Repository navigation

release: 0.9.0 — audited (rounds 1-5b), #[non_exhaustive] break, Linux host-crash root-cause fix - #72

Merged

runyourempire merged 185 commits into

mainfrom

release/0.9-prep

Sep 30, 2026

Merged

release: 0.9.0 — audited (rounds 1-5b), #[non_exhaustive] break, Linux host-crash root-cause fix#72
runyourempire merged 185 commits into
mainfrom
release/0.9-prep

Commits on Sep 27, 2026
- fix(plugin): main-thread callers run inline; Tauri-command evals go through the bridge
  
  audit
  and
  claude
  committed
  a498fbe
- feat(bridge): try_list_window_labels + eval_webview_resolved; deterministic default window
  
  audit
  and
  claude
  committed
  f98c7d3
- fix(eval): private eval state, exact-window watch, busy UI != closed window
  
  audit
  and
  claude
  committed
  95b747b
- style(tools): pub items in the private tools module (clippy::redundant_pub_crate)
  
  audit
  and
  claude
  committed
  c65f69e
- hardening(0.9): CI/release supply chain, init symlink safety, watchdog identity pinning, docs honesty
  
  audit
  and
  claude
  committed
  76a3d61
- fix(js-bridge): hostile-page hardening + slow IPC calls no longer stuck "pending"
  
  audit
  and
  claude
  committed
  c3ae9a8
- Merge remote-tracking branch 'origin/hardening-0.9' into release/0.9-prep
  audit
  committed
  c141cab
- feat!: 0.9 API sweep — #[non_exhaustive] output types, constructors, internals pulled back
  
  audit
  and
  claude
  committed
  a22c83b
- fix(database): SQLite authorizer for query_db; hardened, fully-budgeted db_health
  
  audit
  and
  claude
  committed
  611d38a
- Merge remote-tracking branch 'origin/sweep-0.9' into release/0.9-prep
  audit
  committed
  a2eb841
- fix(recording,trace): shared drain watermark; trace owns its recording by id
  
  audit
  and
  claude
  committed
  50c698a
- fix: network-boundary, ASI and honesty findings from the pre-audit red team
  
  audit
  and
  claude
  committed
  e72246e
- release: prepare 0.9.0 — changelog, migration guide, version bump
  
  audit
  and
  claude
  committed
  0d59759
- fix(plugin): gate lexically_normalize behind the sqlite feature (dead code under --no-default-features)
  
  audit
  and
  claude
  committed
  7b131af
- fix(js-bridge): find_elements no longer calls a valid selector "invalid" while the page reloads
  
  audit
  and
  claude
  committed
  8cc7623
- feat(eval): fail fast when the page reloads under an in-flight eval
  
  audit
  and
  claude
  committed
  be75c90
- feat(invoke_command): per-call timeout_ms; aborted calls are not timings
  
  audit
  and
  claude
  committed
  e837e86
- test(victauri-test): hold the "closed" port bound so CI cannot reuse it
  
  audit
  and
  claude
  committed
  88b3339
- fix(authz): refuse non-string actions and non-object args before the capability gate
  
  runyourempire
  and
  claude
  committed
  5c8e4f3
- fix(inspectable): record the IPC key Tauri invokes each argument by
  
  runyourempire
  and
  claude
  committed
  09971ce
- fix(codegen): generated tests survive hostile recordings
  
  runyourempire
  and
  claude
  committed
  8206c6d
- fix(victauri-test): check()/uncheck() work on React inputs; stale refs error
  
  runyourempire
  and
  claude
  committed
  e14fdc9
- fix(query_db): charge the result budget per raw cell; cap result width, LIKE patterns and lock waits
  
  runyourempire
  and
  claude
  committed
  a7736ed
- fix(eval): no parse-watchdog race, page-nonce reload detection, leak-proof pending slots
  
  runyourempire
  and
  claude
  committed
  7b8b620
- fix(recorder): generation-scoped, atomic stop/import; IpcCall carries a mocked flag
  
  runyourempire
  and
  claude
  committed
  07319d3
- fix(introspection): bound CommandTimings to 1024 distinct commands
  
