Repository navigation
release: 1.8.1, fixes to code 1.8.0 already ships, for #623 (MEDIUM; draft, do not merge) - #648
Closed
DealAppSeo wants to merge 10 commits into
Closed
DealAppSeo wants to merge 10 commits into
DealAppSeo wants to merge 10 commits into
Conversation
…ght holder (#619) Code first: - check.ts: the run check labelled the commit fact "The commit exists on the remote", but no lookup is done. It now says "GitHub reports the commit this run ran on" (dist rebuilt; only dist/lib/check.js changes). The label is in the evidence record, so the pinned digest moves, on purpose; recomputed independently with Python. Then the copy: - README: "The portable agentic trust harness" becomes what runs today (Inspect) and where it is going (Carry, reputation that moves with you), with a link to hyperdag-protocol/docs/WHY.md. "ZK-verifiable receipt" and "portable reputation" go; the range proof's score is public. Inspect is listed first. Credits for x402 (Coinbase) and Plonky3 (Polygon Labs); the ERC-8004 badge points at the EIP; the hub blurb replaces "Built on". - README: the commercial-use term the LICENSE does not contain is removed (Sean, 2026-10-23). - LICENSE appendix and README: copyright Sean Goodwin (Sean, 2026-10-23). - package.json description: Inspect first; ships with the next release. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 4273170)
…from sending the text (loop sprint 1) (#623) The audit found that MCP verify_output returned a live PASS with OFFLINE=1: only TRUSTSHELL_LOCAL_ONLY=1 stopped it. TrustShell.score is where every HAL send goes through (MCP verify, evaluate and verify_output, SDK verifyOutput and evaluate, wrap-execute), and it looked only at local-only. It now stops on OFFLINE=1 too, with the same words the CLI uses. Test first: tests/mcp-offline-sends-nothing.test.ts fails on main (4 of 9: the three MCP tools and the SDK each sent a request and answered PASS) and passes here. The 5 that pass on main are the controls: with OFFLINE unset the same calls do reach HAL. dist/ rebuilt (5 files), docs/getting-started.md OFFLINE row and CHANGELOG updated. Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com> (cherry picked from commit 37f2402)
…s text (MEDIUM) (#637) profile show printed profile.md verbatim and its "problem:" lines quoted the bad value from the file. A profile a trusted bundle signer wrote into profile.md (bundle import) reached the owner's terminal with its control and bidi bytes, while bundle context scrubs the same text. Both prints (and the refusal list an edit prints) now go through cleanCodePoints; newlines are kept. Test first: tests/antifragile-profile-show-scrub.test.ts failed on main on the control-byte assertion alone (its controls held) and passes with the fix. Corpus fixture af-review-profile-show-escape. Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com> (cherry picked from commit 034bd6d)
…e, Tavily and Replicate keys are credential shapes (MEDIUM) (#642) The detector is a list of shapes (redact.ts says so) and did not know these providers' bare keys, although it refused an OpenAI-style key, a GitHub token and a labelled GROQ_API_KEY=. remember, and so bundle export ("a bundle never carries credentials"), stored them, and the redactor left them in text bound for the hosted engine through check "<sentence>". PROVIDER_KEYS carries each key's real body length, not PREFIXED_TOKEN's 8, so an identifier like fw_update_package stays readable (the test pins ten such words). Added in both copies of the list, src/memory/redact.ts and extension/scrub.js, at the same position; scrub-parity passes. Test first: tests/antifragile-credential-shapes.test.ts failed 16 of 18 on main (8 keys through two doors; the control and the false-positive guard held) and passes. Corpus fixture af-review-remember-accepts-provider-keys. Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com> (cherry picked from commit 55c9e5a)
