Repository navigation

feat(env): accept secret values on stdin with --value-stdin - #308

Merged

roodboi merged 89 commits into

nextfrom

wf/c1-stdin-b7

Oct 12, 2026

Merged

feat(env): accept secret values on stdin with --value-stdin#308
roodboi merged 89 commits into
nextfrom
wf/c1-stdin-b7

Commits on Oct 12, 2026
- docs: add versioned agent-client capability matrix and policy controls
  
  roodboi
  and
  claude
  committed
  d111802
- fix(mcp): harden run argv and tool input contract
  
  roodboi
  and
  claude
  committed
  58c485a
- fix(env): harden legacy env key files and AES-GCM envelope parsing
  
  roodboi
  and
  claude
  committed
  c6c0db3
- Merge remote-tracking branch 'origin/next' into w14-rework
  roodboi
  committed
  de862d7
- Merge remote-tracking branch 'origin/next' into w06-rework
  roodboi
  committed
  dc88c6b
- fix(agents): generate capability matrix doc and parse all guidance config
  
  roodboi
  and
  claude
  committed
  ffeecce
- fix(mcp): make typed refusals value-free and keep unknown-tool in-band
  
  roodboi
  and
  claude
  committed
  56bac3a
- chore: merge origin/next into wf/w15-w5-6
  
  roodboi
  and
  claude
  committed
  12e80af
- test(env): pin AES-GCM IV, size and tag-length guards with discriminating tests
  
  roodboi
  and
  claude
  committed
  cd76b26
- fix(init): stop writing repo-local agent files by default
  
  roodboi
  and
  claude
  committed
  bcf88ec
- fix(env): resolve --env base and default the same way on every command
  
  roodboi
  and
  claude
  committed
  c005262
- fix(agents): count corrupted and unreadable integrations as drift
  
  roodboi
  and
  claude
  committed
  6136946
- test(env): pin the console logger backend for CLI refusal tests
  
  roodboi
  and
  claude
  committed
  9854d1b
- test(mcp): assert closed ambiguous_project refusal in project-name suite
  
  roodboi
  and
  claude
  committed
  6e1ff63
- chore(x01): temporary witness cost trace for hosted measurement
  
  roodboi
  and
  claude
  committed
  1f8b51e
- perf(storage): coalesce witness helper work per native command
  
  roodboi
  and
  claude
  committed
  0911e6d
- chore(x01): revert temporary witness cost trace
  
  roodboi
  and
  claude
  committed
  eb9a678
- test(e2e): restore the networks scenario budget after witness coalescing
  
  roodboi
  and
  claude
  committed
  7b2ccfc
- Merge remote-tracking branch 'origin/next' into wf/x03-witness-probes
  roodboi
  committed
  fa7741c
- perf(storage): make witness engine and executable fences cheaper
  
  roodboi
  and
  claude
  committed
  37f093a
- chore(x03): temporary witness probe trace for hosted measurement
  
  roodboi
  and
  claude
  committed
  6a4e118
- fix(storage): keep closed probe cancellation for direct engine-ID fences
  
  roodboi
  and
  claude
  committed
  2b11ed3
- test(storage): pin witness fence counts and refusal controls
  
  roodboi
  and
  claude
  committed
  a777bc4
- chore(x03): revert temporary witness probe trace
  
  roodboi
  and
  claude
  committed
  994ddb8
- feat(agents): package offline skill references and the HACK-P pattern catalogue
  
  roodboi
  and
  claude
  committed
  3edbd54
- test(e2e): add agent-surface-freeze negative control for guidance writes
  
  roodboi
  and
  claude
  committed
  726cc27
- ci: add gated Bun crash experiment and read-only crash census
  
  roodboi
  and
  claude
  committed
  9b971fa
- perf(storage): read engine identity directly for docker context selections
  
  roodboi
  and
  claude
  committed
  1342871
- chore(x04): temporary witness probe trace for hosted measurement
  
  roodboi
  and
  claude
  committed
  c2ecf9c
- chore(x04): revert temporary witness probe trace
  