  runyourempire
  and
  claude
  committed
  f26f6bd
- fix(bridge): a timed-out main-thread call never runs later; trusted input only reaches the app
  
  runyourempire
  and
  claude
  committed
  29047d1
- fix(mcp): bound blocking DB/probe work, isolate handler panics, no busy-UI or path oracles
  
  runyourempire
  and
  claude
  committed
  ce76d31
- fix(recording): sequence-keyed drain, recording-scoped reads, window-true replay, trace lifecycle
  
  runyourempire
  and
  claude
  committed
  e94115b
- fix(discovery): exact, own-user, in-process liveness on Windows; bridge e2e isolated
  
  runyourempire
  and
  claude
  committed
  a24b517
- fix(release,ci,docs): tokenless verify before publish; honest gates and docs
  
  runyourempire
  and
  claude
  committed
  d0366a1
- fix(cli): the stdio bridge's HTTP timeout outlasts a tool call's own timeout_ms
  
  runyourempire
  and
  claude
  committed
  c4bab9a
- fix(bridge): snapshot, logs and eval results hold up against hostile values and page script
  
  runyourempire
  and
  claude
  committed
  9c6ad55
- fix(authz): unknown string actions keep their helpful parse error; disabled first
  
  runyourempire
  and
  claude
  committed
  ff86cf2
- Merge lane B: recording/drain/trace/replay fixes (C5 C6 C13 C14 C15a/b/e V-3 V-4)
  runyourempire
  committed
  20f8fc4
- fix(eval): the auto-return scanner never drops a statement
  
  runyourempire
  and
  claude
  committed
  baa312d
- test(demo-app): describe the parse check that replaced the 750ms watchdog
  
  runyourempire
  and
  claude
  committed
  976e0af
- Merge lane C: page-facing JS bridge hardening + ASI scanner (V-1 V-2 V-4 V-6 V-7 V-8 V-9 V-11 V-14)
  
  runyourempire
  and
  claude
  committed
  802fd56
- fix(server): header/body deadlines, connection cap, browser-request guard, split rate limit
  
  runyourempire
  and
  claude
  committed
  03deed1
- Merge lane A: eval lifecycle (C1/V-5 C2/N2 C3 C4/V-13 C7 C9 C15c/d V-12 V-15)
  
  runyourempire
  and
  claude
  committed
  bbeab15
- test: end-to-end N1 proof over the real server; slot test drains a live recording
  
  runyourempire
  and
  claude
  committed
  c0783c4
- fix(discovery): per-user discovery root on Unix; every reader scans the same roots
  
  runyourempire
  and
  claude
  committed
  6f09f30
- test: align stale expectations with the capability gate and the F6 no-oracle contract
  
  runyourempire
  and
  claude
  committed
  2f1d4cb
- fix(mcp): name InitializeResult, not the ServerInfo alias rmcp 3.4 deprecates
  
  runyourempire
  and
  claude
  committed
  64ed5ed
- fix(eval): the unserializable-result message had runs of source indentation
  
  runyourempire
  and
  claude
  committed
  dc1db6a
- Merge lane D: database, file tools, HTTP server and discovery hardening (F1-F7 C8 C10 C11 C12 N3-N6 I1-I7)
  
  runyourempire
  and
  claude
  committed
  0cf882c
- fix(vscode): discover 0.9 apps in the per-user Unix root; another user's PID is not live
  
  runyourempire
  and
  claude
  committed
  a1f574b
- docs: round-3 audit changes in CHANGELOG, MIGRATION, security model and tool reference
  
  runyourempire
  and
  claude
  committed
  bf1699c
- fix(init): patched main.rs/Cargo.toml never written through a symlink; CRLF kept
  
  runyourempire
  and
  claude
  committed
  961c519
- fix(test): slice::from_ref in a unix-only test (clippy 1.98 cloned_ref_to_slice_refs)
  
  runyourempire
  and
  claude
  committed
  e2324f6
- fix(query_db): refuse a bad query before resolving any database; demo seeds demo.db; stale live E2E suites repaired
  
  runyourempire
  and
  claude
  committed
  ea40ec5
- chore: Cargo.lock for demo-app's rusqlite dependency
  
