Skip to main content
← Changelog

v1.2.0

2026-07-01

Changed

  • TypeScript SDK canary upgrade to TS6 — cli/sdk/ts (@nself/plugin-sdk v2.0.0) bumped from TypeScript ^5.4.5 to ^6.0.0 (S06 canary). tsconfig.json updated: module → node16, moduleResolution → node16 (node10 alias deprecated in TS6). Added tsconfig.test.json for ts-jest with isolatedModules: true. Jest config migrated to flat transform syntax (removes deprecated globals.ts-jest). Added eslint, @typescript-eslint/parser, @typescript-eslint/eslint-plugin devDeps and eslint.config.mjs (ESLint 10 flat config). All 18 tests pass. Type-check and build clean.

Added

  • Embedded PostgreSQL via pglite/wasmtime (--embedded-pg) — nself start --embedded-pg boots a full ɳSelf stack without a Docker postgres container. PostgreSQL runs as a pglite WebAssembly module inside wasmtime. A Unix-domain socket bridge proxies the Postgres wire protocol to Hasura and Auth. pgvector is included in pglite v0.2.17. Cold start compiles the WASM module to native code and caches it; warm starts typically take under 5 seconds. Backup via nself backup targets the UDS socket (pg_dump --format=custom primary, SQL wire-protocol fallback). Enable persistently with NSELF_EMBEDDED_PG=true in .env.local. See [[Embedded-Postgres]].

Security

  • CWE-214 Hasura secret exposure fixed — hasuraMetadataExportCmd() in internal/backup/create.go previously passed the Hasura admin secret as --admin-secret=<value> in argv. Any local user with access to /proc/<pid>/cmdline or ps aux could read it during a backup run. The secret is now passed exclusively through the child process environment (cmd.Env). Docker exec receives -e HASURA_GRAPHQL_ADMIN_SECRET (no value on the command line). Severity: High. Chain ID: a83c99d6. Advisory: .github/SECURITY-ADVISORIES/2026-05-15-rce-and-secrets.md.
  • Supply-chain installer verification added — the Ollama installer previously piped curl output directly to sh without content verification. DownloadAndVerify() in the new internal/installer/verify.go downloads to a 0700 owner-only temp directory, opens the file with O_EXCL (closes TOCTOU window), caps the body at 2 MiB, and verifies SHA-256 against the pinned checksum from ExpectedOllamaInstallChecksum() before execution. Severity: High. Chain ID: a83c99d6. Advisory: .github/SECURITY-ADVISORIES/2026-05-15-rce-and-secrets.md.

Testing

  • S42-sec security-critical coverage uplift (sprint a5e2b723) — targeted coverage pass across internal/license, internal/auth, internal/trust, internal/crypto, SSRF guards, and RLS enforcement. Real uplift: license 76 → 91.1% (392 new tests), auth 85 → 92.5% (140 tests), trust 67 → 72.1% (4 timeout-panic test bugs fixed: brew/osascript/setupResolver had unconditional 30s–5 min blocking calls, now t.Skip with unreachable-doc comment), security 89.3%, truststate 96.0%. No security bugs discovered; go build and go vet clean. Accepted coverage debt: internal/trust/ssl 49.4%, internal/secrets 39.0%, internal/tenant 48.4% — these packages rely on external binary execution (mkcert, openssl, age — no injection point to test safely), osascript admin-dialog invocation (untestable in CI without real macOS privileges), and live Postgres/Stripe/MinIO connections. Plausible integration-test class; further uplift deferred to S47 once an integration harness is in place.