Changelog
26 releases shipped — every feature, fix, and security improvement on the record. Latest: v0.15.0 on 2026-08-05.
Showing 26 releases matching any change
v0.15.0
2026-08-05
Latest11 changes- added`qring://` secret references — committable pointers that go in a .env file instead of the value: `qring://project/KEY`, `qring://global/KEY`, `qring:///KEY` (auto scope: project → global), `?env=` to pin an environment; the key lives in the path (never the host, which URL parsers lowercase), and malformed refs fail loudly instead of leaking a literal `qring://…` string into a child process
- added`qring run -- <cmd>` — least-privilege sibling of `exec` that injects only what the project declares (the `.q-ring.json` secrets manifest plus `qring://` refs found in .env files) rather than the whole scope, with fail-fast on missing required keys, the same output redaction as `exec`, and a `--dry-run` injection plan
- added`qring setup <cursor|kiro|claude>` — wires the q-ring MCP server into the editor's MCP config in one command, merged non-destructively (other servers preserved; a diverging q-ring entry requires --force); the Kiro entry ships the read-only autoApprove list
- added`qring push <github|vercel|cloudflare>` — pushes manifest secrets to GitHub Actions, Vercel envs, or Cloudflare Workers through each platform's own authenticated CLI (gh / vercel / wrangler); q-ring never holds platform tokens, values travel over stdin (never argv), and every pushed key lands in the audit chain as a new `push` action
- addedAI-stack liveness providers — anthropic, openrouter, google-ai (Gemini), groq, huggingface, plus explicit-only elevenlabs and vercel; keys are only ever sent in headers, never URLs
- addedEncrypted file backend (QRING_BACKEND=file) for hosts with no OS keyring — AES-256-GCM store keyed by PBKDF2 from QRING_FILE_PASSPHRASE, explicit-only and fail-closed without the passphrase; secrets, the audit anchor, and the agent-memory key all route through it
- addedApproval notifications — an MCP read blocked on requiresApproval raises a desktop notification (Linux notify-send, macOS osascript) naming the key and the exact `qring approve` command, throttled per key; disable with QRING_NOTIFY=off
- addedPublic threat model (docs/threat-model.md) — assets, trust boundaries, attackers considered, per-surface mitigations, honest non-goals, and production-key hardening recommendations, linked from the README Security section
- changedSmithery publishing is now part of the release pipeline — CI builds the cross-platform MCPB bundle after npm serves the release, attaches it to the GitHub release, and republishes the Smithery listing automatically
- fixedwithFileLock no longer swallows exceptions thrown inside its critical section (they resurfaced ~8s later as a bogus lock-timeout error)
- fixedAnthropic and OpenRouter keys no longer misdetect as OpenAI in provider auto-detection (sk-ant- and sk-or- now register ahead of the bare sk- prefix)
v0.14.1
2026-08-03
4 changes- added`PRIVACY.md` — local-first privacy policy (secrets in the OS vault, `0600` local files, no telemetry, no network calls except user-configured JIT providers), linked from the Kiro plugin's new "License and support" footer alongside the SPDX license, support, and security-policy links directory submissions require
- changedREADME pass — replaced the unverifiable "first quantum-inspired keyring" tagline with the canonical one-liner, added a Security section (local-first posture, v0.14 hardening, disclosure process), and updated exec-profile / audit-chain / policy-validation descriptions to match the v0.14 behavior they undersold
- changedBrand asset kit now ships in the npm package — vector mark SVGs (mark.svg, mark-mono.svg, mark-small.svg), square icons, and the regenerated social card (the v0.14.0 tarball predated the site rollout sync and kept serving old card art on npm/unpkg)
- changedREADME hero image is served from the repo (raw.githubusercontent.com on main) instead of the unpkg tarball path, so future brand updates land without waiting for a publish; added the Discord community badge
v0.14.0
2026-08-01
15 changes- securityEntanglement can no longer be used as a policy-bypass write primitive — `entangle_secrets` was gated only by the coarse tool policy, and `set_secret`'s propagation loop wrote entangled targets with no policy check at all; both keys are now checked against key-level policy at entangle time, and every MCP-sourced propagation re-checks the target's policy before writing
- securityApprovals are now bound to the resolved project, not the coarse scope label — an approval for a key at --scope project in one project could no longer satisfy the same key's approval gate in a different project; approvals now carry (and HMAC-cover) the resolved service identity
- security`exec_with_secrets`'s restricted profile now denies interpreters and shells (python, node, deno, bun, perl, ruby, php, sh, bash, zsh) in addition to network tools, closing the `python -c '…'` egress path around the network block; the tool description now states the real (still-not-a-sandbox) guarantee
- securityAgent memory no longer falls back to a machine-derivable key when the OS keyring is unavailable — writes now use the keyring key, else a PBKDF2 key from QRING_MEMORY_PASSPHRASE, else fail closed (the old key is used only to read pre-existing stores)
- securityThe audit hash chain is now tamper-evident against truncation and rewrite — a keyed HMAC anchor stored outside the log backs `audit:verify`; keyring-unavailable hosts degrade to per-line checks with a one-time warning