….8.1 Ported by hand from #647 (1e03d80), which also changes guard, run and bundle. 1.8.0 ships none of those, so only these three fixes come across: - F3 `learn inject` with nothing to inject says why on stderr (stdout, what a hook injects, stays empty); the README example passes --check ship-tests. - F4 the CLI drops Node's "SQLite is an experimental feature" warning, only it. The SDK and the MCP server leave the host's warnings alone. - F9 a refused TRUSTSHELL_API_URL prints one line with the next step, no stack trace; exit code still 3. The line names recall, not guard (not in 1.8.0). quietSqliteWarning and fatalLine are byte-identical to main apart from that one word. tests/release-1.8.1-first-run.test.ts is the F3/F4/F9 subset of tests/harness-first-run.test.ts (the F9 dist case runs `recall`, not `guard show`). It does not compile against 4b01ec3 (the functions do not exist there) and passes here, 12 of 12 with the dist case run. dist rebuilt with `npm run sdk:build` (3 files change). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
….8.1 #637's comment pointed at a profile imported from a signed bundle; 1.8.0 has no bundle. The way in for 1.8.0 is the path itself: profile show reads ./.trustshell/profile.md from the working folder, so a cloned repository can carry one. Comment only (and its line in dist/cli/profile.js). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ds, for 1.8.1 Three README lines (which npm shows) said the A2A loop ends in a "verifiable settlement receipt" / "verifiable receipt". The SDK verifies nothing there: getContractStatus and pollUntilSettled read the backend's contract row (status, provider, price, x402_payment_id as settlementId, result) and hand it back. The lines now say the backend's record, read and not verified. main still carries the same three lines (README.md "Discover -> buy -> receipt", "The full A2A loop", the RepID stack diagram); this narrows them for the 1.8.1 tarball only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cut from 4b01ec3 (the 1.8.0 source), not from main. Carries #619, #623, #637, #642 and #647's F3/F4/F9, plus the README A2A lines. Nothing that needs Guard, Carry, bundle, run or inspect_run, which 1.8.0 does not have. - package.json / package-lock.json: 1.8.0 -> 1.8.1-rc.0. - CHANGELOG: a 1.8.1-rc.0 section above 1.8.0. - check:doc-version VERIFIED (a prerelease also accepts NPM_LATEST, 1.8.0, so the @1.8.0 install pins in the docs stay correct while latest is 1.8.0). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…s commit) 1.8.1-rc.0 (e8c178c) was packed, installed cold and checked: OFFLINE=1 control, the 1.8.0 stranger checks, the 20 MCP tools and proof-pack 70/70. This commit changes no package code. It sets the version so publish-sdk.yml derives dist-tag `latest` (it refuses a prerelease there), and it moves the docs' current-version claims to 1.8.1, which check-doc-version requires of a plain release. - package.json / package-lock.json: 1.8.1-rc.0 -> 1.8.1. - CHANGELOG: a 1.8.1 section above rc.0 (kept as history). - Install pins @1.8.0 -> @1.8.1 and the npm `latest` rows in README, PRODUCT, docs (STATUS, WALKTHROUGH, getting-started, api-reference, HUMAN_TESTNET, JOIN_KIT, install/*), examples/quickstart, skills (SKILL.md, skill.json), and the three tests that pin those strings. - Not changed: the site pages, components and lib/npm-latest.ts. They deploy from main, and NPM_LATEST moves only after `npm view` returns 1.8.1. check:doc-version VERIFIED. jest minus tests/e2e: the same 7 failures in 6 suites as the 1.8.0 source on this Windows PC, none new. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
