v3.4.1¶
Released 2026-07-12.
A patch release on top of v3.4.0. It completes the follow-up work that landed after the v3.4.0 tag: Windows parity coverage and a security hardening and static-analysis cleanup pass. There are no breaking changes and no configuration migration is required.
Security hardening¶
- ssh secret handling for the detached run service now keeps only vault provider ids in its backend descriptor. The connection sidecar that a supervisor rebuilds on restart names which vault provider supplies which remote environment variable and never carries a secret value. Resolved credentials continue to flow through the vault path into the remote process environment only, and are never written to the sidecar, the work ledger, the receipts, or the logs. The failure log now records the provider id and the exception type, never the credential payload.
- Run journal path hardening. The per-run event journal derives its on-disk path only from a run id that has passed an anchored allowlist, an explicit rejection of the current and parent directory, and a realpath containment check against the runs root. A run id can no longer steer the journal file outside the runs directory.
Static-analysis cleanup¶
- Removed redundant idioms in the skills conformance command and reworded a detached-run log line, clearing the corresponding scanner findings.
Windows parity coverage¶
- Self-promoting lane gate, mocked stop and restart with worktree isolation, and a reduction in skipped Windows cases, closing gaps ahead of first-class Windows support (#2448).
Upgrading¶
No configuration migration is required. Every capability available in v3.4.0 is unchanged.