Skip to content

v0.4.0 — See exactly what leaves your machine

Choose a tag to compare

View all tags
@w1ckedxt w1ckedxt released this 08 Jun 17:09
· 22 commits to main since this release
v0.4.0
5f6690f

Trust you can verify, not just read. This release is about proving — not promising — that your code stays yours.

☢ sally roast --dry-run — see exactly what leaves your machine

Before a single byte is sent, Sally shows you the exact payload a real roast would upload:

  • every file with its byte size, a token estimate, and a SHA-256 hash
  • every file that was held back and why — secrets (.env, keys, certs), binaries, oversized files, .gitignore matches
  • a local SHA-256 receipt written to .sally/ so you can verify it byte-for-byte

…and it sends nothing. The MCP sally_roast tool gets the same thing via a preview flag.

sally roast --dry-run ./src/

📇 sally roast --card

A shareable, screenshot-friendly roast card — score, one savage line, two findings, repo URL — saved to .sally/.

🔏 Signed releases

Packages now publish with npm provenance: a public, cryptographic attestation linking each release to the exact source commit and CI build.

📄 Privacy, in engineering detail

New docs/PRIVACY.md: full data-flow diagram, retention table, subprocessors, and log policy. Your code is never written to disk, logs, error traces, or APM — and now you can verify it yourself.

Reviewed and forgotten. Now with a receipt.

Assets 3
Loading