v0.3.1

Changelog

• 794b56c: errors: show kdbx's own message after the kind (#27) (@nabsha)
• e78ec07: release: prepare v0.3.1 (self-explaining error lines) (#28) (@nabsha)

v0.3.0

Changelog

• 97bb0ee: ci: mcp-publish is dispatch-only; the release trigger could never fire (#23) (@nabsha)
• 79cdff8: init: bootstrap a project with --here, or wherever no pointer exists (#24) (@nabsha)
• 34a92bf: init: confirm before using a parent directory's pointer (#25) (@nabsha)
• ffcacb2: release: prepare v0.3.0 (#26) (@nabsha)

v0.2.1

Changelog

• 0e31c56: ci: drop the version field from the OCI registry package (#21) (@nabsha)
• 94e3fb8: ci: fix MCP registry publishing, make its failures loud and retryable (#20) (@nabsha)
• c6a2fb5: release: prepare v0.2.1 (MCP registry image label) (#22) (@nabsha)

v0.2.0

Changelog

• af5fb3a: docs: put keywords in the README H1 (#9) (@nabsha)
• 7f9e2df: docs: stop claiming an agent never sees a secret's value (#12) (@nabsha)
• d1f92e4: docs: stop the README hardcoding a version (#8) (@nabsha)
• 4ac7205: feat: publish an MCP Registry entry (#10) (@nabsha)
• 3a85156: guard: deny agent writes to the pointer file (#15) (@nabsha)
• 0058a84: policy: standard and strict modes, audit log, vault-anchored blessing (#18) (@nabsha)
• 44530d3: release: prepare v0.2.0 (#19) (@nabsha)
• 65ad4a2: run: mask injected values in captured child output (#16) (@nabsha)
• d255904: run: pin injection to a committed argv allowlist (#17) (@nabsha)

v0.1.3

Changelog

• 0f39fbe: chore: dependency, CI and repo hygiene sweep (#1) (@nabsha)
• 4275578: ci: add vulnerability scanning, Scorecard, and repo security features (#3) (@nabsha)
• 37b94e6: ci: rehearse the release, make archives reproducible, add the score badge (#5) (@nabsha)
• 35e9e1e: docs: adopt the design spec — extensions is archived and read-only (#2) (@nabsha)
• 831cbd6: docs: container image is live as of v0.1.2 (@nabsha)
• 020e114: fix(ci): drive the dry run's second build through the action (#6) (@nabsha)
• 5d4413c: fix: byte-oriented shlex, bounded ojson nesting; fuzz the parsers (#4) (@nabsha)
• f487670: release: cut v0.1.3 (#7) (@nabsha)

v0.1.2

Changelog

• e7c7d6d: docs: Homebrew cask is live as of v0.1.1 (@nabsha)
• 234ba6a: release: publish the multi-arch container image (@nabsha)

v0.1.1

Changelog

• df8c18e: release: enable the Homebrew cask (tap repo now exists) (@nabsha)