  roodboi
  and
  claude
  committed
  5cf9f0f
- test(agents): cover reference generation and reference-style and HTML skill links
  
  roodboi
  and
  claude
  committed
  ebe0539
- test: keep the Bun crash loop tests free of real crash reports
  
  roodboi
  and
  claude
  committed
  6b54980
- Merge branch 'next' into wf/w15-w5-6
  
  roodboi
  and
  claude
  committed
  7a05b84
- Merge branch 'next' into wf/w06-w5-3
  
  roodboi
  and
  claude
  committed
  c00468c
- Merge branch 'next' into wf/w13-w5b-2
  
  roodboi
  and
  claude
  committed
  e9b1252
- Merge branch 'next' into wf/w10-w5b-0
  
  roodboi
  and
  claude
  committed
  af786b5
- Merge branch 'next' into wf/w14-w5-5
  
  roodboi
  and
  claude
  committed
  9db4dba
- Merge remote-tracking branch 'origin/wf/w06-w5-3' into train/queue-preview
  roodboi
  committed
  5a731cc
- Merge remote-tracking branch 'origin/wf/w14-w5-5' into train/queue-preview
  roodboi
  committed
  38d9d7f
- Merge remote-tracking branch 'origin/wf/w15-w5-6' into train/queue-preview
  roodboi
  committed
  d50e935
- Merge remote-tracking branch 'origin/wf/w10-w5b-0' into train/queue-preview
  roodboi
  committed
  8bab674
- Merge remote-tracking branch 'origin/wf/w13-w5b-2' into train/queue-preview
  roodboi
  committed
  26958c9
- Merge remote-tracking branch 'origin/wf/w07-w6-3' into train/queue-preview
  roodboi
  committed
  07a1834
- Merge remote-tracking branch 'origin/wf/w02-w6-1' into train/queue-preview
  roodboi
  committed
  a92e3ab
- Merge remote-tracking branch 'origin/wf/w05-w6-2' into train/queue-preview
  roodboi
  committed
  3e261d5
- test(patterns): add validated HACK-P01 and HACK-P02 example fixtures
  
  roodboi
  and
  claude
  committed
  6b22e00
- feat(exec): warn value-free when a running service's env changed since start
  
  roodboi
  and
  claude
  committed
  b07121f
- fix(env): write .hack/.env and the encrypted store atomically with 0600
  
  roodboi
  and
  claude
  committed
  9f20366
- fix(mcp): separate log cutoffs from backend failures
  
  roodboi
  and
  claude
  committed
  42e7b3b
- fix(mcp): align budget docs with log cutoffs and keep byte-cut failures
  
  roodboi
  and
  claude
  committed
  e2c41a9
- feat(mcp): add exec, doctor, env explain/keys and instances tools
  
  roodboi
  and
  claude
  committed
  cea44f8
- fix(ci): allowlist the synthetic MCP inspect-tool canary for gitleaks
  
  roodboi
  and
  claude
  committed
  85c67b0
- fix(agents): point the env matrix bullet at the offline env guide
  
  roodboi
  and
  claude
  committed
  10b6d73
- Merge remote-tracking branch 'origin/wf/w13-w5b-2' into train/queue-preview
  roodboi
  committed
  77da332
- test(exec): cover failed targeted restart env digest handling
  
  roodboi
  and
  claude
  committed
  4e3acee
- fix(env): scope the env-file symlink refusal doc to write paths
  
  roodboi
  and
  claude
  committed
  cb665d5
- docs(mcp): clarify which instances hack.project.instances lists
  
  roodboi
  and
  claude
  committed
  3a6f73c
- chore: merge train/queue-preview into wf/y3-envfile-b6
  
  roodboi
  and
  claude
  committed
  c2b41ff
- chore: merge train/queue-preview into wf/y1-logs-b6
  
  roodboi
  and
  claude
  committed
  d9a5627
- Merge remote-tracking branch 'origin/train/queue-preview' into wf/y4-patterns-b6
  
