Skip to content

zeroshot

v3.0.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agent-loops agent-orchestration agentic-workflow ai-agent ai-agents autonomous-agents
+10 more
claude cli codex coding-assistant developer-tools gemini loop-engineering meta-harness multi-agent vibecoding

Affected surfaces

rce_ssrf

Summary

AI summary

Broad release touches BREAKING CHANGES, Bug Fixes, https://github.com/covibes/zeroshot/issues/21, and https://github.com/covibes/zeroshot/issues/23.

Full changelog

3.0.0 (2025-12-29)

Bug Fixes

  • isolation: replace busy-wait with async/await for parallel copy (c8afbf0), closes #21
  • security: escape shell arguments in Docker commands (43476ad)
  • shell injection prevention and test reliability improvements (45254f7)
  • status-footer: use decimal display for interpolated metrics (#26) (73ce673)

Features

  • cli: change default model ceiling to opus (#28) (1810be3)
  • cli: change default model ceiling to opus + fix worktree flag cascade (#29) (eaa30b0)
  • cli: consolidate StatusFooter for logs -f mode + add blinking agent indicator (fe2722d)
  • real-time metrics via interpolation + maxModel cost ceiling (#24) (f1db466), closes #21
  • settings: replace defaultModel with maxModel cost ceiling (#25) (9877dad), closes #23
  • validation: add Phase 5 template variable validation (#27) (5e5e7c6)

Performance Improvements

BREAKING CHANGES

  • None

  • settings: defaultModel setting renamed to maxModel

  • defaultModel setting renamed to maxModel

  • feat(status-footer): implement real-time metrics via interpolation

Replace blocking 1s metrics polling with background sampling + interpolation:

  • Sample actual metrics every 500ms (non-blocking background)
  • Display updates every 100ms (10 fps - appears continuous)
  • Values smoothly drift toward targets via lerp (15% per tick)
  • CPU and RAM interpolate; Network is cumulative (no interpolation)

Result: Real-time seeming monitoring while reducing actual polling.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.5 [email protected]

  • feat(debug-workflow): harden investigator/fixer/tester for senior-dev quality

Implements 7 hardening changes to ensure debug-workflow produces
trustworthy output without manual code review:

Investigator:

  • Structured rootCauses schema requiring proof each is fundamental
  • Mandatory similarPatternLocations field from codebase-wide scan
  • Prompt requires documenting WHY each cause is root (not symptom)

Fixer:

  • Mandatory root cause mapping (each cause → specific fix)
  • Mandatory test addition with escape hatch for valid justifications
  • Must fix ALL similar pattern locations, not just original failure

Tester:

  • Structured verification schema with commandResult, rootCauseVerification,
    similarLocationVerification, testVerification, regressionCheck
  • Comprehensive checklist: A (command), B (root causes), C (similar locs),
    D (test quality), E (regression via smart tiering)
  • Explicit forbidden rationalizations and approval criteria

Result: Workflow now blocks incomplete work, band-aid fixes, missing tests,
and ignored similar bugs. Output can be trusted.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.5 [email protected]

Breaking Changes

  • **settings:** defaultModel setting renamed to maxModel

Security Fixes

  • security: escape shell arguments in Docker commands — prevents shell injection

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track zeroshot

Get notified when new releases ship.

Sign up free

About zeroshot

Your autonomous engineering team in a CLI. The agent loop produces senior-level code that you can actually trust in prod because of non-negotiable feedback from independent reviewers. Supports Claude Code, OpenAI Codex, OpenCode, and Gemini CLI with trivial setup.

All releases →

Related context

Beta — feedback welcome: [email protected]