v0.1.0

Changelog

• 847d4b7: chore(deps): tidy go.mod and raise the Go floor to 1.25 (Nabeel Shaheen nabsha.dev@gmail.com)
• ac1971f: chore(release): GoReleaser pipeline, curl installer, container image, docs (Nabeel Shaheen nabsha.dev@gmail.com)
• 8fd16ce: chore: bootstrap kdbx Go module, cobra skeleton, CI (Nabeel Shaheen nabsha.dev@gmail.com)
• ce277df: chore: excise the retired Python reference; harden repo for public release (Nabeel Shaheen nabsha.dev@gmail.com)
• efa2bfe: docs(vault): correct the Rekey comment, which inverted a safety guarantee (Nabeel Shaheen nabsha.dev@gmail.com)
• 7bee6c2: docs: AGENTS.md reflects the now-public repo (Nabeel Shaheen nabsha.dev@gmail.com)
• d14e3d3: docs: record current status and the decisions still outstanding (Nabeel Shaheen nabsha.dev@gmail.com)
• 4ed4f4e: docs: record resolved and open parity findings from the foundation build (Nabeel Shaheen nabsha.dev@gmail.com)
• 1c26e2c: docs: record the dotenv interpolation hazard and the unterminated-quote divergence (Nabeel Shaheen nabsha.dev@gmail.com)
• 89cfbe9: docs: record the signal-killed-child exit-code divergence (Nabeel Shaheen nabsha.dev@gmail.com)
• 0cb413f: feat(completion): shell completions; test: enforce the engine boundary and CLI surface (Nabeel Shaheen nabsha.dev@gmail.com)
• 7c2d95e: feat(delete,mv): recycle-bin delete, confirmed purge, entry moves with var repointing (Nabeel Shaheen nabsha.dev@gmail.com)
• 0e1ac51: feat(dotenv): exact-quoting renderer and non-interpolating parser (Nabeel Shaheen nabsha.dev@gmail.com)
• 1d88ebe: feat(envs): env resolution, ACTIVE ENV banner, --json envelopes, testscript harness (Nabeel Shaheen nabsha.dev@gmail.com)
• 657d4bf: feat(export,import): dotenv round-trip with drift detection and 0600 output (Nabeel Shaheen nabsha.dev@gmail.com)
• b1f1c3f: feat(get,list,check): read operations with masking, --json, clipboard, drift exit 5 (Nabeel Shaheen nabsha.dev@gmail.com)
• 3c7a94d: feat(guard): built-in PreToolUse role/leak guard replacing the plugin's Python hook (Nabeel Shaheen nabsha.dev@gmail.com)
• 3dd8694: feat(init,set): vault creation with sync-root warning; transcript-safe secret storage (Nabeel Shaheen nabsha.dev@gmail.com)
• 9d40521: feat(kdbxerr): typed errors carrying documented exit codes and scrubbed reporting (Nabeel Shaheen nabsha.dev@gmail.com)
• 584800c: feat(keyfile): mint and validate KeePass XML keyfile v2 byte-compatibly with Python (Nabeel Shaheen nabsha.dev@gmail.com)
• 3a15b17: feat(mcp): stdio MCP server exposing the five read-only kdbx tools (Nabeel Shaheen nabsha.dev@gmail.com)
• 2bd6ee6: feat(ojson): order-preserving JSON object model for minimal pointer diffs (Nabeel Shaheen nabsha.dev@gmail.com)
• 25eef9c: feat(paths): OS-aware KeePassXC dir, path expansion, sync-root detection (Nabeel Shaheen nabsha.dev@gmail.com)
• cf4468d: feat(pointer): discovery, env resolution, entry-path grammar, order-preserving var edits (Nabeel Shaheen nabsha.dev@gmail.com)
• a05183d: feat(rekey): confirmed keyfile rotation with atomic replacement (Nabeel Shaheen nabsha.dev@gmail.com)
• 29e7c50: feat(run): inject mapped secrets into a child process and pass its exit code through (Nabeel Shaheen nabsha.dev@gmail.com)
• f4e8d39: feat(runner): PATH/PATHEXT-aware child spawn with env injection and exit passthrough (Nabeel Shaheen nabsha.dev@gmail.com)
• 20951c8: feat(secretio): transcript-safe secret intake, masked constant, confirmations, 0600 writes (Nabeel Shaheen nabsha.dev@gmail.com)
• 147f0dd: feat(vault): engine boundary with create/open/get/list; retire the M0 spike (Nabeel Shaheen nabsha.dev@gmail.com)
• 02882d3: feat(vault): locking, integrity capture, and the set/trash/purge/move/rekey write path (Nabeel Shaheen nabsha.dev@gmail.com)
• 6c14ded: fix(ci,vault): green CI on all three OSes (Nabeel Shaheen nabsha.dev@gmail.com)
• 84e8c75: fix(get): flag conflicts exit 7 (Preflight), not 1 (Nabeel Shaheen nabsha.dev@gmail.com)
• 890a764: fix(mcp): split kdbx_run's command with shell semantics, not whitespace (Nabeel Shaheen nabsha.dev@gmail.com)
• d7499fd: fix(ojson): escape non-ASCII as \uXXXX to match Python's json.dumps (Nabeel Shaheen nabsha.dev@gmail.com)
• 15d3acc: fix(paths,pointer): resolve symlinks to match Python's Path.resolve() (Nabeel Shaheen nabsha.dev@gmail.com)
• 92968c0: fix(version): honor --json, per spec N1 (Nabeel Shaheen nabsha.dev@gmail.com)
• 36b3354: refactor(kdbxerr): use errors.As instead of a hand-rolled unwrap loop (Nabeel Shaheen nabsha.dev@gmail.com)
• 5bc02fa: release: prepare v0.1.0 (core artifacts; brew + container deferred) (Nabeel Shaheen nabsha.dev@gmail.com)
• f2cf037: style: make golangci-lint clean; migrate off deprecated testscript.RunMain (Nabeel Shaheen nabsha.dev@gmail.com)
• 033f81b: test(boundary): also check XTestImports (Nabeel Shaheen nabsha.dev@gmail.com)
• 910f7aa: test(interop): vault round-trip and CLI parity against the Python reference (Nabeel Shaheen nabsha.dev@gmail.com)
• 388414a: test: M0 interop spike — gokeepasslib round-trips a Python-created vault (Nabeel Shaheen nabsha.dev@gmail.com)