Skip to content

release: v0.5.3 - #9

Merged
Raftersecurity merged 24 commits into
prodfrom
main
Feb 21, 2026
Merged

release: v0.5.3#9
Raftersecurity merged 24 commits into
prodfrom
main

Conversation

@Rome-1

@Rome-1 Rome-1 commented Feb 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

v0.5.3 — SARIF output, shell completions, custom patterns, agent status, Python gitleaks auto-download, and force push detection.

New Features

  • SARIF 2.1.0 output (Node + Python): rafter agent scan --format sarif for GitHub/GitLab security tabs. --format text|json|sarif; --json remains as alias.
  • Shell completions (Node + Python): rafter completion bash|zsh|fish
  • Custom patterns from disk (Node + Python): ~/.rafter/patterns/*.txt and *.json merged with built-ins
  • .rafterignore suppression (Node + Python): path/glob rules to suppress findings
  • rafter agent status (Node + Python): config, gitleaks, hooks, OpenClaw, audit log summary
  • Python gitleaks auto-download: full port of binary-manager.ts to Python

Fixed

  • Force push detection: git push -f, --force-with-lease, --force-if-includes, refspec force syntax
  • Gitleaks tarball extraction: binary-only filter, no more LICENSE/README in ~/.rafter/bin/
  • patterns/ README written on first init
  • VERSION constant in node/src/index.ts was hardcoded to 0.5.0; now correct

Tests

  • 92 Node / 195 Python tests passing

Test plan

  • pnpm test — 92 Node tests passing
  • python -m pytest — 195 Python tests passing
  • pnpm run build — clean TypeScript compile
  • validate-release.yml gates on Node/Python version sync (both 0.5.3)
  • Merge triggers publish.yml → npm + PyPI publish

🤖 Generated with Claude Code

Rome-1 and others added 19 commits February 20, 2026 17:53
@Rome-1
feat(python): add rafter agent install-hook command (F008)
3abdbb2 
Implements Python parity with the Node CLI's install-hook subcommand.
Bundles pre-commit-hook.sh via importlib.resources and exposes
`rafter agent install-hook [--global]` with local and global install
modes, idempotency check, existing-hook backup, and executable bit
preservation.

Closes rc-jou
@Rome-1
chore: add Gas Town runtime paths to .gitignore
28f6724
@Rome-1 @claude
fix(python): upgrade typer to ^0.15.0, pin click <9.0.0 to fix --help…
cae9d76 
… crash

Typer 0.13.x + Click 8.3.x causes TypeError: Parameter.make_metavar() missing
1 required positional argument: 'ctx'. Upgrade to typer ^0.15.0 (resolves to
0.15.4) which is compatible with click 8.1.x. Add explicit click >=8.0.0,<9.0.0
constraint to prevent future incompatibility. Resolves rc-3ce.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Rome-1 @claude
ci: add npm packaging test job on prod push (rc-gnl)
393c87a 
Adds test-package CI job that gates publish-node:
- npm pack, inspect tarball for resources/pre-commit-hook.sh
- Install from packed tarball, run agent install-hook end-to-end
- Verify .git/hooks/pre-commit installed in temp git repo

Runs only on prod push (no per-PR overhead). Blocks npm publish
if packaging or hook install fails.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Rome-1 @claude
fix(F005): improve gitleaks init diagnostics, no silent fallback
85a1649 
Node.js (binary-manager.ts):
- Log exact download URL before fetch
- Log downloaded archive size after fetch
- Log "chmod +x applied" confirmation
- Replace verifyGitleaks() with verifyGitleaksVerbose() that captures
  stdout/stderr from 'gitleaks version'
- Add collectBinaryDiagnostics(): runs file <binary>, uname -a,
  reports node arch/platform, detects glibc vs musl on Linux
- On verification failure, throw structured error with URL, binary
  path, stdout/stderr, and full diagnostics

Node.js (init.ts):
- Surface the full error via fmt.error + fmt.warning instead of
  swallowing it with silent "Falling back to pattern-based scanning"
- Include actionable fix instructions (manual install URL)

Python (gitleaks.py):
- Add GitleaksCheckResult NamedTuple with available/stdout/stderr/error
- Add check() method that captures gitleaks version output verbosely
- is_available() delegates to check() for backward compat
- Add collect_diagnostics(binary_path) static: file, uname -a,
  python arch/platform, glibc/musl detection on Linux

Python (agent.py):
- Use scanner.check() instead of is_available()
- On failure: print reason, stderr, full diagnostics, fix instructions
- Distinguishes not-found-on-PATH from found-but-crashes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Rome-1
merge(rc-pkcz/P0): fix Python typer ^0.15.0 + click <9.0.0 — rafter -…
c5591a5 
…-help crash

