This release fixes issues for SREs watching stability and regressions.
✓ No known CVEs patched in this version
Topics
+12 more
Affected surfaces
Summary
AI summaryFixed authentication loss detection for claude -p --bare causing silent dead reviews.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Fixes silent failure when `--bare` CLI lacks authentication. Fixes silent failure when `--bare` CLI lacks authentication. Source: llm_adapter@2026-07-18 Confidence: low |
— |
| Bugfix | Medium |
Auth-loss probe now runs regardless of exit code for `--bare` CLI. Auth-loss probe now runs regardless of exit code for `--bare` CLI. Source: granite4.1:30b@2026-07-18-audit Confidence: low |
— |
Full changelog
Fixed
- The turn-end review layer (the Stop-hook correctness / duplication / idiom
lenses) was silently dead on current Claude CLIs. The reviewer spawns
claude -p --bare, and--barenow drops OAuth/keychain on current CLIs --
but it does so with an EXIT-0 "Not logged in / Please run /login" body, not a
nonzero exit. The auth-loss probe only ran in the nonzero branch, so the exit-0
auth-error string was mistaken for a successful review: it was returned as the
review output (unparseable, so no findings surfaced),--barewas recorded as
working, and the reviewer never fell back to a plain spawn. The auth-loss probe
now runs REGARDLESS of exit code, so an exit-0 "Not logged in" is detected,
recorded (later spawns skip--bare), and retried plain -- which keeps auth and
produces a real review. Found and verified via real usage (the reviewer spawn
now returns a real response instead of the auth-error string). Restores the
entire turn-end review layer on affected CLIs.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Chameleon
All releases →Beta — feedback welcome: [email protected]