relay-shell 0.5.0__tar.gz → 0.5.2__tar.gz

{relay_shell-0.5.0 → relay_shell-0.5.2}/.github/workflows/ci.yml

@@ -41,7 +41,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7
         with:
           python-version: ${{ matrix.python-version }}
           cache: "pip"

{relay_shell-0.5.0 → relay_shell-0.5.2}/.github/workflows/codeql.yml

@@ -38,15 +38,15 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4
+        uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4
 
   # A14-D12: the workflows themselves are code that holds tokens. A separate job (not a
   # matrix entry) so the required check `Analyze (python) (python)` keeps its name. It is in
@@ -63,12 +63,12 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4
         with:
           languages: actions
           build-mode: none
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4
         with:
           category: "/language:actions"

{relay_shell-0.5.0 → relay_shell-0.5.2}/.github/workflows/copilot-setup-steps.yml

@@ -27,7 +27,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.14"
       - name: Prepare the constrained development environment

{relay_shell-0.5.0 → relay_shell-0.5.2}/.github/workflows/docs.yml

@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7
         with:
           python-version: "3.12"
           cache: pip

{relay_shell-0.5.0 → relay_shell-0.5.2}/.github/workflows/nightly-fuzz.yml

@@ -26,7 +26,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7
         with:
           python-version: "3.14"
           cache: "pip"

{relay_shell-0.5.0 → relay_shell-0.5.2}/.github/workflows/pip-audit.yml

@@ -38,7 +38,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7
         with:
           python-version: "3.14"
           cache: "pip"
@@ -70,7 +70,7 @@ jobs:
         # still audited, and pip-audit still exits non-zero on any CVE found.
         run: .audit-tool/bin/pip-audit --path "$AUDIT_SITE_PACKAGES" --skip-editable
 
-      - name: Audit the hash-locked release and SBOM tooling
+      - name: Audit the hash-locked bootstrap, release and SBOM tooling
         # requirements-build.txt / requirements-sbom.txt feed the jobs that build,
         # sign and publish (A14-D7); they are not part of the package's own tree, so
         # audit them explicitly. They are fully pinned, so no resolution is needed.
@@ -78,4 +78,5 @@ jobs:
           .audit-tool/bin/pip-audit --disable-pip --no-deps -r requirements-build.txt
           .audit-tool/bin/pip-audit --disable-pip --no-deps -r requirements-sbom.txt
           .audit-tool/bin/pip-audit --disable-pip --no-deps -r requirements-audit.txt
+          .audit-tool/bin/pip-audit --disable-pip --no-deps -r requirements-bootstrap.txt
 

{relay_shell-0.5.0 → relay_shell-0.5.2}/.github/workflows/release-rehearsal.yml

@@ -31,7 +31,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.14"
       - name: Prepare the locked rehearsal driver
@@ -65,14 +65,14 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         id: build-python
         with:
           python-version: "3.14"
       - name: Prepare hash-locked build tools
         run: |
           python -m pip install --only-binary=:all: --require-hashes -r requirements/development-py3.12.txt
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         with:
           python-version: "3.14"
       - name: Prepare independent audit tools with their locked interpreter
@@ -87,7 +87,7 @@ jobs:
           set -e
           test "$audit_result" -eq 0 || test "$audit_result" -eq 1
           test -s "$RUNNER_TEMP/legacy-audit.json"
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7
         id: legacy-python
         with:
           python-version: "3.12"

{relay_shell-0.5.0 → relay_shell-0.5.2}/.github/workflows/release.yml

@@ -161,7 +161,7 @@ jobs:
           ref: ${{ needs.verify.outputs.release_commit }}
           persist-credentials: false
 
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7
         with:
           python-version: "3.14"
           # No pip cache on the release path: nothing restored from a shared
@@ -201,6 +201,9 @@ jobs:
           python -m pip check
 
       - name: Run full test suite
+        env:
+          # Keep generated test data outside the source distribution input tree.
+          HYPOTHESIS_STORAGE_DIRECTORY: ${{ runner.temp }}/release-hypothesis
         run: pytest -q
 