Source issue: rc-3ce (obsidian)
Worker: polecat/obsidian
MR: rc-pkcz
@Rome-1
merge(rc-ib1o/P0): add CI npm packaging test for prod push
b6ec7c5 
Source issue: rc-gnl (quartz)
Worker: polecat/quartz
MR: rc-ib1o
@Rome-1
merge(rc-2eyu/P1): improve gitleaks diagnostics — no silent fallback
35a6301 
Source issue: rc-2jm (jasper)
Worker: polecat/jasper
MR: rc-2eyu
@Rome-1
docs: update CHANGELOG for v0.5.2
8ee83f4
@Rome-1 @claude
ci: add post-publish smoke tests for Node and Python (rc-aot)
c66d2f7 
Replace basic install-only smoke test with comprehensive smoke-test-node
and smoke-test-python jobs that verify --help, --version, and agent scan
against a fixture file with a fake AWS key. Both gate after publish and
create-release, catching broken releases before users hit them.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Rome-1 @claude
fix(F007): stabilize exit codes + JSON schema for agent scan
f50f6dc 
- Agent scan exit codes: 0=clean, 1=findings, 2=runtime error (was 1 for both)
- JSON output schema aligned between Node and Python (structured pattern object, no raw secret)
- Python redaction threshold aligned with Node (<=8 fully masked, was <16)
- CLI_SPEC.md: separate exit code tables for backend vs agent scan, full JSON schema reference
- Skill docs: exit codes and JSON output documented

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Rome-1 @claude
docs(F009): add audit log JSONL schema to CLI_SPEC.md
64d6d55 
Document the stable audit log schema covering all event types,
field names/types, required vs optional fields, redaction behavior,
size/rotation notes, and configuration options.

Filed rc-7dub for Node/Python schema mismatch (camelCase vs snake_case).

Closes: rc-9kq1

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Rome-1 @claude
fix(F005): wire PATH-check diagnostics in Node agent init
bddd62a 
When gitleaks is found on PATH or installed locally but fails to execute,
Node's agent init now calls verifyGitleaksVerbose() + collectBinaryDiagnostics()
and surfaces URL/arch/stderr diagnostics. Mirrors Python's init behavior exactly.

Adds findGitleaksOnPath() to BinaryManager (like Python's shutil.which).
Makes verifyGitleaksVerbose() and collectBinaryDiagnostics() accept optional
binaryPath parameter for PATH-found binaries.

Closes: rc-rloz

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Rome-1 @claude
feat(F006): add rafter agent verify + verbose OpenClaw init failure
ca271f1 
Two-part fix for rc-672:
1. OpenClaw skill install failure in `rafter agent init` now logs source path,
   destination path, and full error detail instead of a silent warning.
2. New `rafter agent verify` subcommand checks: gitleaks binary, config.json,
   Claude Code hooks, and OpenClaw skill — with pass/fail per integration.
   Exits 0 if all pass, 1 if any fail.

Both Node and Python implementations at parity. Python init now also detects
OpenClaw and supports --skip-openclaw flag.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Rome-1 @claude
feat(python): implement agent audit-skill command (Node parity)
5946ac1 
Add `rafter agent audit-skill <path>` to Python CLI with full feature
parity: secret detection, URL extraction, 11 high-risk command patterns
with line tracking, OpenClaw integration, manual review prompt, --json
and --skip-openclaw flags. Includes SkillManager utility and 30 tests.

Closes: rc-lfg2

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Rome-1
docs: complete CHANGELOG for v0.5.2
cc4e723
@Rome-1
fix: review findings B1+B2+N1+N3 — audit-skill exit codes, verify opt…
81fbc24 
…ional checks, gitleaks PATH, os.homedir()

- audit-skill: exit 1 when secrets > 0 or high_risk_commands > 0 (Node + Python)
- verify: Claude Code and OpenClaw checks are now optional (WARN, not FAIL)
  only Config + Gitleaks are hard failures; exit 1 only on core check failure
- verify: gitleaks check now checks PATH first then ~/.rafter/bin (Node + Python parity)
- install-hook: replace process.env.HOME with os.homedir() (consistent with codebase)
@Rome-1
test: add 19 tests for rafter agent verify command (N7)
9d99971 
Covers all 4 scenarios per check function:
- Config: pass, missing, invalid JSON
- Gitleaks: PATH found, rafter-bin found, not found, binary broken + diagnostics
- Claude Code: not detected (warn/optional), settings missing, hooks absent, hooks installed
- OpenClaw: not detected (warn/optional), skill missing, skill installed
- verify command exit codes: 0 on all-pass, 0 on optional-only absent, 1 on config fail, 1 on gitleaks fail
@Rome-1 @claude
chore: bump version to 0.5.2
f6e7682 
Node package.json and Python pyproject.toml both set to 0.5.2.
CHANGELOG date corrected to 2026-02-21.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Rome-1

