Browse documentation

Project

Changelog

Review release-by-release changes to Splice.

Full source guide View source on GitHub

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

0.2.0 (2026-08-10)

Features

  • design: the design agent can now request to crystallize the plan or approve it for execution. Revisions keep the current plan and critique context. The approve transition stays available after a resume when no critique requires a fix. Splice records who requested each transition. (3a1421f)

Bug Fixes

  • memory: only code_writer and test_generator query memory now. Other stages skip the sidecar search, so they do not pull in results that do not apply. (4f63d05)
  • reasoning: a request for xhigh or max could give less thinking than high, including the least. An unsupported tier now steps to the nearest supported tier. Supported tiers now come from the models.dev snapshot when available. (1fe01ea)
  • tui: /stages now refreshes model lists from each saved provider. The escalation and stage pickers previously showed only the short static catalog. (9f8324a)
  • tui: the sidebar layout stays stable during brief content changes. The composer width follows the chat column, and swarm rows stay with their run. (935e247)
  • update: stop canceled notices before cache writes (5276f95)

0.1.4 (2026-08-06)

Added

  • cli: Splice tells you when a newer release exists. A run checks at most once a day and prints one line naming the command that suits how you installed it. The check never delays or fails a run. Only a terminal sees it: piped output, splice exec in protocol mode, and the interactive TUI carry no notice. SPLICE_DISABLE_UPDATE_NOTICE turns the notice off and leaves splice update working; SPLICE_DISABLE_UPDATES turns off both. splice --update checks and reports; installing stays splice update --apply.
  • stages: a plan's acceptance criteria now run. A criterion carrying a command was reaching the code writer as prose and nothing ever executed it, so a run could report success on code that compiled, passed its tests, and did not do what was asked. A verification stage runs each criterion that has a command and reports one result each. A criterion nobody automated is recorded as skipped, not failed.
  • tui: an untrusted workspace is now marked in the footer, and /trust records the decision. Previously a user who declined trust, or who was defaulted to untrusted, had no way to see it and no way to change it without editing a file. The decision takes effect on restart, because the session already decided at startup whether to load project commands, hooks, MCP servers, and plugins.

Security

  • auth: OAuth tokens are protected at rest. They defaulted to a plaintext file while API keys defaulted to the keychain or an encrypted file, so the stronger secret had the weaker protection. Tokens now resolve the same policy API keys use, and existing tokens move across at startup. Set SPLICE_OAUTH_STORAGE=file to keep plaintext. Migration keeps the plaintext copy until the protected write is read back and verified, so a locked keychain leaves the login working.
  • sandbox: credential directories are read-denied by default: SSH, cloud, GPG, Kubernetes, container registry, GitHub CLI, and Splice's own token store. The sandbox previously granted read access across the filesystem, so any sandboxed command could read these. Add sandbox.allowRead to the global user config to re-include a path. Project config cannot grant it.

Fixed

  • stages: the security audit stage failed on any machine with gosec, bandit, or a SARIF scanner installed. The scanners write log lines to stderr and their report to stdout, and Splice read both together, so the report could not be parsed. The stage failed, the writer retried, and the run ended before its test stages. Substantial and architectural runs were affected.
  • sandbox: a sandboxed go build could not write its build cache, because the cache sits outside the sandbox. One stage passed and the next failed on a cache entry that was never written. Splice now points GOCACHE at a directory the sandbox can write. An explicit GOCACHE still wins.
  • stages: a pipeline run could fail to finish even when every stage ran. The test generator was told what the code writer did in prose, not which files it produced, so it wrote tests against names that did not exist and the run failed on undefined symbols. On a retry it could not rewrite the test file it had written itself. It now receives the writer's actual paths, and a retry replaces its own earlier file.
  • design: the plan critic could block a plan indefinitely. It never saw its own earlier critiques, so each revision drew new objections, and a medium-severity concern could stop execution. It now sees the previous plan and critique, only high and critical severity blocks, and it reads what the design conversation established rather than guessing.

Changed

  • sandbox (Linux): the sandbox now enforces. It located its helper on $PATH only, and no release archive ships that helper, so enforcement degraded to unconfined without saying so. Commands that ran before may now run confined wherever bwrap is installed.
  • sandbox: SSH-based Git inside the sandbox needs ~/.ssh in sandbox.allowRead. Approving network access does not restore a denied key.

Miscellaneous Chores

0.1.3 (2026-07-30)

Breaking Changes

  • All environment variables now use the SPLICE_ prefix. Splice does not read the old ZERO_ names, and it gives no warning when it finds them. Rename these variables in your shell, your CI configuration, and your scripts. For example, change ZERO_API_KEY to SPLICE_API_KEY. (3b3b01c)

Documentation

  • The README, the security policy, and the install guide are rewritten. (b4e3388)