  runyourempire
  and
  claude
  committed
  a7ea293
- fix(examples): enable Tauri's x11 feature so Linux screenshots work in the demo and gauntlet apps
  
  runyourempire
  and
  claude
  committed
  43b7561
Commits on Sep 28, 2026
Commits on Sep 29, 2026
- fix(plugin): never clone or drop a Tauri handle off the main thread — the Linux host heap corruption
  
  runyourempire
  and
  claude
  committed
  ae033e8
- test, ci, docs: guard the off-main-handle fix; repeat the Linux heap tests; record the root cause
  
  runyourempire
  and
  claude
  committed
  872753d
- docs: CI + live validation of the off-main-handle fix; correct MAIN_DISPATCH_LOCK's cause
  runyourempire
  committed
  9846473
- fix(server): never drop the bridge's AppHandle off the main thread at shutdown
  runyourempire
  committed
  12f2a91
- fix(watchdog): match --app identity ASCII case-insensitively, like the bridge (R5-WD1)
  
  runyourempire
  and
  claude
  committed
  c59e5ce
- fix(permissions): drop eval_js / dom_snapshot from victauri:default
  
  runyourempire
  and
  claude
  committed
  2ac4858
- fix(cli): treat a blank VICTAURI_APP / --app as unset in the bridge (R5-BR2)
  
  runyourempire
  and
  claude
  committed
  9ecb6fb
- fix(examples): keep Tauri handles on the main thread
  
  runyourempire
  and
  claude
  committed
  294d963
- fix(server): a connection holds a request slot only after its first byte (R5-NET1)
  
  runyourempire
  and
  claude
  committed
  f2f59ed
- fix(bridge): select + limit IPC/network log entries before deep-copying (R5-JS1)
  
  runyourempire
  and
  claude
  committed
  6627e8a
- ci: compile the plugin without SQLite; MSRV --locked; honest semver note
  
  runyourempire
  and
  claude
  committed
  7adb767
- docs: fix Pages link case, document bundled-sqlite, drop no-op --wait
  
  runyourempire
  and
  claude
  committed
  df67b1b
- docs: state the real browser-origin rule (403 vs 415)
  
  runyourempire
  and
  claude
  committed
  316414a
- fix(cli): answer a JSON-RPC batch locally, never forward it (R5-BR1)
  
  runyourempire
  and
  claude
  committed
  d37a88f
- fix(cli): never answer a client's JSON-RPC response (R5-BR3)
  
  runyourempire
  and
  claude
  committed
  d6783fb
- fix(cli): a tool call whose SSE response dies mid-stream says it may have run (R5-BR4)
  
  runyourempire
  and
  claude
  committed
  5216659
- fix(victauri-test): JUnit XML never contains characters XML 1.0 forbids (R5-XML1)
  
  runyourempire
  and
  claude
  committed
  8570e02
- fix(victauri-test): neutralize page text in check details, panics and locator errors (R5-TERM2)
  
  runyourempire
  and
  claude
  committed
  6f0fa67
- fix(vscode): never re-send the token to a port its app no longer owns; no overlapping polls (R5-VSC1)
  
  runyourempire
  and
  claude
  committed
  c71ebcc
- docs: same-window page script can rewrite eval results (correct claims)
  
  runyourempire
  and
  claude
  committed
  9212819
- fix(db): db_health counts only canonical CREATE TABLE definitions (R5-DB1)
  
  runyourempire
  and
  claude
  committed
  1afecba
- fix(server): animation scrub never reports a capture it did not make (R5-ANIM1)
  
  runyourempire
  and
  claude
  committed
  25b7085
- fix(bridge): always deliver an eval outcome when the page breaks toJSON (R5-JS2)
  
  runyourempire
  and
  claude
  committed
  a816d89
- fix(bridge): slotted content no longer "covers" its shadow slot host (R5-JS3)
  
  runyourempire
  and
  claude
  committed
  b4c3889
- docs(migration): list every item 0.9.0 hid, removed or made non_exhaustive
  
  runyourempire
  and
  claude
  committed
  198d234
- fix(bridge): a route glob's `?` matches a literal `?` (R5-JS4)
  
  runyourempire
  and
  claude
  committed
  b6244fc
- fix(bridge): cap uncaught-error messages, pristine addRoute parse, logs limit 0 (R5-JS5)
  