Rome-1 commented Feb 21, 2026

Copy link
Copy Markdown
Collaborator Author

Docs updated

reference.mdx now includes full reference entries for the three v0.5.2 commands that were missing:

  • rafter agent verify — checks, optional vs. hard failures, exit codes, example output
  • rafter agent install-hook — local vs. global behavior, bypass instructions
  • rafter agent audit-skill — detection types, exit codes, JSON schema, examples

Also patched missing flags on existing entries (agent init, agent scan).

Commit: Rome-1/docs@ff315d6

Rome-1 and others added 5 commits February 21, 2026 13:03
@Rome-1 @claude
fix: force push variants, gitleaks extraction, patterns README, audit…
b08ce1f 
….log docs

Force push detection (Node + Python):
- Add git push -f, --force-with-lease, --force-if-includes patterns
- Add refspec force syntax (git push origin +main, +HEAD:main)
- 5 new Node tests, 10 new Python tests (85 Node / 189 Python total)

Gitleaks tarball extraction (Node):
- binary-manager.ts: strip: 1 + filter to gitleaks binary only
- Prevents LICENSE and README.md from landing in ~/.rafter/bin/

patterns/ directory (Node + Python):
- Write README.md on first init explaining the directory purpose
- Clears user confusion about empty folder

Docs:
- audit.log → audit.jsonl in README.md, node/README.md, CHANGELOG.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Rome-1 @claude
feat: Python gitleaks auto-download (parity with Node)
444d5b4 
- Add python/rafter_cli/utils/binary_manager.py: full Python port of
  node/src/utils/binary-manager.ts with platform/arch detection, URL
  construction, urllib download with progress, tarfile extraction
  (binary-only filter), chmod 0o755, subprocess verification, and
  diagnostic collection on failure.
- Wire BinaryManager into agent init: after skip_gitleaks check, auto-
  download if gitleaks not on PATH and not in ~/.rafter/bin/.
- Wire BinaryManager into _check_gitleaks: verify_gitleaks_verbose +
  collect_binary_diagnostics replace direct GitleaksScanner.check usage.
- Update test_agent_verify.py to mock BinaryManager instead of
  GitleaksScanner for the three affected _check_gitleaks tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Rome-1 @claude
feat: custom patterns, .rafterignore suppression, agent status dashboard
440b0e9 
Custom patterns from disk (Node + Python):
- Load ~/.rafter/patterns/*.txt (one regex/line) and *.json ({name,pattern,severity})
- Merged with built-in 21 patterns at RegexScanner init

.rafterignore suppression (Node + Python):
- Format: path/glob or path/glob:pattern-name per line
- Findings matching suppressed paths/patterns filtered at scan_file()
- Glob matcher supports * and ** syntax

rafter agent status (Node + Python):
- Config, gitleaks version, PreToolUse/PostToolUse hook status
- OpenClaw skill detection, audit log summary (totals + 5 recent events)

Tests: 92 Node / 195 Python

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Rome-1 @claude
feat: SARIF output and shell completions (P2)
3165cd2 
SARIF 2.1.0 output (Node + Python):
- rafter agent scan --format sarif outputs GitHub/GitLab-compatible SARIF JSON
- --format flag: text (default), json, sarif (--json still works as alias)
- Each finding maps to a SARIF result with ruleId, level, physicalLocation

Shell completions (Node + Python):
- Node: rafter completion bash|zsh|fish generates complete scripts
  eval "$(rafter completion bash)" pattern, fish saves to completions dir
- Python: Typer built-in completion enabled (add_completion=True)
  rafter completion bash|zsh|fish command wraps --show-completion

Tests: 92 Node / 195 Python

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Rome-1 @claude
chore: bump version to 0.5.3, add CHANGELOG, fix stale VERSION constant
bd8992f 
- Bump node/package.json + python/pyproject.toml to 0.5.3
- Fix node/src/index.ts VERSION constant (was hardcoded 0.5.0)
- Add v0.5.3 CHANGELOG section (force push detection, Python gitleaks
  auto-download, custom patterns, .rafterignore, agent status, SARIF,
  shell completions)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Rome-1 Rome-1 changed the title release: v0.5.2 release: v0.5.3 Feb 21, 2026
@Raftersecurity
Raftersecurity merged commit c270ee6 into prod Feb 21, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Raftersecurity Raftersecurity Raftersecurity approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Rome-1 @Raftersecurity