Wynelson94/longhand

v0.10.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 15d MCP Data & Storage

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ai-memory anthropic chromadb claude-code forensic local-first

+6 more

lossless mcp mcp-server python recall sqlite

Affected surfaces

auth

ReleasePort's take

Moderate signal

editorial:auto 12d

Version v0.10.0 introduces opt‑in secret redaction at ingest and a retroactive `longhand redact` command, while fixing benign noise errors and capping the chromadb dependency to avoid pre‑1.0 versions.

Why it matters: Security engineers must enable redaction (config --set redact.enabled=true) to mask secrets; ops should run `longhand redact [--apply]` on existing stores. The release caps chromadb <1.0, eliminating exposure to unstable releases that could cause runtime failures.

Summary

AI summary

Opt-in secret redaction masks sensitive strings at ingest and retroactively scans existing stores.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Caps chromadb dependency to <1.0 for all Python versions. Caps chromadb dependency to <1.0 for all Python versions. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Adds opt-in secret redaction at ingest. Adds opt-in secret redaction at ingest. Source: llm_adapter@2026-07-15 Confidence: high	—
Feature	Medium	Adds `longhand redact` command for retroactive scanning and masking. Adds `longhand redact` command for retroactive scanning and masking. Source: llm_adapter@2026-07-15 Confidence: high	—
Bugfix	Medium	Fixes benign noise being counted as errors in error detector. Fixes benign noise being counted as errors in error detector. Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

Feature release: opt-in secret redaction, plus recall-quality and toolchain hardening.

Added

Secret redaction at ingest (opt-in). longhand config --set redact.enabled=true masks secret-shaped strings — Anthropic/OpenAI/AWS/GitHub/Google/Slack/Stripe keys, SSH key headers, JWTs, database URLs with passwords, SSNs, and Luhn-validated card numbers — at parse time, before they reach SQLite, the raw JSON blobs, or the vector index. Masks keep only the first/last 4 characters and the length (sk-a…wxyz (len=50)). Default is off: Longhand stays forensic unless you opt in. (#26)
longhand redact — retroactive scan of an existing store. Reports pattern names and counts only (never the matched values); --apply masks matches in place across events, episodes, segments, and outcomes, and re-embeds changed vector documents. (#26)

Fixed

Benign noise no longer counts as errors. The error detector now skips known-noise lines — Next.js streaming-SSR data-dgst/ markers, "0 failing"/"Tests: 0 failed" summaries, empty error: fields, Error: Task not found tool churn, and missing-GNU-timeout probes — while continuing to scan, so real errors in the same output still register. This was the main inflator of the unresolved-episode rate. Run longhand analyze --all to re-extract episodes with the cleaner detector. (#25)

Security

chromadb is now capped <1.0 for all Python versions (previously unbounded below 3.14) — a chromadb 1.x release can no longer break fresh installs. (#25)

Internal

mypy is clean (21 → 0 errors) and the CI typecheck job is now blocking. (#25)
ruff format adopted repo-wide and gated in CI. (#24)
311 tests (280 → 311). The May 2026 audit report is archived under docs/audits/. (#24–#26)

Security Fixes

chromadb dependency capped to `<1.0` for all Python versions, preventing breakage from chromadb 1.x releases.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Wynelson94/longhand

Get notified when new releases ship.

About Wynelson94/longhand

Persistent local memory for Claude Code. Indexes every session JSONL verbatim into SQLite + ChromaDB for semantic recall (~126ms)