nfemmanuel/iranti

v0.3.4 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 2mo AI Agents & Assistants

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Affected surfaces

auth

Summary

AI summary

Provider key handling is now secure with a new --provider-key flag, fixing critical authentication reuse.

Full changelog

What's Changed (since v0.3.2)

Alpha Test Bug Fixes

[CRITICAL] Provider key security (BUG-002): iranti setup --api-key no longer reuses provider credentials as IRANTI_API_KEY. New --provider-key flag added; --api-key with a remote provider now routes to the provider key automatically.
[CRITICAL] CP Overview cross-instance data (BUG-008): Overview dashboard now queries the selected instance's database instead of always showing the default instance data.
[HIGH] Silent iranti project init (BUG-005): Fixed premature Node.js exit during async DB operations that swallowed success output.
CLI claude-setup log leak (BUG-006): Internal [router] Primary provider failed message no longer leaks to stdout; gated behind DEBUG_LLM.
CP contradictory readiness (BUG-009/010): Project readiness now uses OR logic (Claude OR Codex wired = ready). "Fix project wiring" scrolls to correct section.
CP page refresh after wiring (BUG-012): Project binding success now invalidates react-query caches so the UI updates immediately.

Protocol Enforcement

checkpoint() now clears pendingPostResponse so subsequent pre-response attend calls succeed. Fixes a pre-existing CI failure in test:api-surfaces-protocol-enforcement.
Added clearPendingPostResponse() method to AgentProtocolTracker.

Other

Protocol enforcement, fact freshness timestamps, project learning snapshots (from v0.3.0 work)
Server VERSION constant aligned to package version
TypeScript client (@iranti/sdk) and Python client versions aligned to 0.3.4

Full Changelog: https://github.com/nfemmanuel/iranti/compare/v0.3.2...v0.3.4

Breaking Changes

Removed automatic reuse of `IRANTI_API_KEY` for provider credentials; requires explicit `--provider-key` flag.

Security Fixes

CVE‑2025‑XXXXX — Provider key security (BUG-002): `iranti setup --api-key` no longer reuses provider credentials as `IRANTI_API_KEY`; new `--provider-key` flag added.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track nfemmanuel/iranti

Get notified when new releases ship.

About nfemmanuel/iranti

Persistent shared memory for AI coding agents. Stores facts as `entity/key/value` triples with hybrid semantic search, task checkpoints, and conflict resolution — shared across Claude Code, Codex CLI, and GitHub Copilot.

All releases →