[DealAppSeo]

Do not merge until npm view @hyperdag/trustshell version returns 1.9.0. This branch is what gets published. The docs here say 1.9.0 is on npm, so merging first would make them false.

Cut from main. Nothing is published by this PR.

What changed

• Version 1.9.0 in package.json and the lockfile, install pins and the npm latest row, using the file list of the 1.8.1 release commit. Site pages are not changed, except the /lab/test-agent preview, which is a 404 on production and otherwise says trust-report is unreleased.
• CHANGELOG.md: the Unreleased section becomes 1.9.0 and gains the code changes it was missing. The 1.8.1 notes, absent from main, are restored.
• README: the three A2A lines go back to what 1.8.1 said. They had returned to promising a "verifiable" receipt, and pollUntilSettled reads the backend's record without verifying it.
• "In no npm release" wording is replaced with "Since 1.9.0". Measured: 165 files, 21 MCP tools, @noble/hashes as a new runtime dependency.
• tests/release-1.8.1-first-run.test.ts is added to main. It existed only on the 1.8.1 branch.
• The red-team page and its 1.8.0 record are marked doc-version: historical, because they record what was attacked on that date. The checker itself is unchanged.

1.8.1 is not an ancestor of main

1.8.1 was cut from the 1.8.0 source, so publishing main could have undone its fixes. All four of its regression suites pass on this tree (43 tests), and its check record label is on main. The README wording above was the one regression found.

Evidence

check-doc-version VERIFIED across 175 markdown files, and redteam-report --check matches. The other results are in the checks on this PR.

Limits

Nothing here says Guard, Carry or the sandbox control anything outside trustshell run, the MCP server and the SDK's gated functions; the changelog says so directly. The 1.8.0 tarball had a separate scripted attack before release. This tarball has not, and that battery is not in this repository.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
trustshell-landing	Ready	Preview	Nov 9, 2026 3:03am UTC

[strix-security]

Strix Security Review

✅ No open security findings.

PR summary: Release PR that sets `@​hyperdag/trustshell` to 1.9.0 across `package.json`, the lockfile, install pins and docs, rewrites the changelog to fold in the 1.8.1 notes, corrects the A2A "verifiable receipt" wording, and adds the 1.8.1 first-run regression test to main.

Review summary

No security findings. This is a release PR: it sets @hyperdag/trustshell to 1.9.0 in package.json and the lockfile, sweeps the install pins and npm latest rows across the README, docs, install guides and the OpenClaw skill manifest, rewrites the changelog to fold in the 1.8.1 notes, corrects the A2A "verifiable receipt" wording, and adds the 1.8.1 first-run regression test to main.

The only non-documentation changes are a static install-command string in components/test-agent-flow.tsx (rendered as text through the existing Command component, no user input, no HTML sink), a literal doc-version: historical comment emitted by scripts/redteam-report.mjs, and the new test file. None of them introduces a sink, a trust boundary or a new data flow.

Because the PR body states that 1.8.1 is not an ancestor of main and that publishing main could undo its fixes, I verified the security-relevant 1.8.1 fixes are actually present in this tree and in the committed dist/ that the tarball publishes: the OFFLINE=1 gate in TrustShell.score that stops the SDK verifyOutput/evaluate and the MCP verify/verify_output/evaluate from sending text to HAL, the bare provider credential shapes in src/memory/redact.ts wired into containsSecret/redact and remember, and the control/bidi scrubbing in profile show. All three are present in both src and dist, and the 1.8.0 classify ReDoS fix is intact. No 1.8.1 security control is missing.

Lint leads were triaged and ruled out: the stale "version": "1.6.0" field in skills/trustshell/skill.json is informational metadata while the install pin correctly names 1.9.0; the unpinned npx ...@latest invocations the lint file names are on lines this PR does not touch and are documentation only; .mcp.json's 1.8.0 pin is outside the diff; and the --passWithNoTests prepublish gate and the @hyperdag/proof-verifier caret range are pre-existing build configuration the PR does not change.