  roodboi
  and
  claude
  committed
  09b4e83
- Merge remote-tracking branch 'origin/train/queue-preview' into wf/y5-staleenv-b6
  
  roodboi
  and
  claude
  committed
  5afaf19
- test(e2e): keep Hack diagnostics out of exec-stale-env probe output
  
  roodboi
  and
  claude
  committed
  36cd272
- chore: merge wf/y1-logs-b6 into wf/y2-mcptools-b6
  
  roodboi
  and
  claude
  committed
  b9ae28c
- test(e2e): reproduce dependency config-hash drift for hack run/exec
  
  roodboi
  and
  claude
  committed
  919de8b
- feat(env): accept secret values on stdin with --value-stdin
  
  roodboi
  and
  claude
  committed
  de55236
- feat(doctor): add value-free env key strength diagnostic
  
  roodboi
  and
  claude
  committed
  5078855
- fix(logger): pass messages to gum after an end-of-options marker
  
  roodboi
  and
  claude
  committed
  5f8cb79
- fix(env): refuse invalid env key arguments without echoing them
  
  roodboi
  and
  claude
  committed
  378f75f
- fix(env): refuse env scope arguments without echoing them
  
  roodboi
  and
  claude
  committed
  4acac81
- fix(env): refuse value-bearing --env, --project and --target without echoing them
  
  roodboi
  and
  claude
  committed
  b1bc6db
- Merge branch 'next' into wf/c5-confighash-b7
  
  roodboi
  and
  claude
  committed
  0a26c64
- Merge branch 'next' into wf/c4-keydiag-b7
  
  roodboi
  and
  claude
  committed
  07413d0
- Merge branch 'next' into wf/c6-gum-dash-b7
  
  roodboi
  and
  claude
  committed
  6a043c0
- Merge branch 'next' into wf/y4-patterns-b6
  
  roodboi
  and
  claude
  committed
  13165f9
- Merge branch 'next' into wf/y5-staleenv-b6
  
  roodboi
  and
  claude
  committed
  92c2ee1
- Merge branch 'next' into wf/y3-envfile-b6
  
  roodboi
  and
  claude
  committed
  4243d60
- Merge branch 'next' into wf/y1-logs-b6
  
  roodboi
  and
  claude
  committed
  c044445
- Merge branch 'wf/y1-logs-b6' into wf/y2-mcptools-b6
  
  roodboi
  and
  claude
  committed
  6dadbe5
- Merge branch 'next' into wf/c1-stdin-b7
  
  roodboi
  and
  claude
  committed
  ed7d2f4
- Merge branch 'wf/c6-gum-dash-b7' into wf/y3-envfile-b6
  
  roodboi
  and
  claude
  committed
  989fcea
- Merge branch 'wf/y3-envfile-b6' into wf/c4-keydiag-b7
  
  roodboi
  and
  claude
  committed
  c6055dd
- Merge branch 'wf/c4-keydiag-b7' into wf/y4-patterns-b6
  
  roodboi
  and
  claude
  committed
  6a754df
- Merge branch 'wf/y4-patterns-b6' into wf/c5-confighash-b7
  
  roodboi
  and
  claude
  committed
  ef04f02
- Merge branch 'wf/c5-confighash-b7' into wf/y5-staleenv-b6
  
  roodboi
  and
  claude
  committed
  b0cde14
- Merge branch 'wf/y5-staleenv-b6' into wf/y1-logs-b6
  
  roodboi
  and
  claude
  committed
  5a258e6
- Merge branch 'wf/y1-logs-b6' into wf/y2-mcptools-b6
  
  roodboi
  and
  claude
  committed
  642775e
- Merge branch 'wf/y2-mcptools-b6' into wf/c1-stdin-b7
  
  roodboi
  and
  claude
  committed
  2fa96a2
- test(native): use a canonical overlay name in the env selection case
  
  roodboi
  and
  claude
  committed
  63e1d39
- Merge branch 'next' into wf/c1-stdin-b7
  
  roodboi
  and
  claude
  committed
  d25d8c0

Commits

Commits on Oct 12, 2026