- securityaudit.jsonl and agent-memory.enc (and their directories) are now created owner-only (0600/0700), with a best-effort chmod tightening files left world-readable by older versions
- securityRedactionTransform no longer leaks multi-byte secrets split across output chunks — chunk decoding now uses StringDecoder instead of raw toString()
- changed`.q-ring.json` policy is validated with a strict schema and fails closed — an invalid policy object now raises a PolicyConfigError instead of silently allowing a mistyped rule (e.g. denytools for denyTools)
- changed`qring doctor` reports pre-v0.14 approvals that lack a project binding and won't grant access until re-granted. Breaking: approvals granted before this release are invalidated — re-run `qring approve <key>` (most self-resolve within the default 1h TTL)
- changedBreaking: the restricted exec profile now blocks interpreters and shells by default — define a custom profile in .q-ring.json or use the ci/unrestricted profile to run them with secrets
- changedBrand asset kit refresh — new constructed vector mark, square icons, GitHub social preview, and a lighter OG card; npm keywords expanded for MCP-directory discoverability
- changedCleared all high/moderate advisories from the audit gate (fast-uri, @hono/node-server, postcss, and a new brace-expansion override)
- fixedCorrupt registry files no longer silently wipe your data — entanglement.json, approvals.json, and hooks.json are moved aside to <path>.corrupt-<timestamp> instead of being overwritten with an empty registry on the next write
- fixedThe JIT provisioning lock no longer busy-waits or deadlocks — a shared file-lock util steals locks held by a dead process or older than the stale window, and sleeps via Atomics.wait instead of spinning the CPU
- fixedConcurrent writes are no longer clobbered by the read-time access counter, and environment collapse (git branch + .q-ring.json) is now cached per-cwd instead of re-shelling out on every call
v0.13.1
2026-07-27
3 changes- securityHardened SSRF IP-literal matching for IPv6-mapped forms — the private/loopback/link-local guard now parses addresses structurally via ipaddr.js instead of regex, closing a bypass where IPv4-mapped IPv6 forms (e.g. [::ffff:127.0.0.1]) slipped past the dotted-decimal-only match across all four guard entry points (SSRF checks, the connect-time DNS-rebinding guard, and JIT HTTP provisioning)
- fixed`exec_with_secrets`'s restricted profile description now states the real guarantee — it denies a fixed list of network-tool binaries and strips proxy env vars but doesn't restrict PATH; interpreters invoked directly could still perform network I/O and read injected secrets (no behavior change; hardened in 0.14.0)
- changedipaddr.js promoted to a direct dependency, backing the SSRF hardening above (already present transitively; the published runtime dependency set is otherwise unchanged)
v0.13.0
2026-07-11
10 changes- addedClaude Code plugin is now a real installable plugin — `/plugin marketplace add I4cTime/quantum_ring` then `/plugin install qring@q-ring` registers the MCP server, 8 slash commands, 2 subagents, 5 skills, and 3 safety hooks in one step (previously a file-copy sync script)
- added`qring doctor` — one-shot install diagnosis: keyring-backend round-trip probe (the headless-Linux failure mode), audit-dir writability + hash-chain integrity, `.q-ring.json` validity, active policy, and `qring-mcp` on `PATH`; supports `--json`, exits 1 on any failed check
- added`qring completion bash|zsh|fish` — shell completions generated from the live command tree so they can never drift, plus `qring has <key>` for script-friendly, decay-aware existence checks (exit 0/1, `--quiet`)
- added`--json` is honored by ~20 more commands — list, inspect, delete, import, audit, audit:verify, health, analyze, recall, check, env, validate, rotate, tunnel list, hook list, approvals, scan, lint all emit `{ ok, data }`, making the whole read surface scriptable (previously 4 commands)
- changedDestructive operations now confirm before proceeding — delete, forget --all, teleport unpack (overwriting existing keys), wizard (regenerating existing keys), and env:generate -o (existing file) prompt on a TTY and require `-y`/`--yes` non-interactively instead of silently proceeding
- changedCLI errors are one-line messages instead of stack traces (set `QRING_DEBUG=1` for the full stack), and piped stdin works for `qring set KEY` instead of hanging
- addedDashboard: entangled secrets render as a live SVG node/edge graph, and the audit log card shows hash-chain integrity in real time — green when intact, red with the break position when tampered
- securityDashboard responses now enforce real security headers — default-deny Content-Security-Policy, X-Frame-Options: DENY, nosniff, Referrer-Policy: no-referrer (keeps the `?token=` URL out of Referer headers), and Cache-Control: no-store
- addedDocs: troubleshooting guide (keyring backends, MCP connection per editor, approval gate, policy pinning), five-minute quickstarts for Claude Code / Cursor / Kiro, Docker install instructions, and CONTRIBUTING.md
- changedTag-driven release automation (`release:prepare` + a v* tag runs GitHub Release → npm with provenance → MCP Registry → Homebrew), a CI parity guard keeping the three editor plugins/tool counts/versions in lockstep, cross-platform CI (macOS + Windows keyring backends now exercised), and all dependency majors updated (commander 15, eslint 10) with the js-yaml advisory fixed