Changelog
28 releases shipped — every feature, fix, and security improvement on the record. Latest: v0.16.1 on 2026-08-17.
Showing 28 releases matching any change
v0.16.1
2026-08-17
Latest1 change- changedRicher MCP Registry listing — server.json now carries the optional metadata registries render: title, websiteUrl (qring.i4c.studio), brand icons, an npx runtime hint, and declarations for the three install-relevant environment variables (QRING_BACKEND, QRING_FILE_PASSPHRASE, QRING_FILE_BACKEND_PATH), so MCP clients and directories can render a proper config form instead of a bare package name; no runtime changes
v0.16.0
2026-08-17
3 changes- addedCanary honeytokens (`qring canary plant <key>`, `qring canary list`) — plants a fake credential that stores and reads like a real secret with no tell, while every read fires a desktop alert and lands in the tamper-evident audit chain as a new `canary` action; values are CSPRNG noise in realistic provider shapes (aws matching AKIA…, github, openai, anthropic, stripe, generic) or bring-your-own via --value, planting refuses to overwrite a real secret without --force, and alerts are throttled per key while audit events never are
- addedMCP airlock (`qring mcp wrap -- <server command>`) — runs a third-party MCP server as a child and re-exposes it over stdio with q-ring in the middle: the wrapped server is spawned with a minimal safe environment instead of the parent env (opt out with --inherit-env), and every tool call crossing the airlock becomes a `wrap` audit event with a per-session correlation id; tool arguments are deliberately never logged since they may contain secrets
- addedPer-agent identity in the audit chain — MCP sessions stamp audit events with the client's clientInfo (name@version) captured at the initialize handshake, surfaced as a new `agent` field in `qring audit` output, queries, and CSV exports; the label is client-supplied and trivially spoofable, so it is attribution metadata only and never feeds policy, approvals, or authorization
v0.15.0
2026-08-05
11 changes- added`qring://` secret references — committable pointers that go in a .env file instead of the value: `qring://project/KEY`, `qring://global/KEY`, `qring:///KEY` (auto scope: project → global), `?env=` to pin an environment; the key lives in the path (never the host, which URL parsers lowercase), and malformed refs fail loudly instead of leaking a literal `qring://…` string into a child process
- added`qring run -- <cmd>` — least-privilege sibling of `exec` that injects only what the project declares (the `.q-ring.json` secrets manifest plus `qring://` refs found in .env files) rather than the whole scope, with fail-fast on missing required keys, the same output redaction as `exec`, and a `--dry-run` injection plan
- added`qring setup <cursor|kiro|claude>` — wires the q-ring MCP server into the editor's MCP config in one command, merged non-destructively (other servers preserved; a diverging q-ring entry requires --force); the Kiro entry ships the read-only autoApprove list
- added`qring push <github|vercel|cloudflare>` — pushes manifest secrets to GitHub Actions, Vercel envs, or Cloudflare Workers through each platform's own authenticated CLI (gh / vercel / wrangler); q-ring never holds platform tokens, values travel over stdin (never argv), and every pushed key lands in the audit chain as a new `push` action
- addedAI-stack liveness providers — anthropic, openrouter, google-ai (Gemini), groq, huggingface, plus explicit-only elevenlabs and vercel; keys are only ever sent in headers, never URLs
- addedEncrypted file backend (QRING_BACKEND=file) for hosts with no OS keyring — AES-256-GCM store keyed by PBKDF2 from QRING_FILE_PASSPHRASE, explicit-only and fail-closed without the passphrase; secrets, the audit anchor, and the agent-memory key all route through it
- addedApproval notifications — an MCP read blocked on requiresApproval raises a desktop notification (Linux notify-send, macOS osascript) naming the key and the exact `qring approve` command, throttled per key; disable with QRING_NOTIFY=off
- addedPublic threat model (docs/threat-model.md) — assets, trust boundaries, attackers considered, per-surface mitigations, honest non-goals, and production-key hardening recommendations, linked from the README Security section
- changedSmithery publishing is now part of the release pipeline — CI builds the cross-platform MCPB bundle after npm serves the release, attaches it to the GitHub release, and republishes the Smithery listing automatically
- fixedwithFileLock no longer swallows exceptions thrown inside its critical section (they resurfaced ~8s later as a bogus lock-timeout error)
