From 93e51c70ab2a51523f119982c05ce61f2ffa2453 Mon Sep 17 00:00:00 2001 From: Jacob Stephens Date: Mon, 7 Sep 2026 17:00:46 -0400 Subject: [PATCH] Release v0.4.22: pin installer after Bitwarden launch lookup reuse #101: Bitwarden harness launches were listing the full vault separately for every named or project-qualified reference. Reuse parsed lookup metadata within one manifest resolution. UUID-only and empty manifests skip listing, and every launch still fetches current secret values. Also includes #99: fail closed on glued Bitwarden refs from bash 0.3.0 refresh. --- AGENTS.md | 8 ++++---- Cargo.lock | 2 +- Cargo.toml | 2 +- MIGRATION.md | 2 +- README.md | 8 ++++---- install-remote.sh | 2 +- 6 files changed, 12 insertions(+), 12 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index ced54ea..773ddd9 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -12,13 +12,13 @@ Also hosted: https://vaultedagent.com/AGENTS.md Glossary for domain terms (harness, manifest, backend, …): [CONTEXT.md](CONTEXT.md). -Current release pin (product install): **v0.4.21** +Current release pin (product install): **v0.4.22** ```bash curl -fsSL https://vaultedagent.com/install.sh | bash # pin: -VAULTED_AGENT_VERSION=v0.4.21 curl -fsSL https://vaultedagent.com/install.sh | bash -vaulted-agent version # expect 0.4.21 (git stamp may appear in parentheses) +VAULTED_AGENT_VERSION=v0.4.22 curl -fsSL https://vaultedagent.com/install.sh | bash +vaulted-agent version # expect 0.4.22 (git stamp may appear in parentheses) ``` ## What you must not do @@ -80,7 +80,7 @@ elevated launches always read the machine config dir). | Auth mode | `va auth-mode` / `va auth-mode prompt` / `va auth-mode file` | | Interactive install-time config | `va setup` | | Store / rotate the manager token | `printf %s "$TOKEN" \| sudo va setup bitwarden --set-token` | -| Replace the installed launcher binary | `va update` (latest GitHub release) / `va update v0.4.21` | +| Replace the installed launcher binary | `va update` (latest GitHub release) / `va update v0.4.22` | | Uninstall | `sudo va uninstall` | Launcher flags **before** the harness name: `-p` / `--prompt-auth`, diff --git a/Cargo.lock b/Cargo.lock index 701d72b..1d999ed 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -290,7 +290,7 @@ dependencies = [ [[package]] name = "vaulted-agent" -version = "0.4.21" +version = "0.4.22" dependencies = [ "rpassword", "serde_json", diff --git a/Cargo.toml b/Cargo.toml index 06d9bc9..0ca9743 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "vaulted-agent" -version = "0.4.21" +version = "0.4.22" edition = "2021" description = "Launch AI coding agents with vault-resolved secrets in-process" license = "MIT" diff --git a/MIGRATION.md b/MIGRATION.md index 028804f..4c60b0b 100644 --- a/MIGRATION.md +++ b/MIGRATION.md @@ -24,7 +24,7 @@ refresh. `va update` (or a reinstall) is the way off that writer. `va update` downloads a GitHub release asset for this OS/arch and overwrites the running launcher (`current_exe`, usually `/usr/local/bin/vaulted-agent`). Default target is `VAULTED_AGENT_VERSION`, else the latest GitHub release. -`va update v0.4.21` pins. `--check` and `--dry-run` write nothing. +`va update v0.4.22` pins. `--check` and `--dry-run` write nothing. This is not `install.sh`. Harnesses, manifests, and token files stay put. If the dest is not writable, it retries with `sudo install`. `va` and diff --git a/README.md b/README.md index 5271041..319044c 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,7 @@ auth**: paste the vault token at each launch so even the manager token need not live on disk. Same scrub/resolve/exec path for one-shot tools via `va run`. **macOS and Linux.** Product page: [vaultedagent.com](https://vaultedagent.com/) · -Latest: [v0.4.21](https://github.com/JacobStephens2/vaulted-agent/releases/tag/v0.4.21) +Latest: [v0.4.22](https://github.com/JacobStephens2/vaulted-agent/releases/tag/v0.4.22) (Rust runtime; Bash retired — see [MIGRATION.md](MIGRATION.md)) ## Contents @@ -37,7 +37,7 @@ curl -fsSL https://vaultedagent.com/install.sh | bash Installs `vaulted-agent` and `va`, detects agents on PATH (`claude`, `codex`, `grok`, `kimi`, `agy`) and `bash`, and can ask for a vault backend + auth mode. Pin: -`VAULTED_AGENT_VERSION=v0.4.21` (or `latest`). +`VAULTED_AGENT_VERSION=v0.4.22` (or `latest`). ### 2. Wire a vault @@ -91,7 +91,7 @@ va refresh # build/update a refs file (Bitwarden or 1Password) va edit-manifest # open a refs file in $EDITOR; check on save va auth-mode prompt # or: file va update # replace the installed binary from the latest GitHub release -va update v0.4.21 # pin; --check / --dry-run do not write +va update v0.4.22 # pin; --check / --dry-run do not write sudo va uninstall ``` @@ -230,7 +230,7 @@ you $ va claude --resume blast-radius control, not containment. Writeup: [One vault, three agents](https://stephens.page/blog/one-vault-three-agents-writing-the-pattern-down-found-five-bugs/) · -Latest: [v0.4.21](https://github.com/JacobStephens2/vaulted-agent/releases/tag/v0.4.21) +Latest: [v0.4.22](https://github.com/JacobStephens2/vaulted-agent/releases/tag/v0.4.22) ## The honest claim diff --git a/install-remote.sh b/install-remote.sh index 04c35e5..91114a9 100755 --- a/install-remote.sh +++ b/install-remote.sh @@ -37,7 +37,7 @@ REPO="${VAULTED_AGENT_REPO:-JacobStephens2/vaulted-agent}" # Default pin. Overridden by VAULTED_AGENT_VERSION=... or "latest". # Bump this when cutting a release so unpinned one-liners stay intentional. # Must match a published GitHub release tag (and Cargo.toml version). -DEFAULT_VERSION="v0.4.21" +DEFAULT_VERSION="v0.4.22" VERSION="${VAULTED_AGENT_VERSION:-$DEFAULT_VERSION}" GITHUB_API="${GITHUB_API:-https://api.github.com}" GITHUB="${GITHUB:-https://github.com}"