Skip to content

Clockwork v0.5.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Sep 23:37
· 2 commits to main since this release
v0.5.0
5a7f9a8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Clockwork v0.5.0

The day after launch, four public claims did not match the code. Each is now wired, tested, and proven against Claude Code CLI 2.1.261 through the production runner. Records: ADR-034 and ADR-035 in decisions/DECISIONS.md; matrix in spikes/reports/T007-engine-contract-matrix-2.1.261.md.

What changed

  • Approvals hold. A gated tool call pauses the run and waits for you, for the run's remaining wall-clock budget, then fails safe. Before 0.5.0 this never fired on a real engine.
  • Every engine runs inside the macOS Seatbelt sandbox (Claude, Codex, OpenCode, Hermes, and the BYOK agent's shell): writes only to the worktree, scratch and tool caches; credential paths unreadable. CW_SANDBOX=off is the only escape and is logged, journaled, and stamped on the report. Before 0.5.0 the profile existed but nothing applied it.
  • The policy floor sees every Bash call. A fail-closed PreToolUse hook refuses deny-list floor hits (force-push to a protected branch, package publishing) in every permission mode, ~60 ms per call. It also pins disableAllHooks: false, so a repo's own settings cannot switch it off.
  • Interrupted runs keep their worktree. A timeout or cancel mid-rebase preserves the working state; the report says what was kept and why.
  • BYOK credentials travel over the daemon⇄runner stdin channel, never the environment (a process's exec-time env is readable via sysctl by any same-user process).
  • Codex runs with its own sandbox off while Clockwork's is on (macOS will not nest two Seatbelts). Hermes's working directory is pinned to the worktree. Tool caches are redirected under ~/.clockwork/cache for npm, pnpm, yarn, pip, cargo, go, gem, bundle, uv, poetry, gradle, composer and nuget.

Known limits (documented in docs/security.md)

Repo-declared MCP servers that run shell are not matched by the Bash-only hook; the loopback permission bridge has no per-run bearer token yet; runs inherit HOME, so your own Claude Code allow rules and session hooks apply unattended; BYOK configs that read the key from an env var keep it in the daemon's exec-time env (keychain-backed configs are fully closed); network is allowed inside the profile for every engine.

Verify before installing

shasum -a 256 -c checksums-sha256.txt

Clockwork_aarch64.dmg is the same file as Clockwork_0.5.0_aarch64.dmg under a stable name (used by the landing page's "latest" link).

Install

  1. Download the DMG (Apple Silicon, macOS 14+), open it, drag Clockwork to Applications.
  2. Run the daemon from this tag: git clone https://github.com/vimoxshah/clockwork && cd clockwork && git checkout v0.5.0 && pnpm install && pnpm build && node packages/daemon/dist/main.js (Node 22+; needs one provider CLI: claude, codex, opencode or hermes).
  3. Pair the app with the daemon using ~/.clockwork/api-token.

Signature status

This build is unsigned (ad hoc). macOS will ask you to confirm the app under System Settings → Privacy & Security on first launch. Homebrew (brew tap vimoxshah/clockwork && brew install --cask clockwork) verifies the checksum for you.

Assets 5
Loading