Cloister 0.4.0

Cloister 0.4.0

Release tag: v0.4.0. The matching base image is
ghcr.io/yi427/cloister:0.4.0.

This release adds explicit on-demand Host tools and Profile V8. Agents can
discover installed macOS commands and use them in the same conversation,
without editing the Profile or restarting the session for each command.
The default mode remains allowlist.

The base tool versions are unchanged:

Base tool	Version
Node.js	24.19.0
Rust	1.97.1

On-demand Host tools

Create a separate Profile to deliberately enable broad Host access:

cloister init --host-exec-mode on-demand --profile /path/to/new-profile.toml
cloister codex --profile /path/to/new-profile.toml
# or: cloister claude --profile /path/to/new-profile.toml

Initialization discloses broad macOS-user authority before the normal Profile
creation confirmation. On-demand mode makes bare commands from the bridge's
startup PATH available without per-command registration or Cloister execution
prompts. Agent-client policies may still deny tools or request confirmation.

host.list_commands reports the selected mode and pinned commands.
The new read-only host.find_command checks one installed command without
executing it. Discovery is cached for the session, pinned commands take
precedence, and a changed canonical executable target requires rediscovery
after restarting the bridge. Relative and empty PATH entries are ignored.

Every on-demand host.exec requires a short reason. The canonical Host Skill
and MCP instructions guide both Agents to use Guest tools for routine workspace
work, explain Host operations, and reuse discovered commands. Execution still
uses literal arguments, bounded output/status polling, cancellation, and
metadata-only audit logs. Audit logs omit argument values, purpose text, and
environment values.

Profile compatibility and upgrade

New Profiles use schema_version = 8 and require explicit host.exec.mode:

[host.exec]
enabled = true
mode = "on-demand" # or "allowlist"
allow = []

Existing V7 Profiles remain supported with allowlist behavior. Installing the
CLI does not silently broaden their authority. After upgrading the CLI, update
the matching official image with:

cloister profile upgrade --dry-run
cloister profile upgrade
cloister check

profile upgrade changes only the official image reference and does not migrate
the schema or enable on-demand access. To enable the new mode, create a separate
V8 Profile or deliberately review a manual V8 configuration change. V6 and
earlier remain unsupported. Published 0.3.1 images lack the updated canonical
Host Skill and cannot be paired with the 0.4.0 CLI.

Security boundary and validation

On-demand grants broad execution with the macOS user's permissions. Required
purpose text and Guest-first guidance influence Agent behavior; they do not
contain Host filesystem, network, shell, or interpreter access. Executables can
change at the same path, and discovery does not eliminate filesystem races.
The selected workspace remains a live read-write Host bind mount. Shared Agent
state remains separate Cloister-managed state; credentials and Agent software
are not baked into the base image.

Development checks passed all 229 tests and Clippy, including real authenticated
loopback MCP discovery, execution, purpose validation, status, cancellation,
audit redaction, V7/V8 parsing, and both Agent approval configurations. On
2026-10-11, the local development image passed Apple container 1.5 readiness
and actual Guest-to-Host connectivity checks; Codex 0.162.1 and Claude Code
2.1.296 were installed independently and passed executable launch checks.

Publication checks against the exact release image are recorded separately in
the GitHub release.
Version output and deterministic configuration tests do not establish
authenticated model routing, Skill selection, or future Agent-client approval
behavior. Agent software continues to update independently of Cloister.

Publication verification on 2026-10-11

Release commit: b89d08b70a184faf6cb86692b7d38814b2ffb173.

• Local make verify and the staged-snapshot pre-commit hook passed all 229
  tests and Clippy. GitHub Verify passed for PR #10
  and the merged release commit.
• The release image workflow
  passed. Anonymous GHCR access returns Linux ARM64 for 0.4.0 and 0.4;
  both identify the same index. The existing sha-b89d08b70a184faf6cb86692b7d38814b2ffb173
  image remained unchanged after the tag build.
• Source installation with cargo install --locked --git ... --tag v0.4.0
  into a clean temporary installation root succeeded and reports cloister 0.4.0.
• The exact release CLI/image passed init, readiness, actual Guest-to-Host
  connectivity, base tool version checks, canonical Skill hash comparison,
  and a Guest workspace write observed on the Host.
• Fresh isolated-state launches passed with Codex 0.162.1 and Claude Code
  2.1.296. Both passed cached/offline and exact-version launches. An explicit
  update check passed; a deliberately rejecting local proxy caused an automatic
  update failure and successfully preserved/reused installed Codex. Two parallel
  Codex sessions used different workspaces and distinct Host bridge ports.
• A Guest in the exact release image authenticated to the Host MCP bridge and
  passed discovery, literal argument execution, missing-command, status, and
  cancellation checks. Purpose/argument/environment values were absent from
  the audit file. The temporary bridge, processes, and token file were cleaned up.
• Homebrew strict online audit, build-from-source installation, and brew test
  passed for the verified archive and Formula. The macOS and Linux Homebrew CI
  checks passed, and homebrew-tap PR #2
  was merged as 27e6f65ebf2dfc05fb09a0d3143868ae847b4a81.

These smoke checks used temporary isolated Agent state and did not log in or
perform model tasks. They do not certify model routing, Skill selection, or
future Agent-client approvals. The actual MCP checks used a test client in the
Guest, separately from the two Agent executable-launch checks.

Locked source installation emitted Cargo's existing yanked-dependency warning
for chacha20 0.10.1, inherited through rmcp and rand; installation still
completed with the unchanged dependency lockfile. This release does not make
an additional dependency-security certification.

Image index digest: sha256:03242c3c2ef897ad7bd6c57901eabc615a25ad3d2b5eda9ebfaedc8fcd4367db.
Release source archive SHA-256: 9604b270dd0bb5adb85121e366f90edde01b45c91581fd8101f866b51ca0408c.