering and regression tests for secret omission, unsafe markup and review gates.
• Release gates: release only after Rust workspace verification and authentic native CLI+desktop binary builds on Windows x86-64, Linux x86-64, macOS ARM64, each with SHA-256 file.

Important limits

Issue drafts are manual templates and may require editing. Metadata options can still reveal sensitive information; pattern redaction is not proof of complete sanitization. This milestone does not create a GitHub/GitLab/Gitea issue, contact servers, perform automatic reproduction, provide signed installers or certify clean-machine GUI compatibility. All imported content remains inert.

See issue exporter reference, security policy and current handoff.

ReproCrate v0.6.1 (CLI and Desktop maintenance pre-release)

ReproCrate v0.6.1 — privacy and history maintenance pre-release

Experimental maintenance release; not stable v1.0.0. Release publication is gated on validated Rust CLI and native desktop builds on Linux, Windows and macOS. Packages are unsigned developer-preview archives with SHA-256 files, not installers.

This patch preserves CLI compatibility and report schema 1.0.0. It adds no automatic uploads, filesystem scanning, recipe execution, account features or network integrations.

Fixes

• Safer reviewed-report exports: on Unix, newly created reviewed JSON files request owner-only 0600 permissions, independent of a permissive process umask. Exports continue to refuse overwrite and delete a failed partial write.
• Safer desktop file imports: the native reader verifies the opened handle is a regular file; on Unix it additionally compares the originally selected file's inode and device with the opened handle to reject common path-swap races.
• History database schema protection: an existing SQLite database with an unsupported future user_version is rejected rather than silently reset to v1.
• Stable history paths: explicitly indexed report paths are canonicalized after report validation, avoiding duplicate entries for equivalent relative paths and entries tied to a process working directory.
• Regression coverage: protect review no-overwrite and Unix permissions, and ensure that higher-version history databases remain unchanged.

Privacy and limitations

Manual review remains essential. Exports may include sensitive data that generic redaction does not detect; paths and history metadata may also be private. Owner-only mode applies to Unix only; Windows access control depends on local system settings. Checking the opened file does not eliminate every concurrent filesystem race. SQLite deletion cannot guarantee removal from backups or snapshots. A command intentionally captured by the CLI is not sandboxed.

Distribution

The gated v0.6.1 workflow is expected to create three genuine unsigned CLI archives and three genuine unsigned desktop archives, one of each for Linux x86-64, Windows x86-64, and macOS ARM64, plus individual SHA-256 checksums. Publication must not be claimed until the workflow passes and the GitHub Releases API confirms the assets.

See security boundaries, history guide, desktop guide, and change handoff.

ReproCrate v0.6.0 (CLI pre-release)

ReproCrate v0.6.0 — local report history developer pre-release candidate

Status: development candidate. Do not claim this version is publicly published until GitHub Actions and GitHub Releases API confirm all required artifacts.

This milestone builds on v0.5.0's Tauri 2 + React desktop. The existing Rust CLI, secure diagnostic bundles and privacy-conscious report comparisons remain available.

New capability

• Explicit report indexing: opt-in local SQLite database for selected, schema-validated report paths and limited metadata.
• Search: case-insensitive title/OS/architecture query with SQL parameters, strict query and result caps.
• Inspect from history: opens the selected original path via the previous read-only inspector.
• Forget index: deletes the SQLite row only, not the original diagnostic report. Re-indexing updates the row without creating a duplicate.
• Privacy: no automatic indexing, raw logs, raw command arguments, credentials, uploads, accounts or imported-command execution through this feature.
• Cross-platform validation: isolated database tests, React production build and native desktop IPC compilation on Windows/Linux/macOS must pass before publication.

Important limits

Local SQLite metadata includes complete file paths, which may themselves contain sensitive information. Titles and identifiers receive only best-effort sanitization; data deletion cannot guarantee erasure from snapshots and backups. The desktop currently accepts manually entered paths rather than a native picker and unsigned executables are developer previews, not signed installers.

See history documentation and the current handoff.

ReproCrate v0.5.0 (CLI pre-release)

ReproCrate v0.5.0 — desktop foundation developer pre-release

Status: Candidate until GitHub release publication is confirmed; not stable v1.0.0.

This milestone adds a native-desktop Tauri 2 / React foundation over the Rust core, keeping the previous Rust CLI working.

Desktop workflows

• Native report inspection with bounded, inert import.
• Privacy-preserving structural comparison of existing reports.
• Heuristic log inspection of a bounded local file.
• Non-executable reproduction checklist generation.
• Local privacy-review preview with optional exclusions and manual literal masks.
• New-file-only reviewed JSON export; existing files are never replaced deliberately.
• A responsive desktop workspace with explicit read-only mode in a normal browser.

Build and security model

Desktop frontend and Rust platform checks live in GitHub Actions. Npm dependencies and the separate Tauri Rust workspace are locked; native app icons are generated from a repository-owned SVG. No filesystem or shell plugins, remote URLs, telemetry, authentication, or automatic uploads are requested by the desktop bridge.

The original CLI continues to be tested independently on Linux, macOS and Windows. Review inputs before sharing. Best-effort redaction may miss sensitive content; structural comparison and recipe steps do not prove a bug was reproduced. The first desktop bridge does not support executing commands from imported files.

Known limitations

This is a desktop foundation. No claim is made of signed installers, automatic updater, GUI-assisted file picker, database history, complete cross-platform visual testing, safe host sandbox, or stable release. Platform-specific native binary availability is determined by completed release artifacts, not inferred from source code.

See Desktop guide, Security policy, and development handoff.

