Nightly (2026-03-18)

Nightly build from commit c6bf927.

Warning

This is an automated nightly build and may be unstable. For stable releases, see the latest release.

v0.2.0

0.2.0 (2026-03-15)

⚠ BREAKING CHANGES

• treat * inside quotes as glob, support \* escape for literal asterisk (#157)

Features

• audit: improve audit subcommand output with table format and colors (#200) (490e206)
• audit: support audit logging for command evaluation results (#103) (25c6749)
• cli: add --dir filter option to runok audit (#207) (71b768e)
• cli: add runok test subcommand for rule verification (#204) (cfafb18)
• cli: add update-presets command (#197) (4c57355)
• rules: add typed variable definitions (definitions.vars) with <var:name> placeholder (#201) (ffee2ec)
• rules: support <var:name> in command position and per-value type (#208) (c5995ae)
• rules: support redirects and pipe variables in when clauses (#203) (a513e1b)
• rules: support fused short flag pattern matching (-n3) (#205) (7a74122)
• treat * inside quotes as glob, support \* escape for literal asterisk (#157) (23c7789)

Bug Fixes

• cli: reject unknown flags before -- in exec/check subcommands (#202) (7344abd)
• cli: remove exec --dry-run option (#216) (155c0d3)
• pattern-matcher: skip flag-starting token sequences in <cmd> placeholder matching (#206) (f706488)

Dependencies

• update rust crate chrono to v0.4.44 (#211) (68bdb28)
• update rust crate semver to v1.0.27 (#212) (81a5251)

v0.1.5

0.1.5 (2026-03-12)

Bug Fixes

• rules: handle =-joined flag tokens in Alternation matching (#196) (15fe774)
• rules: prevent flag negation from being consumed as preceding flag's value (#191) (31b76a8)

v0.1.4

0.1.4 (2026-03-11)

Features

• init: warn when other PreToolUse hooks conflict with runok sandbox (#186) (94a506f)
• rules: apply order-independent matching to literal tokens (#177) (e257cad)

Bug Fixes

• rules: allow flag-only negation to pass with empty command tokens (#179) (1d6c757)
• rules: match FlagWithValue patterns against =-joined tokens (#180) (6ebb296)
• rules: match flag-only negation patterns against =-joined tokens (#175) (7cf8eaa)
• rules: resolve unmatched sub-commands to concrete actions in compound evaluation (#178) (377f83d)

v0.1.3

0.1.3 (2026-03-09)

Features

• config: resolve relative paths based on config file parent directory (#166) (ee1a7c3)
• preset: add file-based locking for concurrent preset cache access (#168) (27c31f4)
• preset: support path specification in GitHub shorthand references (#167) (eff4b56)

Bug Fixes

• config: resolve preset rules referenced via extends (#174) (abc5e41)
• config: traverse ancestor directories to find project config (#165) (a49f916)
• preset: remove unnecessary mutable reference warning (#169) (c1d9d3c)
• rules: apply order-independent matching to flag-only negation patterns (#171) (9c43c91)

Dependencies

• update rust crate serde-saphyr to v0.0.21 (#162) (56c0827)

v0.1.2

0.1.2 (2026-03-06)

Features

• init: add runok init subcommand (#152) (176d9b6)

Bug Fixes

• evaluate command substitutions nested in quoted strings (#151) (af784b6)
• resolve stack overflow in compound command evaluation with command substitutions (#149) (97b46a7)
• rules: stop flag alternation from consuming placeholder as flag value (#154) (24a951a)
• treat -- as a positional literal instead of a flag (#153) (c2f6d72)

Dependencies

• update rust crate dialoguer to v0.12.0 (#158) (9e3cd2e)
• update rust crate tempfile to v3.26.0 (#147) (02fba8a)
• update rust crate tree-sitter to v0.26.6 (#156) (f44c9a6)

v0.1.1

0.1.1 (2026-03-02)

Bug Fixes

• cli: add --version flag (#138) (a284a3b)
• config: support runok.yaml for global config file discovery (#141) (b338d30)