Ruled out (3)

• Does releasing main as 1.9.0 regress the security fixes that only exist on the 1.8.1 branch?
  All three security-relevant 1.8.1 fixes (the OFFLINE=1 HAL gate in TrustShell.score, the bare provider credential shapes in redact.ts, and the profile show control/bidi scrubbing) are present in both src and the committed dist that the tarball publishes.
• Does the stale "version": "1.6.0" in skills/trustshell/skill.json make an agent host install an older package?
  The field is informational metadata; the OpenClaw install entry this PR updates pins @​hyperdag/trustshell@​1.9.0, which is what a host resolves.
• Does the PR's version sweep leave an unpinned npx @​latest invocation that could pull an unexpected package?
  The unpinned npx lines the lint file names are documentation lines this PR does not modify, and they resolve the same package name from npm.

Review history (2)

• Review 2 · 01e46e4 · Nov 9 03:08 UTC · Nothing new
• Review 1 · f91e9f5 · Nov 9 02:53 UTC · Nothing new

_{Review 2 on this PR · 01e46e4 · requested Nov 9 03:03 UTC on a new commit}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[strix-security]

This is a release PR: it sets the version to 1.9.0 in package.json and the lockfile, sweeps the install pins and npm latest rows across the README, docs and the OpenClaw skill, rewrites the changelog (folding the Unreleased section into 1.9.0 and restoring the 1.8.1 notes), corrects the A2A wording so it no longer promises a "verifiable" settlement receipt, adds tests/release-1.8.1-first-run.test.ts, and marks the red-team page and its 1.8.0 record doc-version: historical. The only non-documentation code changes are a literal string added to the generator in scripts/redteam-report.mjs and a static install command rendered as text in components/test-agent-flow.tsx; neither introduces a sink.

I checked the one security-relevant claim the PR makes about itself: because 1.8.1 was cut from the 1.8.0 source rather than from main, publishing main could have regressed its fixes. All three are present in this tree and their suites pass — the OFFLINE=1 guard in TrustShell.score returns NOT_CHECKED with seenBy: [] before the only HAL fetch and covers the SDK and MCP verify/evaluate/verify_output paths, src/memory/redact.ts matches bare provider key shapes without a KEY= label, and profile show scrubs control and bidi characters. The lint items that touch changed files are pre-existing and unchanged by this diff (a stale "version": "1.6.0" in skills/trustshell/skill.json, the prepublishOnly test gate, a caret range on @hyperdag/proof-verifier, and the narrow GROQ_API_KEY-only scrubPrinted), and none is a vulnerability. No security issues found in the changed code.

---

Reviewed by Strix
_{Configure security review settings}

[DealAppSeo]

@strix-security

[strix-security]

No security findings. This is a release PR: it sets @hyperdag/trustshell to 1.9.0 in package.json and the lockfile, sweeps the install pins and npm latest rows across the README, docs, install guides and the OpenClaw skill manifest, rewrites the changelog to fold in the 1.8.1 notes, corrects the A2A "verifiable receipt" wording, and adds the 1.8.1 first-run regression test to main.

The only non-documentation changes are a static install-command string in components/test-agent-flow.tsx (rendered as text through the existing Command component, no user input, no HTML sink), a literal doc-version: historical comment emitted by scripts/redteam-report.mjs, and the new test file. None of them introduces a sink, a trust boundary or a new data flow.

Because the PR body states that 1.8.1 is not an ancestor of main and that publishing main could undo its fixes, I verified the security-relevant 1.8.1 fixes are actually present in this tree and in the committed dist/ that the tarball publishes: the OFFLINE=1 gate in TrustShell.score that stops the SDK verifyOutput/evaluate and the MCP verify/verify_output/evaluate from sending text to HAL, the bare provider credential shapes in src/memory/redact.ts wired into containsSecret/redact and remember, and the control/bidi scrubbing in profile show. All three are present in both src and dist, and the 1.8.0 classify ReDoS fix is intact. No 1.8.1 security control is missing.

Lint leads were triaged and ruled out: the stale "version": "1.6.0" field in skills/trustshell/skill.json is informational metadata while the install pin correctly names 1.9.0; the unpinned npx ...@latest invocations the lint file names are on lines this PR does not touch and are documentation only; .mcp.json's 1.8.0 pin is outside the diff; and the --passWithNoTests prepublish gate and the @hyperdag/proof-verifier caret range are pre-existing build configuration the PR does not change.

---

Reviewed by Strix
_{Configure security review settings}