ReproCrate v0.4.0 (CLI pre-release)

ReproCrate v0.4.0 — experimental CLI pre-release

This version builds on published v0.3.0's review tools and integrity-checked diagnostic bundles.

Features

• reprocrate compare baseline.json candidate.json --output comparison.json [--markdown comparison.md]: deterministic privacy-minimizing structural report comparison, explicit redacted/missing/incomplete states and heuristic fingerprint differences where both analyses are complete.
• reprocrate recipe create --report reviewed.json --output recipe.json [--markdown recipe.md]: versioned, inert manual reproduction guide without command details by default.
• Optional command reference requires --include-command --acknowledge-reviewed; reviewed fields receive best-effort masking and still require manual verification.
• reprocrate recipe inspect recipe.json: bounded inert schema and step validation.
• Rust unit and CLI integration coverage for field changes, suppressed raw values, redacted/truncated unknowns, recipe opt-in, non-executability and no-overwrite behavior.
• Continued Windows/Linux/macOS CI and guarded release archive/checksum publishing.

Limitations

ReproCrate never executes imported recipes or automatically uploads diagnostics. Structural comparison does not prove a root cause, while fingerprint grouping can collide. Best-effort redaction is not proof of confidentiality. Command capture remains unsandboxed. The desktop GUI, report history and stable v1.0.0 are future milestones.

See report comparisons and reproduction recipes.

ReproCrate v0.3.0 (CLI pre-release)

ReproCrate v0.3.0 — experimental pre-release notes

This milestone expands privacy controls and portable local diagnostic bundles. It is not stable v1.0.0.

Added

• reprocrate review: explicitly preview a report's JSON, mask project-specific literal strings from a private file, exclude selected fields, and save a new candidate without modifying the original.
• reprocrate bundle create: require acknowledgment of manual review and individually selected attachments; create bounded local ZIP bundles with versioned manifests and SHA-256 integrity checks.
• reprocrate bundle inspect / verify: reject inconsistent, oversized, traversal, duplicate, symlink, unsupported-schema, or altered archives.
• reprocrate bundle extract: verify everything before extraction; use a new output directory and only fixed safe archive paths.
• Cross-platform integration tests for review, archive verification, extraction and rejection behavior.

Important limitations

Pattern-based redaction cannot certify privacy. Attachments are included verbatim once explicitly approved and may contain sensitive data. SHA-256 checksums authenticate bytes against the included manifest, not an external trusted publisher. Imported recipes/commands stay inert and should be considered untrusted. The tool never uploads diagnostics automatically.

No desktop GUI, database history, full reproduction sandbox, complete test framework parsers, or stable v1.0.0 quality claim. See privacy and bundles.

ReproCrate v0.2.0 (CLI pre-release)

ReproCrate v0.2.0 — experimental CLI pre-release

This release extends the original Rust CLI; it is not stable v1.0.0.

Changes

• New inert reprocrate analyze command for bounded textual log imports, including stdin (-), JSON export and readable Markdown output.
• Generic heuristics plus initial Cargo, pytest, Jest and Vitest log format recognition. These are preliminary adapters, not complete parsers of every framework's output.
• Stable deterministic, non-cryptographic FNV-1a 64-bit failure fingerprints with conservative grouping and occurrence counts.
• Captured JSON/Markdown reports now include optional sanitized failure observations without changing the existing report schema version; old reports can still be inspected.
• Fixed input bounds, truncation indicators, no-overwrite output behavior, and regression fixtures for the four named frameworks.

Example

reprocrate analyze build.log --output findings.json --markdown findings.md
reprocrate capture --output failure.json -- cargo test
reprocrate inspect failure.json

Privacy and security

Local-first; no implicit shell or network upload. Command capture is not sandboxed; log import never executes the log. Redaction is best-effort, not a guarantee; inspect the full export before sharing. Fingerprints are grouping aids, not cryptographic integrity hashes or proven root causes.

Known omissions

No desktop GUI, JUnit XML parser, fully featured test adapters, report comparison, portable bundles, automated reproduction, controlled process-tree cancellation, code signing or installers. Dependency-license review and security hardening are ongoing.

Packages are portable CLI archives for the platforms actually built by release CI, accompanied by .sha256 files. Do not assume the release exists until GitHub marks it published.

ReproCrate v0.1.0 (CLI pre-release)

ReproCrate v0.1.0 — pre-release

This is an experimental CLI-only milestone, not the stable v1.0.0 release.

Features

• Explicit command execution without an implicit shell.
• Output retention caps per stream, timeout/exit status and high-level environment metadata.
• Local JSON/Markdown reports using versioned schema 1.0.0.
• Basic redaction of common secret formats and inert JSON report inspection.
• Initial Rust integration tests and documentation.

Usage

reprocrate doctor
reprocrate capture --output failure.json --markdown failure.md -- cargo test
reprocrate inspect failure.json

Capture executes the command on your actual host. It is not a sandbox. Generated reports may still contain secrets and private information. Review complete exports before sharing.

Known limitations

No desktop app, safe ZIP bundles, full process-tree termination, comprehensive redaction, comparison engine, signed installers, notarization, or guarantee of bug reproducibility. stderr/stdout are converted using lossy UTF-8 and truncated at configured limits. inspect accepts only the current schema version and at most 4 MiB. License compatibility of third-party components is under ongoing review; third parties retain their licenses.

Install

Download the archive matching the release's actual platform/architecture, extract, and run reprocrate --help. There are no elevated installers or automatic network access. Platform checksums accompany each archive as .sha256. You can also build from source with stable Rust 1.82+ using cargo build --release -p reprocrate-cli --locked.

Issue reports: https://github.com/sanskarIN/ReproCrate/issues

License: Eclipse Public License 2.0 (see LICENSE).