v0.16.5 v1.7.3
high risk
asheshgoplani/agent-deckOct 19, 2026 → Oct 19, 20260 days between releases
What's New
Major security model overhaul implements least-privilege access for skills and agents with state persistence.
Breaking Changes
- Skill frontmatter now strictly adheres to settings.json allowlists.
- Agents reading postings can no longer edit or write files.
- New deny rules in settings.json persist across all permission modes.
New Features
- Periodic untraced commit fixup worker.
- Persistence of repo families and fixup cursors across restarts.
- Metrics recording for commit source.
- Ability to claim untraced commits from the worktree HEAD reflog.
- Temporary repositories are now excluded from the untraced fixup.
Improvements
- Security model now correctly enforces documented least-privilege behavior.
- Job postings are checked for hidden instructions before reading.
- Permission file rules now hold even in bypass mode.
Bug Fixes
- Security model now does what the docs said it did.
- Hidden instructions in job postings are checked before reading.
Upgrade Notes
Update settings.json to include new deny rules that persist across permission modes. Review skill frontmatter to ensure it does not request tools beyond settings.json allowlists.
The Two Releases
v1.7.3
v1.7.3 - Least privilege, postings checked before use, and fifty-eight fixes
Oct 19, 2026· 3 days ago
Full release notes