- fixedAnthropic and OpenRouter keys no longer misdetect as OpenAI in provider auto-detection (sk-ant- and sk-or- now register ahead of the bare sk- prefix)
v0.14.1
2026-08-03
4 changes- added`PRIVACY.md` — local-first privacy policy (secrets in the OS vault, `0600` local files, no telemetry, no network calls except user-configured JIT providers), linked from the Kiro plugin's new "License and support" footer alongside the SPDX license, support, and security-policy links directory submissions require
- changedREADME pass — replaced the unverifiable "first quantum-inspired keyring" tagline with the canonical one-liner, added a Security section (local-first posture, v0.14 hardening, disclosure process), and updated exec-profile / audit-chain / policy-validation descriptions to match the v0.14 behavior they undersold
- changedBrand asset kit now ships in the npm package — vector mark SVGs (mark.svg, mark-mono.svg, mark-small.svg), square icons, and the regenerated social card (the v0.14.0 tarball predated the site rollout sync and kept serving old card art on npm/unpkg)
- changedREADME hero image is served from the repo (raw.githubusercontent.com on main) instead of the unpkg tarball path, so future brand updates land without waiting for a publish; added the Discord community badge
v0.14.0
2026-08-01
15 changes- securityEntanglement can no longer be used as a policy-bypass write primitive — `entangle_secrets` was gated only by the coarse tool policy, and `set_secret`'s propagation loop wrote entangled targets with no policy check at all; both keys are now checked against key-level policy at entangle time, and every MCP-sourced propagation re-checks the target's policy before writing
- securityApprovals are now bound to the resolved project, not the coarse scope label — an approval for a key at --scope project in one project could no longer satisfy the same key's approval gate in a different project; approvals now carry (and HMAC-cover) the resolved service identity
- security`exec_with_secrets`'s restricted profile now denies interpreters and shells (python, node, deno, bun, perl, ruby, php, sh, bash, zsh) in addition to network tools, closing the `python -c '…'` egress path around the network block; the tool description now states the real (still-not-a-sandbox) guarantee
- securityAgent memory no longer falls back to a machine-derivable key when the OS keyring is unavailable — writes now use the keyring key, else a PBKDF2 key from QRING_MEMORY_PASSPHRASE, else fail closed (the old key is used only to read pre-existing stores)
- securityThe audit hash chain is now tamper-evident against truncation and rewrite — a keyed HMAC anchor stored outside the log backs `audit:verify`; keyring-unavailable hosts degrade to per-line checks with a one-time warning
- securityaudit.jsonl and agent-memory.enc (and their directories) are now created owner-only (0600/0700), with a best-effort chmod tightening files left world-readable by older versions
- securityRedactionTransform no longer leaks multi-byte secrets split across output chunks — chunk decoding now uses StringDecoder instead of raw toString()
- changed`.q-ring.json` policy is validated with a strict schema and fails closed — an invalid policy object now raises a PolicyConfigError instead of silently allowing a mistyped rule (e.g. denytools for denyTools)
- changed`qring doctor` reports pre-v0.14 approvals that lack a project binding and won't grant access until re-granted. Breaking: approvals granted before this release are invalidated — re-run `qring approve <key>` (most self-resolve within the default 1h TTL)
- changedBreaking: the restricted exec profile now blocks interpreters and shells by default — define a custom profile in .q-ring.json or use the ci/unrestricted profile to run them with secrets
- changedBrand asset kit refresh — new constructed vector mark, square icons, GitHub social preview, and a lighter OG card; npm keywords expanded for MCP-directory discoverability
- changedCleared all high/moderate advisories from the audit gate (fast-uri, @hono/node-server, postcss, and a new brace-expansion override)
- fixedCorrupt registry files no longer silently wipe your data — entanglement.json, approvals.json, and hooks.json are moved aside to <path>.corrupt-<timestamp> instead of being overwritten with an empty registry on the next write
- fixedThe JIT provisioning lock no longer busy-waits or deadlocks — a shared file-lock util steals locks held by a dead process or older than the stale window, and sleeps via Atomics.wait instead of spinning the CPU
- fixedConcurrent writes are no longer clobbered by the read-time access counter, and environment collapse (git branch + .q-ring.json) is now cached per-cwd instead of re-shelling out on every call