       - name: Build wheel + sdist

{relay_shell-0.5.0 → relay_shell-0.5.2}/.github/workflows/sbom.yml

@@ -53,7 +53,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7
         with:
           python-version: "3.14"
 

{relay_shell-0.5.0 → relay_shell-0.5.2}/.pre-commit-config.yaml

@@ -15,7 +15,7 @@ repos:
     # Pin to a known-good ruff release. Update this `rev` and the
     # `ruff==` pin in `[project.optional-dependencies] dev` together
     # so local pre-commit and `pip install -e ".[dev]"` agree.
-    rev: v0.17.1
+    rev: v0.17.2
     hooks:
       - id: ruff
         args: [--fix]

{relay_shell-0.5.0 → relay_shell-0.5.2}/CHANGELOG.md

@@ -6,6 +6,42 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.5.2] - 2026-11-02
+
+### Fixed
+
+- Validate the actual audit descriptor before initial permission hardening and on
+  rotation reopens. Unsupported devices/FIFOs now degrade to stderr without
+  metadata changes or blocking; regular append sinks retain their behavior.
+- Validate regular descriptors for audit-tail and verification reads;
+  handle invalid paths and unavailable home directories through audit fallback.
+- Report rotation-open failures through audit health and preserve the first
+  degraded reason. Skip chain-tail reads after sink initialization fails.
+- Preserve operator-created rotation-file modes; newly created files remain
+  private. See [ADR 0007](docs/adr/0007-audit-hash-chain.md#audit-sink-descriptor-validation-2026-11-02).
+
+## [0.5.1] - 2026-11-02
+
+### Performance
+
+- Avoid unnecessary delete/format scans and privilege-context parsing; use an
+  ASCII fast path while preserving Unicode input and published-table overrides.
+  Keep classification semantics and timing thresholds unchanged. See
+  [ADR 0003](docs/adr/0003-tiered-authority.md#2026-11-02-equivalent-scan-gates-patterns-version-17).
+
+### Security
+
+- Hash-pin and audit installer pip independently; upgrade both the disposable
+  builder and transaction-protected runtime before installing dependency closures.
+
+### Changed
+
+- Refresh Ruff, virtualenv development tooling and pinned GitHub Actions.
+
+### Fixed
+
+- Keep release Hypothesis caches outside package source inputs.
+
 ## [0.5.0] - 2026-10-22
 
 - Change edge-installer precedence: explicitly exported `RELAY_SHELL_EDGE_*` values override the operator environment file; explicitly empty optional values now fail validation instead of selecting defaults. Review exported values before reinstalling the edge.
@@ -1793,7 +1829,9 @@ All notable changes to this project are documented here. The format follows
   bundled logrotate config drops and restores the append-only attribute
   across rotation. See `docs/deployment.md` §6.
 
-[Unreleased]: https://github.com/rmednitzer/relay-shell/compare/v0.5.0...HEAD
+[Unreleased]: https://github.com/rmednitzer/relay-shell/compare/v0.5.2...HEAD
+[0.5.2]: https://github.com/rmednitzer/relay-shell/compare/v0.5.1...v0.5.2
+[0.5.1]: https://github.com/rmednitzer/relay-shell/compare/v0.5.0...v0.5.1
 [0.5.0]: https://github.com/rmednitzer/relay-shell/compare/v0.4.0...v0.5.0
 [0.4.0]: https://github.com/rmednitzer/relay-shell/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/rmednitzer/relay-shell/compare/v0.2.0...v0.3.0