  runyourempire
  and
  claude
  committed
  c0df9ee
- fix(server): eval auto-return no longer drops statements after control-head regexes, `of`, non-ASCII names (R5-EVAL1)
  
  runyourempire
  and
  claude
  committed
  96d1083
- test(plugin): pin every registered command's sync-ness; correct the window-query budget comment (R5-TOOLS)
  
  runyourempire
  and
  claude
  committed
  13bcd88
- test(bridge): run the R5-JS1 projection tests from their own test binary
  
  runyourempire
  and
  claude
  committed
  5fd7056
- merge: round-5 server lane
  runyourempire
  committed
  f342044
- merge: round-5 clients lane
  runyourempire
  committed
  63c54f8
- merge: round-5 docs lane
  runyourempire
  committed
  b04cdb3
- merge: round-5 js lane
  runyourempire
  committed
  55f0319
- docs: round-5 CHANGELOG for the bridge, client and extension fixes; fix a private intra-doc link
  
  runyourempire
  and
  claude
  committed
  c1a5f5e
- ci, docs: rusqlite-range job asserts it reached the newest minor; honest MSRV note; reflow a CHANGELOG line (R5B-REL)
  
  runyourempire
  and
  claude
  committed
  ef22039
- fix(cli): victauri doctor exits 1 when any check FAILs (R5B-DOCTOR1)
  
  runyourempire
  and
  claude
  committed
  790af9d
- fix(css): allowlist-based remote-URL check for css inject (R5B-CSS1)
  
  runyourempire
  and
  claude
  committed
  ce6b51b
- fix(tools): expression tools accept a trailing `;` / comment; a wait_for parse error fails fast (R5B-EXPR1)
  
  runyourempire
  and
  claude
  committed
  99b46a4
- fix(tools): assert_semantic / verify_state read `undefined` as null (R5B-ASSERT1)
  
  runyourempire
  and
  claude
  committed
  f051e3f
- fix(bridge): animation scrub/sweep ops behind the agent key (R5B-SCRUBKEY1)
  
  runyourempire
  and
  claude
  committed
  f623128
- fix(plugin): adopt the real main thread when setup runs off it (R5B-MAIN1)
  
  runyourempire
  and
  claude
  committed
  53ba3e4
- docs(plugin): threading contract for probe/on_ready; honest round-trip bound (R5B-DOC-THREAD)
  
  runyourempire
  and
  claude
  committed
  bb9acc5
- fix(bridge): route rules match relative and absolute request URLs alike (R5B-ROUTEURL1)
  
  runyourempire
  and
  claude
  committed
  797e2e6
- fix(plugin): bound the page-callable IPC queries run on the UI thread (R5B-PAGEQ1)
  
  runyourempire
  and
  claude
  committed
  25c4631
- fix(tools): wait_for `timeout_ms: 0` is a single immediate check (R5B-WAIT0)
  
  runyourempire
  and
  claude
  committed
  cac5ec2
- fix(tools): `logs slow_ipc` honours `webview_label` (R5B-SLOWIPC1)
  
  runyourempire
  and
  claude
  committed
  d0a8750
- fix(bridge): one log entry per XHR request, listeners attached once (R5B-XHR1)
  
  runyourempire
  and
  claude
  committed
  33073eb
- fix(tools): `explain diff` counts every call and lists each command once (R5B-EXPLAIN1)
  
  runyourempire
  and
  claude
  committed
  a523560
- fix(cli): init prints paths without the Windows verbatim prefix (R5B-INIT1)
  
  runyourempire
  and
  claude
  committed
  7e17e98
- fix(cli): init's .mcp.json suggestion pins --app like the generated file (R5B-INIT2)
  
  runyourempire
  and
  claude
  committed
  830eff3
- fix(victauri-test): IPC checkpoints are u64 epoch milliseconds (R5B-CKPT1)
  
  runyourempire
  and
  claude
  committed
  2c7ce9b
- fix(victauri-test): the 401 hint names the real per-user token locations (R5B-HINT1)
  
  runyourempire
  and
  claude
  committed
  a306673
- fix(victauri-test): tool/JSON-RPC error text is sanitized when displayed (R5B-TERM3)
  