Features

  • agenteval: derive eval cost from the request samples (9e137e0)
  • agenteval: parse usage events while the agent runs (15dc68e)
  • agenteval: publish the benchmark v2 report contract (eed860d)
  • cli: report eval runner, routed models, and cost coverage (a740bb7)
  • cli: run eval benchmarks through the production pipeline by default (4ff0a2d)
  • compaction: keep the agent inside the cheapest pricing tier (eee9f67)
  • complete attributed pipeline cost accounting (7440a8e)
  • design: ask the provider to search the web (9c5651d)
  • design: emit task_started before each plan task dispatches (09b3826)
  • design: give the design agent research tools and read-only roots (4e44b86)
  • modelregistry: price long-context tiers from models.dev (5d6e762)
  • modelregistry: price models the curated catalog does not carry (00d93f2)
  • modelregistry: ship a models.dev snapshot and stop curating prices (8b3ad05)
  • openrouter: run web search on the provider (fe19ea3)
  • runtime: add plumbing for provider-executed web search (3976759)
  • tui: show honest session cost with explicit coverage (0de1c81)
  • usage: persist cost estimates with provenance and coverage (0215c28)
  • usage: round a displayed cost to cents at a dollar and above (0703156)
  • usage: show a cost figure when pricing coverage is partial (6bad51a)

Bug Fixes

  • doctor: correct the stale connectivity fallback message (ce91459)
  • dtools: resolve the workspace root through symlinks (e5d5542)
  • exec: honor compaction config in the spec-draft run (391887c)
  • tui: give the TUI catalog its provider profile (2c3089b)
  • tui: keep a critique that failed to persist (887c97b)
  • tui: keep a crystallized plan when the critic fails (c1f3b78)
  • tui: persist attributed usage for non-pipeline runs (d8e7574)
  • tui: stream crystallize output and record its cost (48778b9)
  • usage: show fewer cost digits and use one formatter (f563ba6)

Performance Improvements

  • exec: drop the unread context window from the pipeline run options (e858f58)
  • tui: stop re-measuring the transcript on every wheel tick (c63edd0)

Miscellaneous Chores

0.1.2 (2026-07-20)

Security

  • cli: workspace trust gate. Project-scope executables (MCP stdio servers, hooks, plugins) loaded from .splice/ are no longer spawned automatically when the workspace is untrusted. Trust is resolved from CLI flags (--trust / --no-trust), the SPLICE_TRUST_WORKSPACE env var, the persisted ~/.config/splice/trust.json store (ancestor lookup, parent trust covers children), and the defaultProjectTrust setting (ask / always / never, default ask). Untrusted workspaces skip project resources and print a warning; this closes a remote-code-execution vector where cloning a malicious repository and running splice would execute configured commands. (2479d6a)
  • secrets: credential environment variables are now scrubbed from child processes (bash, exec, hooks, MCP stdio, plugins, sandbox runner). Known credential names (OPENAI_API_KEY, ANTHROPIC_API_KEY, AWS_SECRET_ACCESS_KEY, etc.) and suffix patterns (_API_KEY, _TOKEN, _SECRET, _PASSWORD) are stripped before spawn, with SPLICE_CHILD_ENV_ALLOWLIST for explicit passthrough. Prevents prompt-injected env / printenv from exfiltrating provider keys. (2479d6a)
  • sandbox: unparseable / obfuscated shell commands now force an explicit approval prompt instead of being auto-allowed under an active native sandbox. (2479d6a)
  • sandbox: the safe-git command classifier now rejects --git-dir, --work-tree, and -c (global and inline) so an approved command prefix cannot be used to operate on an arbitrary repository outside the workspace. (2479d6a)
  • dtools: the deterministic-tool path resolver now calls filepath.EvalSymlinks and rejects symlinks pointing outside the workspace. Git preserves symlinks on clone, so a repository could previously ship a symlink to a file outside the workspace and have the security scanners read it. (2479d6a)
  • sandbox: the opt-in seccomp Unix-socket block now fails closed (exit 125) instead of running the command without the filter. (2479d6a)
  • mcp: plaintext http:// MCP server URLs now emit a warning at config load (loopback / localhost excepted). (2479d6a)

Bug Fixes

  • update: correct the npm package name from @gitlawb/splice to @taf0711/splice. The npm update path referenced a package name the maintainer does not own; if unregistered, npm self-update would break, and if registered by a third party it was a supply-chain takeover vector. (#5)
  • cli: the mcp tools list command now resolves workspace trust instead of unconditionally loading project MCP servers, closing the last gate gap. (2479d6a)
  • tui: setup pipeline stage picker shows discovered models, count, scroll indicator, and current mark (a1676dd)
  • tui: setup pipeline picker shows selected model detail line (b3b9872)
  • tui: pipeline picker shows discovered models, not just the catalog (15e9a9b)
  • tui: pipeline picker detail line shows the model name (96131d7)
  • tui: Enter opens pipeline stage picker, Right advances to Safety (fa8166b)
  • ci: npm trusted publishing needs Node 24 (npm CLI 11.5.1+) (c5c6fd7)
  • tui: setup wizard per-stage model picker uses search and filtered list (#3) (da9f47a)

0.1.1 (2026-07-19)

Bug Fixes

  • ci: npm trusted publishing needs Node 24 (npm CLI 11.5.1+) (c5c6fd7)
  • tui: setup wizard per-stage model picker uses search and filtered list (#3) (da9f47a)

0.1.1 (2026-07-19)

Features

  • initial public release of Splice (480083e)