{relay_shell-0.5.0 → relay_shell-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: relay-shell
-Version: 0.5.0
+Version: 0.5.2
 Summary: A highly reliable, maximally capable MCP server for complete shell and SSH mastery: a governed relay in the shell/SSH path.
 Project-URL: Homepage, https://github.com/rmednitzer/relay-shell
 Project-URL: Documentation, https://rmednitzer.github.io/relay-shell/
@@ -36,13 +36,13 @@ Requires-Dist: pre-commit<5,>=4.0; extra == 'dev'
 Requires-Dist: pyjwt<3,>=2.15.0; extra == 'dev'
 Requires-Dist: pytest-asyncio<2,>=0.24; extra == 'dev'
 Requires-Dist: pytest<10,>=8.3; extra == 'dev'
-Requires-Dist: ruff==0.17.1; extra == 'dev'
+Requires-Dist: ruff==0.17.2; extra == 'dev'
 Provides-Extra: http
 Description-Content-Type: text/markdown
 
 # Relay Shell
 
-v0.5.0 · Python 3.12 / 3.14 · transports `stdio` and `streamable-http` · MCP SDK
+v0.5.2 · Python 3.12 / 3.14 · transports `stdio` and `streamable-http` · MCP SDK
 `mcp>=2,<3` · Apache-2.0
 
 `relay-shell` is a [Model Context Protocol](https://modelcontextprotocol.io) server that gives

{relay_shell-0.5.0 → relay_shell-0.5.2}/README.md

@@ -1,6 +1,6 @@
 # Relay Shell
 
-v0.5.0 · Python 3.12 / 3.14 · transports `stdio` and `streamable-http` · MCP SDK
+v0.5.2 · Python 3.12 / 3.14 · transports `stdio` and `streamable-http` · MCP SDK
 `mcp>=2,<3` · Apache-2.0
 
 `relay-shell` is a [Model Context Protocol](https://modelcontextprotocol.io) server that gives

{relay_shell-0.5.0 → relay_shell-0.5.2}/deploy/install.sh

@@ -129,6 +129,8 @@ esac
 RUNTIME_LOCK="$SRC_DIR/requirements/runtime-py$PYTHON_PROFILE.txt"
 [ -r "$RUNTIME_LOCK" ] || die "runtime dependency lock missing"
 [ -r "$SRC_DIR/requirements-build.txt" ] || die "build tooling lock missing"
+BOOTSTRAP_LOCK="$SRC_DIR/requirements-bootstrap.txt"
+[ -r "$BOOTSTRAP_LOCK" ] || die "installer bootstrap lock missing"
 
 log "Ensuring service account 'relay-shell'"
 if ! id relay-shell >/dev/null 2>&1; then
@@ -139,6 +141,8 @@ fi
 # Build with locked tooling in an owned disposable environment, not in the runtime.
 BUILD_DIR=$(sudo -u relay-shell mktemp -d "$PREFIX/.build-XXXXXXXX")
 sudo -u relay-shell "$INSTALL_PYTHON" -m venv "$BUILD_DIR/venv"
+sudo -u relay-shell "$BUILD_DIR/venv/bin/python" -m pip install --quiet \
+    --only-binary=:all: --no-deps --require-hashes -r "$BOOTSTRAP_LOCK"
 sudo -u relay-shell "$BUILD_DIR/venv/bin/python" -m pip install --quiet \
     --only-binary=:all: --require-hashes -r "$SRC_DIR/requirements-build.txt"
 sudo -u relay-shell "$BUILD_DIR/venv/bin/python" -m build --wheel --no-isolation \
@@ -165,6 +169,8 @@ log "Creating venv at $PREFIX/venv"
 if [ ! -x "$PREFIX/venv/bin/python" ]; then
     sudo -u relay-shell python3 -m venv "$PREFIX/venv"
 fi
+sudo -u relay-shell "$PREFIX/venv/bin/python" -m pip install --quiet \
+    --only-binary=:all: --no-deps --require-hashes -r "$BOOTSTRAP_LOCK"
 sudo -u relay-shell "$PREFIX/venv/bin/python" -m pip install --quiet \
     --only-binary=:all: --require-hashes -r "$RUNTIME_LOCK"
 sudo -u relay-shell "$PREFIX/venv/bin/python" -m pip install --quiet \