Dependencies

• update pnpm to v10.30.1 (#133) (94023f8)
• update rust crate tree-sitter to v0.26.5 (#16) (4287cb2)

v0.1.0

0.1.0 (2026-03-01)

• trigger initial release (c9f190c)

Features

• adapter: add CheckAdapter for generic check interface (#53) (cb6dc15)
• adapter: add Endpoint trait and common evaluation flow (#51) (0aee28c)
• adapter: implement ExecAdapter (#52) (36e6453)
• adapter: include matched rule, reason, and fix suggestion in deny feedback (#58) (bd8f929)
• adapter: support Endpoint implementation for Claude Code PreToolUse Hook (#54) (0c0eabf)
• cli: add --dry-run and --verbose options to exec/check subcommands (#59) (f2eee5e)
• cli: add --output-format option and rename --format to --input-format (#95) (5fc9592)
• cli: implement exec/check subcommands with stdin input routing (#55) (041fc33)
• cli: return spec-compliant exit codes per subcommand (#56) (2030cbc)
• cli: support plaintext stdin input for check subcommand (#57) (2efb529)
• cli: unify check command input to positional args matching exec (#96) (e5a3f8f)
• config: add config validation (#18) (9421327)
• config: detect circular references in nested extends (#48) (00bcbe3)
• config: expand <path:name> references in sandbox preset fs.deny (#66) (3fbaf0e)
• config: generate JSON Schema for runok.yml via config-schema feature (#93) (beacb7f)
• config: prefer $XDG_CONFIG_HOME for global config directory (#118) (ff30229)
• config: support global and local config merging (#25) (4ecb66c)
• config: support global local override via runok.local.yml (#105) (c9091d3)
• config: support loading local preset files from extends (#36) (6b5e3cf)
• config: support per-project personal config override via runok.local.yml (#89) (bb9e03a)
• config: support remote preset resolution via git clone --depth 1 (#43) (5368ddb)
• config: support YAML config file parsing (#6) (c1b3d64)
• define common error types for each layer (#2) (14cb840)
• exec: add dry-run mode to CommandExecutor (#41) (77eb8ce)
• exec: fall back to ask on extension errors (#24) (91395e6)
• exec: support command execution with exit code forwarding via CommandExecutor (#38) (5c04095)
• exec: support JSON-RPC 2.0 communication with extension plugins (#19) (d30c9ab)
• pattern: support alternation syntax in command name position (#91) (6fabb81)
• pattern: support multi-word alternation syntax in command position (#94) (2fdea25)
• pattern: support wildcard * as command name in patterns (#77) (82c343c)
• rules: add pattern-to-command matching engine (#37) (823d96b)
• rules: add rule engine with Explicit Deny Wins priority (#40) (28834e5)
• rules: implement LexToken-based pattern parser (#5) (556ef10)
• rules: implement CEL expression evaluator for when-clause conditions (#8) (227252f)
• rules: implement command string tokenizer (#7) (f780588)
• rules: implement pattern string lexer for tokenization (#4) (397e6d8)
• rules: structure command strings into flags and arguments (#21) (47feaba)
• rules: support command extraction from subshells (#23) (07cafa8)
• rules: support compound command evaluation with result aggregation (#49) (4395c0b)
• rules: support recursive command extraction from control structures (#26) (ac7ac89)
• rules: support recursive wrapper command evaluation (#45) (c6fd568)
• sandbox: implement SandboxPolicy construction and policy resolution (#63) (a77bcca)
• sandbox: implement Linux sandbox helper binary (#68) (545ae31)
• sandbox: implement macOS SandboxExecutor using Seatbelt/SBPL (#67) (32d7e96)
• wrapper: add <opts> and <vars> placeholders for wrapper patterns (#84) (0d41c66)

Bug Fixes

• adapter: evaluate extracted sub-command instead of raw input for simplified compound constructs (#87) (0c463b7)
• cli: unwrap Result from shell_quote_join call in route_check (#100) (730633e)
• **command...