DEV Community

Rinat
Rinat

Posted on Originally published at github.com

Tashev Relay: Tashev Relay v0.1.1 — Security and correctness fixes

#agents #ai #devtools #opensource

Tashev Relay: Tashev Relay v0.1.1 — Security and correctness fixes

Security and correctness release. Upgrading from v0.1.0 is recommended.

Security

  • Credentials embedded in the origin URL are stripped before the URL is saved, printed, handed off or synced. In v0.1.0 a token in the remote URL ended up in .relay/state.json, HANDOFF.md, agent handoffs and the synced Git note.
  • security.redactSecrets is now honoured: token-like strings and password=... style pairs in the task, next step, notes and last commit message are masked.
  • Synced state no longer contains the machine hostname or the absolute project path.

If you ran relay sync push with v0.1.0 from a clone whose origin URL contained a token, treat that token as exposed and rotate it. Saving and pushing again with v0.1.1 replaces the note for the current commit, but the history of refs/notes/relay keeps the old content. To remove it from the server, delete the ref and push a fresh state:

git push origin :refs/notes/relay
relay save && relay sync push
Enter fullscreen mode Exit fullscreen mode

Fixes

  • The first git status entry lost its status column, so a modified README.md was recorded as a staged EADME.md.
  • Non-ASCII file names were recorded as octal escapes, and the source path of a rename was parsed as a separate entry.
  • relay sync push no longer fails when another machine pushed first: notes already on origin are merged before pushing. relay sync pull explains when origin has no Relay state yet.
  • --task, --next, --note and --agent without a value are rejected instead of saving true; --key=value is accepted.
  • relay doctor treats a dirty working tree and a missing GitHub CLI as warnings and exits 0 when nothing fails.
  • Outside a Git repository Relay no longer creates a .gitignore, and relay save says that only the task state was saved.
  • The project name fallback works with Windows paths.

Redaction is pattern-based. It lowers the risk of a pasted secret travelling further; it is not a guarantee.

Tested locally: 14/14 tests on Node 20 and 22, plus an end-to-end run with two clones syncing through a local bare repository. CI has not run for this release: GitHub Actions is locked on the maintainer account.

Git remembers your code. Relay remembers your work.

Source and code: https://github.com/tashev11/tashev-relay/releases/tag/v0.1.1

Top comments (0)