{relay_shell-0.5.0 → relay_shell-0.5.2}/docs/adr/0003-tiered-authority.md

@@ -148,3 +148,26 @@ review.
 nothing) the tier and basis now also reach the caller as a trailing `[NOTICE ...]` line for
 Tier 2 and Tier 3 calls. Admission rules are unchanged. See
 [ADR 0013](0013-open-by-default-with-unsafe-notices.md).
+
+
+## 2026-11-02: equivalent scan gates (patterns version 17)
+
+This performance repair addresses SC-4/UCA-4 without changing SC-1/SC-2
+classification intent. The risk is a false-negative prefilter (H-1/UCA-1), so
+gates use necessary syntax only: every separated delete rule consumes whitespace
+immediately before a dash or slash; the drive-format rule consumes a colon. The
+complete matcher and optimized matcher share rule sources. Unicode whitespace,
+positive/near-miss fixtures, generated command sequences and arbitrary Unicode
+inputs compare the optimized path to the full matcher. The privilege fast path
+skips context processing only when no original privilege keyword exists; replacing
+whole reader segments with a space cannot create one. Regex heuristics remain
+heuristics, not containment. No new dependency or runtime posture change.
+
+Rollback restores the previous complete runtime. Acceptance requires unchanged
+classification on the regression corpus, existing timing limits, full tests and
+fuzz gates; measured improvements are host- and workload-dependent.
+
+ASCII-only inputs also use equivalent ASCII regex variants for common Tier-3
+and Tier-2 scans. Inputs containing any non-ASCII character retain the original
+Unicode regexes; replacing a published table disables its optimized variant.
+Differential tests cover both paths.

{relay_shell-0.5.0 → relay_shell-0.5.2}/docs/adr/0007-audit-hash-chain.md

@@ -245,3 +245,39 @@ unchained, head-truncated (with and without `--segment`), and genesis logs.
 No change to policy admission, tier semantics, the no-sandbox posture, or
 any tool's response shape. This pass hardened a compensating control
 (ADR 0002's first one); it did not move the trust boundary.
+
+
+## Audit sink descriptor validation (2026-11-02)
+
+A privileged validation run exposed path-based permission hardening of a device
+before file-type validation. FIFO opens could also block, including chain resume
+after initialization failure, while a rotation-open error could escape the
+handler's degraded-state update.
+
+Validate the descriptor used for writes with fstat, both initially and after
+rotation. Open nonblocking so unsupported FIFOs cannot stall initialization or
+reopen. Only the initial regular descriptor is subject to best-effort fchmod;
+preserve existing rotation-file permissions and create missing files at 0600.
+Initialization failure uses the existing stderr fallback and skips chain-tail
+reads. Reopen failures mark degraded through the existing first-reason-wins API.
+
+This changes unsupported sink handling, with no record-schema, hash-chain,
+execution-authority or policy-mode change. Control-authority STPA changes are
+not applicable; the operational constraints are nonblocking FIFO failure, no device
+metadata mutation, visible degradation and unchanged valid-file append/rotation.
+Device/symlink, FIFO with/without readers, rotation, path replacement, descriptor
+cleanup and chmod-refusal regressions test these constraints. Qualified Python
+profiles and privileged file-mode evidence must be retained at release.
+
+Operator-controlled paths and other filesystem actors remain trusted. This does
+not establish durable storage, fsync guarantees, a hostile-directory boundary or
+independent off-host evidence. Roll back the complete runtime if necessary while
+preserving accepted audit records; no data migration is required.
+
+Audit-tail reads (plain and gzip) and chain-verification opens use the same
+regular-descriptor validation. This also prevents a regular-to-FIFO replacement
+from blocking between a path check and the actual read. Invalid paths and an
+unavailable home directory degrade initialization through the existing fallback.
+
+O_NONBLOCK is not a general storage or network-filesystem timeout; regular-file
+I/O latency remains governed by the operating system and storage.