ubuntu-latest moved to 26.04 today (run 40102212111 got "Image: ubuntu-26.04"; run 40094806779 at 12:39 UTC got 24.04). Playwright 1.56.1 refuses it: "Playwright does not support chromium on ubuntu26.04-x64", so the extension job fails before any test runs, on every PR. Pinning keeps the 1.56.1 pin that matches the agent sandbox. e2e-honesty.yml installs Playwright ^1.62.1 and is not changed here. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 3e16326)
Owner
Author
|
Closing as this PR's description says to after publish: @hyperdag/trustshell 1.8.1 is npm latest, published 2026-10-24 17:28Z by publish-sdk.yml from release/1.8.1 at f20ad3d (this PR's head). The release/1.8.1 branch is kept as the release source. |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Weight: MEDIUM (live behaviour of the published package: an
OFFLINE=1privacy fix, a redaction fix, a terminal-output fix, and copy that narrows claims). Draft. Do not merge: Sean publishes from this branch withpublish-sdk.yml, then this PR is closed, the way #606 was for 1.8.0. Main gets its own "record 1.8.1" PR afterwards.The base is
chore/cc-2026-10-22-release-1.8.0, the frozen 1.8.0 branch at4b01ec34, so the diff shows only the 1.8.1 commits and CI gets a clean merge ref. A PR into main would conflict, and GitHub runs nopull_requestworkflows on a conflicted PR.What 1.8.1 is
Fixes to code that 1.8.0 already ships, cut from
4b01ec34(the 1.8.0 source). Main's Guard + Carry,trustshell run,bundleand the MCPinspect_runare not in it (the release waits on Sean's Guard authority call). Same 123 files, same 20 MCP tools, same runtime dependencies.The biggest fix: in 1.8.0,
OFFLINE=1did not stop the MCPverify_output/verify/evaluateor the SDKverifyOutput/evaluatefrom sending the text to HAL. That is for #623, whose fix is on main as37f24027, and37f24027is not an ancestor of4b01ec34.Take / leave (every main commit since
4b01ec34, checked file by file against what 1.8.0 ships)37f24027OFFLINE=1 stops verify_output and the SDKsrc/lib/{trustshell,local-only,claim}.tsare in 1.8.0, and 1.8.0's MCP sends under OFFLINE=1 (control below). CHANGELOG hunk dropped (it sat in main's Unreleased).034bd6daprofile show prints as textsrc/cli/profile.tsis in 1.8.0, and 1.8.0 reads./.trustshell/profile.mdfrom the working folder, so a cloned repo can carry one. Theingestimport from #593 was dropped, and the comment names that vector instead of bundle import (f43b84a3).55c9e5a5more credential shapes in redactsrc/memory/redact.tsis in 1.8.0 (remember, andcheck "<sentence>"redaction). Clean cherry-pick,extension/scrub.jsincluded so scrub parity holds.1e03d80dF3, F4, F9learn injectsays why, F4 drops the SQLite warning, F9 makes a refused API URL one line. The ported functions are byte-identical to main except "guard and" dropped from F9's line. Test:tests/release-1.8.1-first-run.test.ts.4273170esay only what the code doeschecklabel "The commit exists on the remote" (no lookup is made), the npm description, the LICENSE holder (Sean, 2026-10-23). Linked hyperdag-protocol files exist (WHY.md, BUILDERS.md#how-the-pieces-fit, ACKNOWLEDGEMENTS.md).f4a2beb2)getContractStatus/pollUntilSettledread the backend's contract row and verify nothing; three lines now say so.src/cli/{guard,bundle}.ts,src/lib/{guardrails,bundle,autonomy}.ts): none of it is in 1.8.0.inspect_run--claims --guided(HOLD)docs/red-team.md, which is not in the package.extensionfailed before any test on ubuntu 26.04 (Playwright 1.56.1 cannot install Chromium, run 40114165919). This PR runs that job because #642 touchesextension/scrub.js.Commits
