moltblock 0.11.5 → 0.11.6

package/dist/cli.js

@@ -70,7 +70,22 @@ async function main() {
     });
     await program.parseAsync(process.argv);
 }
+/** Sanitize error messages to strip sensitive data before logging. */
+function sanitizeError(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return msg
+        .replace(/[A-Za-z0-9_\-]{20,}/g, "[REDACTED]")
+        .replace(/https?:\/\/[^\s]+/g, (url) => {
+        try {
+            const u = new URL(url);
+            return `${u.protocol}//${u.hostname}/...`;
+        }
+        catch {
+            return "[REDACTED_URL]";
+        }
+    });
+}
 main().catch((err) => {
-    console.error(err);
+    console.error(`Error: ${sanitizeError(err)}`);
     process.exit(1);
 });

package/dist/config.js

@@ -67,7 +67,12 @@ export const ModelBindingSchema = z.object({
 function isAllowedConfigPath(filePath) {
     const resolved = path.resolve(filePath);
     const allowed = [path.resolve(process.cwd()), path.resolve(os.homedir()), path.resolve(os.tmpdir())];
-    return allowed.some((dir) => resolved.startsWith(dir + path.sep) || resolved === dir);
+    return allowed.some((dir) => {
+        if (resolved === dir)
+            return true;
+        const rel = path.relative(dir, resolved);
+        return !!rel && !rel.startsWith("..") && !path.isAbsolute(rel);
+    });
 }
 /**
  * Resolve moltblock config file: MOLTBLOCK_CONFIG env, then ./moltblock.json, ./.moltblock/moltblock.json, ~/.moltblock/moltblock.json.

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * Moltblock — framework for evolving composite intelligences (Entities).
  */
-export declare const VERSION = "0.11.5";
+export declare const VERSION = "0.11.6";
 export type { ModelBinding, BindingEntry, AgentConfig, MoltblockConfig, ChatMessage, VerifiedMemoryEntry, CheckpointEntry, OutcomeEntry, InboxEntry, StrategySuggestion, ReceivedArtifact, GovernanceConfig, } from "./types.js";
 export { WorkingMemory } from "./memory.js";
 export { signArtifact, verifyArtifact, artifactHash } from "./signing.js";

package/dist/index.js

@@ -1,7 +1,7 @@
 /**
  * Moltblock — framework for evolving composite intelligences (Entities).
  */
-export const VERSION = "0.11.5";
+export const VERSION = "0.11.6";
 // Memory
 export { WorkingMemory } from "./memory.js";
 // Signing

package/dist/signing.js

@@ -42,14 +42,9 @@ function getSecret(entityId) {
             return key;
         }
         catch {
-            // Weak deterministic fallback requires explicit opt-in
-            if (process.env["MOLTBLOCK_INSECURE_DEV_SIGNING"] !== "1") {
-                throw new Error(`No MOLTBLOCK_SIGNING_KEY set and filesystem unavailable. ` +
-                    `Set MOLTBLOCK_SIGNING_KEY for signing, or set MOLTBLOCK_INSECURE_DEV_SIGNING=1 to allow weak dev fallback.`);
-            }
-            console.warn(`Warning: Using weak default signing key for entity "${entityId}". ` +
-                `Set MOLTBLOCK_SIGNING_KEY for secure artifact signing.`);
-            return Buffer.from(`dev-only-insecure-key-${entityId}`, "utf-8");
+            // No weak deterministic fallback — require explicit key material
+            throw new Error(`No MOLTBLOCK_SIGNING_KEY set and filesystem unavailable for dev key generation. ` +
+                `Set MOLTBLOCK_SIGNING_KEY or MOLTBLOCK_SIGNING_KEY_${entityId.toUpperCase()} environment variable.`);
         }
     }
     const keyBytes = Buffer.from(envKey, "utf-8");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moltblock",
-  "version": "0.11.5",
+  "version": "0.11.6",
   "description": "Framework for building evolving composite AI intelligences (Entities)",
   "type": "module",
   "main": "dist/index.js",

package/skill/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: moltblock - Trust Layer for AI Agents
 description: Verification gating for AI-generated artifacts. Policy checks to catch dangerous patterns before execution.
-version: 0.11.5
+version: 0.11.6
 homepage: https://github.com/moltblock/moltblock
 repository: https://github.com/moltblock/moltblock
 metadata:
@@ -21,7 +21,7 @@ metadata:
     homepage: https://github.com/moltblock/moltblock
     install:
       - kind: node
-        package: moltblock@0.11.5
+        package: moltblock@0.11.6
         bins: [moltblock]
 ---
 
@@ -53,7 +53,7 @@ Verify a task before execution.
 ### Usage
 
 ```bash
-npx moltblock@0.11.5 "<task description>" --provider <provider> --json
+npx moltblock@0.11.6 "<task description>" --provider <provider> --json
 ```
 
 ### Parameters
@@ -77,7 +77,7 @@ Moltblock auto-detects the LLM provider from whichever API key is set. If no key
 
 ```bash
 # Verify a task
-npx moltblock@0.11.5 "implement a function that validates email addresses" --json
+npx moltblock@0.11.6 "implement a function that validates email addresses" --json
 ```
 
 ### Output (JSON mode)
@@ -98,13 +98,13 @@ npx moltblock@0.11.5 "implement a function that validates email addresses" --jso
 Use directly with npx (recommended, no install needed):
 
 ```bash
-npx moltblock@0.11.5 "your task" --json
+npx moltblock@0.11.6 "your task" --json
 ```
 
 Or install globally:
 
 ```bash
-npm install -g moltblock@0.11.5
+npm install -g moltblock@0.11.6
 ```
 
 ## Configuration