From 69e6e3fb0badca08aed77b3c4e2165b5236515a9 Mon Sep 17 00:00:00 2001 From: askalf <263217947+askalf@users.noreply.github.com> Date: Thu, 24 Sep 2026 21:38:32 -0400 Subject: [PATCH] release: 0.10.4 Bumps the version to 0.10.4. On merge, auto-release.yml tags v0.10.4, cuts the GitHub release from the new CHANGELOG section and dispatches publish.yml to npm. The Windows EPERM lock-guard fix (#197) is the only change to shipped code since 0.10.3, and it reaches users only in a release. The pinned version in the docs and issue templates moves with it; docker/ stays on 0.10.3 until 0.10.4 is on npm. --- .github/ISSUE_TEMPLATE/bug.yml | 2 +- .github/ISSUE_TEMPLATE/false-positive.yml | 2 +- CHANGELOG.md | 10 ++++++++++ README.md | 2 +- docs/claude-code.md | 2 +- docs/commands.md | 2 +- package-lock.json | 4 ++-- package.json | 2 +- 8 files changed, 18 insertions(+), 8 deletions(-) diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml index 6d943a6..6372870 100644 --- a/.github/ISSUE_TEMPLATE/bug.yml +++ b/.github/ISSUE_TEMPLATE/bug.yml @@ -40,7 +40,7 @@ body: id: version attributes: label: truecopy version - placeholder: '0.10.3 (`truecopy --version`)' + placeholder: '0.10.4 (`truecopy --version`)' validations: required: true diff --git a/.github/ISSUE_TEMPLATE/false-positive.yml b/.github/ISSUE_TEMPLATE/false-positive.yml index 5814955..dede754 100644 --- a/.github/ISSUE_TEMPLATE/false-positive.yml +++ b/.github/ISSUE_TEMPLATE/false-positive.yml @@ -48,6 +48,6 @@ body: id: version attributes: label: truecopy version - placeholder: '0.10.3 (`truecopy --version`)' + placeholder: '0.10.4 (`truecopy --version`)' validations: required: false diff --git a/CHANGELOG.md b/CHANGELOG.md index cc565b6..f6f351c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,9 +6,19 @@ adheres to [Semantic Versioning](https://semver.org/). ## [Unreleased] +## [0.10.4] - 2026-09-25 + ### Fixed - **Concurrent `add`s on Windows no longer fail with `EPERM` on the lock guard.** `open(wx)` on a guard that another process is unlinking at that instant returns `EPERM` on Windows (delete-pending), not `EEXIST`; `acquire()` treated it as fatal, so one of several simultaneous pins exited 1 while the lock itself was correct (CI run 35579991225, windows-latest). `EPERM` / `EACCES` / `EBUSY` from the guard open are now contention and retried like `EEXIST`. Because those two codes can also mean a permanent ACL denial, the retry window is bounded: a guard that can be neither created nor stat'ed is retried for `waitMs` and then reports the original `EACCES`/`EPERM` instead of looping forever. Regression tests inject each code, cover a persistent denial and a recovering stat, and hammer one guard from six processes. +### Changed +- **The README npm and Glama render is the current one.** Both mirror the copy + in the published tarball, so the restructured README (proof first, reference + moved to `docs/`), the hero art and the current agent-security stack + (redstamp · truecopy · plumbline) reach them only with a release. The watch + figure is refreshed to the 2026-09-25 run (314 plugins · 2,442 skills · 0 + under review · 475 advisories). + ## [0.10.3] - 2026-08-05 ### Security diff --git a/README.md b/README.md index 9591503..97d24ef 100644 --- a/README.md +++ b/README.md @@ -72,7 +72,7 @@ Deterministic and offline. truecopy shares **[redstamp](https://github.com/askal truecopy has poison-scanned **68,560 skills**: the official Claude Code plugin directory plus nine community marketplaces ([2,019 skills, zero poisoned](https://sprayberrylabs.com/blog/auditing-the-skills-supply-chain)) and the entire ClawHub registry — the marketplace whose poisoning incident started the category ([66,541 skills, zero confirmed malicious](https://sprayberrylabs.com/blog/the-marketplace-that-started-the-panic)). -And the audit never stopped: a standing watch re-scans the full official plugin directory **every day** and publishes each snapshot to [`WATCH.md`](https://github.com/askalf/truecopy/blob/watch/WATCH.md) and the **[live observatory → truecopy.sprayberrylabs.com](https://truecopy.sprayberrylabs.com)**. The 2026-09-22 run scanned **310 plugins · 2,400 skills**: **0 under review**, 468 advisories. Check your own installed plugin skills against exactly the bytes the watch vetted with `truecopy check-manifest`: [docs/watch.md](docs/watch.md). +And the audit never stopped: a standing watch re-scans the full official plugin directory **every day** and publishes each snapshot to [`WATCH.md`](https://github.com/askalf/truecopy/blob/watch/WATCH.md) and the **[live observatory → truecopy.sprayberrylabs.com](https://truecopy.sprayberrylabs.com)**. The 2026-09-25 run scanned **314 plugins · 2,442 skills**: **0 under review**, 475 advisories. Check your own installed plugin skills against exactly the bytes the watch vetted with `truecopy check-manifest`: [docs/watch.md](docs/watch.md). ## What it gates diff --git a/docs/claude-code.md b/docs/claude-code.md index 7633cd9..99121db 100644 --- a/docs/claude-code.md +++ b/docs/claude-code.md @@ -18,7 +18,7 @@ truecopy scan --marketplace ./clone # audit a marketplace or plugin repo you "hooks": { "PreToolUse": [ { "matcher": "Skill", - "hooks": [{ "type": "command", "command": "npx -y github:askalf/truecopy#v0.10.3 hook claude", "timeout": 20 }] } + "hooks": [{ "type": "command", "command": "npx -y github:askalf/truecopy#v0.10.4 hook claude", "timeout": 20 }] } ] } } diff --git a/docs/commands.md b/docs/commands.md index 79ba641..5dfaf97 100644 --- a/docs/commands.md +++ b/docs/commands.md @@ -4,7 +4,7 @@ ```bash npm i -g @askalf/truecopy # latest, from npm -npm i -g @askalf/truecopy@0.10.3 # pinned release +npm i -g @askalf/truecopy@0.10.4 # pinned release ``` > Also installable straight from GitHub: `npm i -g github:askalf/truecopy`. Every command below runs one-shot with `npx -y @askalf/truecopy` (or `npx -y github:askalf/truecopy`). diff --git a/package-lock.json b/package-lock.json index 535ade6..3273d4c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@askalf/truecopy", - "version": "0.10.3", + "version": "0.10.4", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@askalf/truecopy", - "version": "0.10.3", + "version": "0.10.4", "license": "MIT", "dependencies": { "@askalf/redstamp": "https://github.com/askalf/redstamp/releases/download/v0.7.5/askalf-redstamp-0.7.5.tgz" diff --git a/package.json b/package.json index 86dd01b..489167a 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@askalf/truecopy", - "version": "0.10.3", + "version": "0.10.4", "description": "own your agent skills — vet, sign, and pin every skill & MCP server before it runs. The supply-chain gate for AI agents. Part of Own Your Stack.", "type": "module", "bin": {