Skip to content

apassy 0.2.0

Choose a tag to compare

View all tags
@wydrox wydrox released this 28 Sep 12:17
· 329 commits to main since this release
v0.2.0
b26b10a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Apassy 0.2.0 — the first public release. Agents get access. Never your secrets.

Apassy

Download: the signed and notarized Apassy.dmg is published at apassy.wyderka.cc by the release workflow (macOS 15 or later, Apple silicon). Until the release signing is configured, the site says "Coming soon" and you can build it from source.

The first public release: a signed app for macOS, a website, and everything since the alpha.

Added

  • Download. A signed and notarized Apassy.dmg at apassy.wyderka.cc. Each push to main that passes CI publishes a new build (release).
  • App icon. The Apassy mark in the Dock, on notifications, and on the Touch ID prompt.
  • New desktop interface. A sidebar with Credentials, Agents, Activity, Learning, and Settings. Each credential has a history and can be archived (ADR 0011).
  • Placeholders. A variable can hold a placeholder instead of the value. The run then goes through a proxy of Apassy, which puts the real value into HTTPS requests to the hosts of that credential only. On macOS, the process can connect only to that proxy (ADR 0011).
  • Access requests. An agent can see the names of all credentials, without values, and ask you for access. One grant can cover several credentials, in one folder or in any folder (ADR 0012).
  • Base model. The bouncer uses apassy-base-v1, a local Laya model with decision heads trained on synthetic commands. It starts at login (base model).
  • Learning. A decision log, "Approve and remember" patterns, threshold calibration, and a Learning view with the ask rate of the last 14 days. A local fine-tune runs in shadow mode before it can replace the model (learning).
  • Rule packs. 64 packs describe tools as data: migrations and ORMs, clouds and platforms, databases, containers, Kubernetes, Terraform, and secret managers. A local pack can only add restrictions (rule packs).
  • Declarations. Each credential can say its project, environment, risk, scope, and whether its actions can be undone. Apassy suggests a declaration and knows the hosts of common providers (declarations).
  • Host hooks. apassy-hook gives the bouncer the real request of the user in Claude Code and Codex, and checks it against the transcript (host hooks).
  • Owner checks and notifications. Each owner action needs a fresh Touch ID or passphrase check. Notifications come from ApassyNotify.app, and the inbox keeps each event (native app, notifications).
  • Agent isolation. apassy-sandbox starts Claude Code and Codex in a Seatbelt profile. The profile denies the vault, the backups, the model, the app bundle, and the ways to start a program outside the sandbox (isolation).
  • Vault lifecycle. Passphrase change, agent token expiry and rotation, a settings review after a restore, and migration from each earlier schema.

Changed

  • A run with a production credential always waits for you.
  • The bouncer policy is v7. On the blind held-out set v4 (226 cases, 3 runs), no violation and no critical case ran without the owner, and 91 of 120 normal cases (76%) ran without a prompt (held-out v4).

Security

  • Key memory hardening: secrets and tokens are zeroized, SQLCipher memory security is on, core dumps are off, and each program has the hardened runtime without debug or injection entitlements (key-memory review).
  • rustls 0.23.45 for RUSTSEC-2026-0285, and cargo audit in CI.

Full changelog: CHANGELOG.md · apassy.wyderka.cc/changelog

Assets 2
Loading