chore(release): v0.1.8 — zero-trust CLI wrapper hardening

[thehoff]

Release v0.1.8

Manual cut (release-please workflow is untracked; .github/ excluded since fa9fca6). Bumps Cargo.toml, Cargo.lock, .release-please-manifest.json to 0.1.8.

Highlights since v0.1.6

Security — zero-trust CLI wrapper layer

• 15 secure_*_command helpers wrapping every spawned tool: rg, find, git, cargo, npm/pnpm/yarn/node, python/pytest/ruff/black, ruby/bundle, java/mvn/gradle, dotnet, go, kubectl, docker, aws, psql, curl, wget.
• UNIVERSAL_ENV_STRIP wired into all of them (PR harden(pre-release): UNIVERSAL_ENV_STRIP wiring + remove unsafe env-mutation + 4 missed wire-ins #51 — closed the doc-only gap): LD_PRELOAD, DYLD_*, BASH_FUNC_*, PROMPT_COMMAND, PERL5OPT, LUA_INIT, etc. stripped from every child env.
• Per-tool arg deny-lists block --pre, --kubeconfig, --config, --exec, -K, --rcfile, etc. — env-and-arg attack vectors covered.
• Confirmed RCE blocked: RIPGREP_CONFIG_PATH → --pre <script> (4/4 attack paths empirically reproduced + blocked).
• Cloud fallback re-hardened in PR harden(pre-release): UNIVERSAL_ENV_STRIP wiring + remove unsafe env-mutation + 4 missed wire-ins #51 — spawn path also goes through secure_*_command instead of unsafe env-mutation.

Real contextcrawler security subcommand

Was a doc-only feature in the CONTEXTCRAWLER.md template (invocations fell through to macOS /usr/bin/security keychain tool). Now ships as a Tirith dashboard: binary resolution, gate state, downgrade log tail (10 by default, --all full), --json mode.

Token-savings improvements

• Cap delta: symmetric 80/80 head/tail (was 80/20).
• passthrough_extensions allowlist + two-line marker with contextcrawler proxy cat <path> escape hatch.
• grep -c/-L/-o/-Z long-form routes directly through rg — eliminates the 518 parse_failures observed before ux(grep): pre-clap intercept routes documented format flags through rg #16.
• rtk read weighted savings expected: 12.5% → ~50%+ after JSON-like routing for xcstrings/etc.

Rebrand / regression insurance

• --version now prints contextcrawler 0.1.8 (was incomplete; clap name="rtk" overrode package name).
• Print-string sweep: 47 [rtk] → [contextcrawler] (+ [rtk:toml], [rtk: ...] colon variants) + ~15 RTK.md/@RTK.md user-facing labels.
• 4 regression-pinning tests:
  • tests/branding_lint.rs — scope-aware lint over src/, fails the suite on any new [rtk] / RTK.md literal
  • test_rtk_md_constant_pinned_to_contextcrawler_filename (bug: regression — init --codex writes RTK.md instead of CONTEXTCRAWLER.md (incomplete rebrand) #19)
  • test_cli_name_pinned_to_contextcrawler (bug: --version shows rtk 0.39.0 instead of contextcrawler 0.39.0 (incomplete rebrand) #22)
  • branding_lint_config_files_pin_canonical_package_name (chore(branding): finish rtk→contextcrawler print-string sweep + branding-lint test #25)
• Auto-migration for ~/.codex/RTK.md → CONTEXTCRAWLER.md + AGENTS.md/CLAUDE.md dedupe.

Codex integration

• AGENTS.md template strengthened with MUST + WRONG/RIGHT examples.
• Codex compliance: 0% → 80% on test (was advisory wording).
• contextcrawler discover finds raw Bash and proposes wrapped equivalents.

Tooling

• tests/harness_standalone.rs — Tier 1 bench harness with isolated DB via RTK_DB_PATH tempfile + JSON/MD reports keyed by git sha.

Tests

• cargo test --bin contextcrawler — 2116 pass, 0 fail
• 7 integration suites: branding_lint(3), git_hardening(6), cargo_hardening(4), node_hardening(4), runtime_hardening(12), cloud_hardening(14), harness_standalone(1)

PRs included (19)

#10 #14 #15 #16 #17 #18 #21 #24 #25 #30 #31 #33 #41 #42 #43 #44 #46 #47 #51

Deferred to v0.1.9+

#26 uninstall ordering · #27 $CODEX_HOME canonicalize · #28 codex compliance lift 80→95% · #29 bench Tier2/3 · #40 trusted-PATH binary resolution · #48 GLOBAL_ENV_LOCK sharing · #49 pytest -p · #50 gh/glab/gt hardening