Skip to content

v3.12.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Nov 10:08
· 14 commits to main since this release
v3.12.1
0f0297e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

LeanCTX | OSS 3.12.1

A security and governance release. Shell, file and Hive paths now fail closed: the shell gate checks every command it lets through, its policy can no longer be changed from an agent's own environment, and native Read/Grep follow the secret-path rule. LeanCTX on a machine is now an instance, and it speaks Hive-Protocol 2.2 with LeanCTX | Hive.

Full list: CHANGELOG.md.

Highlights

  • Governor setup by default on Claude Code. New installs get native tools plus two hooks (hook govern, hook rewrite-enforce) and no MCP server: about 86 tokens of fixed prefix per turn instead of ~2,950. Measured ×0.88 against native Claude Code on long conversations. Existing setups switch once on update, with backups. lean-ctx init --agent claude --mode hybrid keeps the ctx_* tools, and that choice is pinned. CodeBuddy, Cursor, Codex CLI, Gemini CLI and Copilot CLI get the same default.
  • Governor rule R4 groups large Bash output whose lines differ only in numbers, timestamps or ids. The exact original stays in the archive (ctx_expand). Errors, tracebacks and diffs stay verbatim. Shadow by default.
  • ctx_read symbol="name" reads one function or class. A read without a range returns files up to 300 lines whole and larger files as an outline capped at ~1,500 tokens.
  • ctx_shell asks before refusing an unlisted program: allow once, for the session, always, or deny, in your AI tool's approval dialog.
  • Opt-in: long-session elision in the proxy. Once a Claude Code conversation passes ~180 kB (~50k tokens), the proxy can replace old tool outputs (over 2 KB, older than the last 8 messages) with a short note that names the archived full text. It is off by default: measured on Claude Code with Haiku 5.5 over three runs (44 long tasks per arm), it cut cost to ×0.67–0.92 against native but solved 37 of 44 tasks against 42 of 44, when the model answered without reading back an elided early output. Turn it on with [proxy] long_session_elide = true or LEAN_CTX_PROXY_LONG_SESSION_ELIDE=on.
  • lean-ctx hive docs import --markdown turns docs into LeanCTX | Hive pages, one section per heading, re-revising only what changed.
  • Hive-Protocol 2.2. Agents check each other's task results (ctx_tasks action=verify). A connected instance now carries corrections, supersedes and withdrawals of its facts to the vault.
  • emspace spaces work without setup. ctx_read names the page that documents a file, and ctx_provider reads one page section.
  • Knowledge has no fact limit. Facts leave memory only by quality. The knowledge store keeps a change journal (ctx_knowledge action=changes).

Security

  • Shell gate: every command the hooks let run without the lean-ctx -c wrap is now checked: heredocs, lean-ctx … prefixes, && chains with reads, Mistral Vibe, Codex, Copilot and PowerShell. Release builds take shell-security settings only from the built-in defaults and ~/…/config.toml, never from LEAN_CTX_SHELL_*, HOME or XDG_* set by the agent. lean-ctx calls from an agent's shell follow an allowlist. Over-long or too deeply nested commands are refused instead of crashing the hook.
  • Approvals mirror your AI tool. The hooks no longer answer "allow" for every call. They allow only what the host's own permission settings would have run without asking.
  • Native Read and Grep follow the secret-path rule on Claude Code, CodeBuddy, Cursor, Copilot CLI and Gemini CLI.
  • PathJail writes stay in the active project by default (path_jail_scope = projects). ctx_multi_repo add_root passes the jail. Project policies can no longer drop the built-in exclusions for .env*, keys and credentials.
  • Signatures are verified against a trusted key: context capsules, every signed audit-trail entry, context packages, addons and compliance verify. --allow-untrusted-signer restores the old check where it applies.
  • Hive: hive connect sends nothing before your yes and lists exactly what it shares. A broken screening rule pauses Hive content instead of letting it through. Fencing tokens are no longer printed.
  • Installers: the skill's curl | bash installer verifies SHA256SUMS. A Cockpit bundle with two checksum entries is refused. npm install lean-ctx-bin@X installs engine X. The Hermes plugin pins lean-ctx-client.
  • Secrets off command lines: serve --auth-token-file, serve --a2a-signing-key-file, cockpit --auth-token-file. The signing keychain password goes over stdin.
  • Local surfaces: dashboard requests that name a project are answered for that project or refused. The Windows daemon pipe and the daemon socket are owner-only. report-issue redacts secrets. Role, policy and workflow refusals are tool errors (isError: true).

Upgrade notes

  • Behaviour changes: native reads of secret-like files (for example *.pem test certificates, .npmrc) are denied under the default role. Allow them through io.allow_secret_paths. Shell-security options belong in config.toml, because LEAN_CTX_SHELL_* and LEAN_CTX_PROFILE=… lean-ctx … from an agent's shell are ignored or refused. lean-ctx config set path_jail_scope home restores the 3.11 jail. See the upgrade guide: docs/guides/upgrade-3.12.md.
  • Claude Code switches to the governor setup on the next update, once per version, after backing up settings.json, ~/.claude.json, CLAUDE.md and the config. Pin another mode with lean-ctx init --agent claude --mode hybrid|replace|mcp.
  • LeanCTX | Hive: this release speaks only the instance naming (C0 2.2), and no earlier release connects to Hive. Hive's TOML org policy is no longer read.
  • New crates on crates.io: the engine is split into lean-ctx-engine, lean-ctx-hooks, lean-ctx-hive, lean-ctx-server and lean-ctx-proxy, with the CLI crate lean-ctx on top (all 3.12.1). Also new: lean-ctx-compress, lean-ctx-fs, lean-ctx-patterns, lean-ctx-syntax, lean-ctx-workgraph and lean-ctx-doc (behind ctx_doc), all 0.1.0. leanctx-native-storage stays unchanged at 0.1.1. Breaking for direct users: lean-ctx-protocol 0.5.0 and lean-ctx-ocla 5.0.0. cargo install lean-ctx works as before.
  • Removed: Hive swarms and Task Compute, sealed vaults, human review of Hive knowledge, episodic and procedural memory, the optional LLM enhancement layer and learned auto modes. lean-ctx autopilot policy and autopilot evidence --learn are deprecated no-ops. Details are in the changelog under Removed and Deprecated.
Assets 66
Loading