de73ad43fix: say only what the code does (Inspect commit label), credit what we build on, one copyright holder (LOW + Sean-approved licence) #619 · 2.653ec1b2fix(mcp,sdk): OFFLINE=1 now stops verify_output, verify and evaluate from sending the text (MEDIUM, loop sprint 1) #623 · 3.9d0207adfix(profile): profile show prints the profile and its problem lines as text (MEDIUM, draft) #637 · 4.29899f2dfix(redact): bare Groq, Cerebras, xAI, Perplexity, Fireworks, Supabase, Tavily and Replicate keys are credential shapes (MEDIUM, draft) #642 (cherry-picks with-x)ff7694aafix(cli): first-run polish for guard, run, bundle, inspect and learn (stranger walk F1-F13; LOW) #647 F3/F4/F9 by hand · 6.f43b84a3the fix(profile): profile show prints the profile and its problem lines as text (MEDIUM, draft) #637 comment · 7.f4a2beb2README A2A linese8c178ce1.8.1-rc.0 (the verified candidate) · 9.162405091.8.1 (version and install pins only) · 10.f20ad3d9ci(extension-e2e): pin the runner to ubuntu-24.04 (LOW, CI only) #645 extension-e2e runner pin (CI only). Publish from the head,f20ad3d9: its tarball is byte-identical to16240509's (sha2565726b29c…).Evidence (all run 2026-10-24 on this PC; full report
E:\dev\reports\2026-10-24\RELEASE_1.8.1_RC.md)OFFLINE=1 control (
offline-control.cjs): a 127.0.0.1 listener stands in for HAL, the installedtrustshell-mcpis driven over stdio, and the installed SDK is imported. With OFFLINE unset, every arm reached the listener, which proves it can see a send.npm view)seenBy: []Tests fail before, pass after: on an extracted
4b01ec34tree,mcp-offline-sends-nothingfails 4/9 (its 5 controls pass),antifragile-credential-shapes16/18,antifragile-profile-show-scrub3/4, and the first-run port does not compile. All pass here.Full jest (minus e2e), Windows: 4882 pass / 7 fail. The same 7 tests in the same 6 suites fail on the 1.8.0 source on this PC, and none is new. CI on Linux is the real gate.
Tarball: 123 files. Against the published 1.8.0, 15 files differ: 11 in
dist/plus README, CHANGELOG, LICENSE and package.json. The other 108 are byte-identical. Between rc.0 and 1.8.1 only package.json (the version), CHANGELOG and README differ.dist/rebuilt from a clean archive equals the committeddist/. There are no Guard/Carry/inspect_runsymbols.1.8.0's stranger checks, cold install with no tokens:
--versiongives 1.8.1. Run 39619591025 exits 1 with 3 supported · 1 contradicted · 1 not checked. vite run 39524643058 exits 0 with 2 · 0 · 0. Both spends are REFUSED. Bash and PowerShell 5.1 give the same results. MCP: server 1.8.1, 20 tools, the same names as 1.8.0. The--claimsrecord's digest changes because of fix: say only what the code does (Inspect commit label), credit what we build on, one copyright holder (LOW + Sean-approved licence) #619's label: the only content difference is that label (andfetchedAt).proof-pack (main's
scripts/proof-pack.mjs --tarball) on rc.0 and on 1.8.1: 70 PASS · 0 FAIL · 0 NOT_CHECKED each.check:doc-versionVERIFIED at rc.0 and at 1.8.1.Sean's steps (Sean-only; each target checked to exist)
gh workflow run publish-sdk.yml --repo DealAppSeo/trustshell --ref release/1.8.1 -f dry_run=true -f dist_tag=latestgh workflow run publish-sdk.yml --repo DealAppSeo/trustshell --ref release/1.8.1 -f dry_run=false -f dist_tag=latestv: av*tag push starts publish-sdk again):git tag -a trustshell-1.8.1 f20ad3d9913db268a02cb07f3d5a69caeaa15ed5 -m "npm @hyperdag/trustshell 1.8.1"thengit push origin trustshell-1.8.1npm dist-tag add @hyperdag/trustshell@1.8.1 nextnpm deprecate @hyperdag/trustshell-mcp "Use the trustshell-mcp command inside @hyperdag/trustshell"Rollback for step 2:
npm dist-tag add @hyperdag/trustshell@1.8.0 latest(npm does not let a published version be reused, so the fix-forward is 1.8.2).Not checked: macOS and Linux shells, and how the npm page renders the provenance badge. Step 2's real publish (provenance, signatures) can only be checked after Sean runs it.
🤖 Generated with Claude Code