  runyourempire
  and
  claude
  committed
  41c3dab
- fix(victauri-test): the smoke suite never stops a recording it did not start (R5B-SMOKE1)
  
  runyourempire
  and
  claude
  committed
  bd7fd8b
- fix(cli): bridge liveness reuses victauri-test's hardened check, never PATH (R5B-BR7)
  
  runyourempire
  and
  claude
  committed
  9ca683e
- fix(bridge): fetch() interceptor passes arguments through exactly (R5B-FETCH0)
  
  runyourempire
  and
  claude
  committed
  7963470
- fix(cli): bridge handles requests concurrently (R5B-BR5)
  
  runyourempire
  and
  claude
  committed
  4857fac
- fix(tools): a page-refused interact/input/inspect/route-add is a tool error (R5B-ISERR1)
  
  runyourempire
  and
  claude
  committed
  6995452
- fix(cli): bridge confirms an --app backend's identity on /info (R5B-BR6)
  
  runyourempire
  and
  claude
  committed
  247f580
- fix(cli,victauri-test): VICTAURI_PORT and an app selector must agree (R5B-PORTAPP1)
  
  runyourempire
  and
  claude
  committed
  b1ea3ff
- fix(plugin): query_db runs only built-in or deterministic SQL functions (R5B-SQLFN1)
  
  runyourempire
  and
  claude
  committed
  98e0392
- fix(bridge): cap URLs stored in the network and route-match logs (R5B-DATAURL1)
  
  runyourempire
  and
  claude
  committed
  0a22b45
- fix(plugin): db_health never runs host-registered virtual-table module code (R5B-QC1)
  
  runyourempire
  and
  claude
  committed
  d878e97
- fix(plugin): accept an eval result only from the window it was sent to (R5B-EVALWIN1)
  
  runyourempire
  and
  claude
  committed
  959a902
- fix(plugin): redact URL credential params and keys in embedded/nested JSON (R5B-REDACT1)
  
  runyourempire
  and
  claude
  committed
  e81cd8d
- fix(tools): make the load-sensitive dispatch / probe / file-read tests deterministic (R5B-FLAKY)
  
  runyourempire
  and
  claude
  committed
  c0d4042
- fix(plugin): 10 s request-head deadline (was hyper's 30 s) (R5B-SLOWLORIS)
  
  runyourempire
  and
  claude
  committed
  20ca143
- fix(bridge): IPC body capture and page evals use the init-time JSON (R5B-PRISTINE1)
  
  runyourempire
  and
  claude
  committed
  8c9eb0c
- fix(discovery): Windows readers trust only discovery dirs the user owns (R5B-WINDISC1)
  
  runyourempire
  and
  claude
  committed
  806f33d
Commits on Sep 30, 2026
- fix(discovery): per-user home fallback when /tmp/victauri-<uid> is taken over (R5B-LINDISC1)
  
  runyourempire
  and
  claude
  committed
  507af94
- merge: round-5b tools lane (Lows)
  runyourempire
  committed
  8dc0021
- merge: round-5b js lane (Lows)
  runyourempire
  committed
  7c0c130
- merge: round-5b sec lane (Lows)
  runyourempire
  committed
  97c90b1
- merge: round-5b clients lane (Lows)
  runyourempire
  committed
  c5c1871
- fix: round-5b integration — client pool below the 10 s keep-alive, deterministic tests, docs
  
  runyourempire
  and
  claude
  committed
  72b7601
- fix(db): collapse a stray run of spaces in the function-list fallback log message
  
  runyourempire
  and
  claude
  committed
  ac1afad
- test(bridge): R5B-XHR1 waits for each request's real loadend (Windows CI)
  
  runyourempire
  and
  claude
  committed
  a981634
- test(bridge): R5B-XHR1 asserts the re-opened request finished, not how the host answered
  
  runyourempire
  and
  claude
  committed
  b5d8f4a
- release: 0.9.0 — CHANGELOG date
  
  runyourempire
  and
  claude
  committed
  3ccd94b

Commits

Commits on Sep 27, 2026

Commits on Sep 28, 2026

Commits on Sep 29, 2026