{relay_shell-0.5.0 → relay_shell-0.5.2}/docs/architecture.md

@@ -28,6 +28,13 @@ MCP client (Claude / Inspector / SDK)
                   \---- SessionRegistry -------/   (unified local + SSH PTYs)
 ```
 
+Tier classification uses the shared pattern tables. Necessary-syntax gates skip
+delete/format rule families only when their required syntax is absent. The full
+Tier-3 regex remains the reference and replacement contract; replacing it disables
+the built-in optimization. Privilege context is parsed only when a privilege
+keyword is present. These optimizations do not truncate input or alter policy
+precedence.
+
 ## Request lifecycle
 
 Every tool body is identical in shape (`Relay.run`):
@@ -69,6 +76,14 @@ Every tool body is identical in shape (`Relay.run`):
    for tamper-evidence ([ADR 0007](adr/0007-audit-hash-chain.md)); default off
    keeps the record byte-identical.
 
+The audit file handler validates its opened descriptor at initialization and every
+rotation reopen. It uses nonblocking open to avoid FIFO stalls, rejects nonregular
+sinks and hardens only the initial regular descriptor. Invalid initialization
+falls back to stderr and skips chain-tail reads. Reopen failures mark audit health
+degraded while tool calls continue; existing rotation-file modes are preserved.
+Regular-file type checks alone do not prove storage durability or constrain an
+operator-controlled path.
+
 A tool may fail, time out, or be denied, but it always returns a single bounded, audited
 string; the one exception is a cancelled call, which is audited and then re-raised.
 
@@ -180,3 +195,13 @@ bounds), see [`runbook.md`](runbook.md) §2. The reproducible validation
 pass against the upstream `mcp` / `asyncssh` / OAuth surfaces lives in
 [ADR 0005](adr/0005-codebase-validation.md), which records the
 methodology and the most recent pass outcome.
+
+ASCII-only inputs also use equivalent ASCII regex variants for common Tier-3
+and Tier-2 scans. Inputs containing any non-ASCII character retain the original
+Unicode regexes; replacing a published table disables its optimized variant.
+Differential tests cover both paths.
+
+Audit-tail reads (plain and gzip) and chain-verification opens use the same
+regular-descriptor validation. This also prevents a regular-to-FIFO replacement
+from blocking between a path check and the actual read. Invalid paths and an
+unavailable home directory degrade initialization through the existing fallback.

{relay_shell-0.5.0 → relay_shell-0.5.2}/docs/index.md

@@ -6,7 +6,7 @@ title: Overview
 
 A [Model Context Protocol](https://modelcontextprotocol.io) server for **complete shell and
 SSH operation**: local commands and scripts, interactive PTY sessions, fleet operation over
-SSH, SFTP transfers and port forwards. Current release: **v0.4.0** (2026-10-15).
+SSH, SFTP transfers and port forwards. Current release: **[v0.5.2](https://github.com/rmednitzer/relay-shell/releases/tag/v0.5.2)** (2026-11-02).
 
 It is operator infrastructure for hosts you own and administer. It runs with the privileges
 of its service account, with no sandbox, and it is **open by default**: with the default

{relay_shell-0.5.0 → relay_shell-0.5.2}/docs/runbook.md

@@ -271,6 +271,14 @@ alertable; any HTTP response (including 401/403/404) means the listener is up.
 
 ### 2.9 Audit-log hygiene
 
+Configure a regular audit file. Device/FIFO sinks are unsupported: initialization
+degrades to stderr without changing their permissions or waiting for a reader.
+Each rotation reopen also validates the actual descriptor; failure marks runtime
+audit health degraded. Initial regular-file hardening is best effort (append-only
+files may refuse chmod), and existing operator-created rotation-file modes remain
+unchanged. New files use mode 0600. Do not interpret a regular-file check as a
+proof of durable persistence.
+
 On a real deployment:
 
 ```bash
@@ -1106,6 +1114,8 @@ caches, signing or publishing rights. `scripts/rehearse_release.py` archives the
 committed source into a disposable directory and executes the named release
 install/build/distribution-check and SBOM preparation/generation shell steps
 verbatim. It uses Python 3.14 and the same workflow-revision tooling locks.
+The release workflow keeps Hypothesis storage under the runner temporary directory
+so its pre-build test run cannot add generated caches to the source distribution.
 The normal two-profile Ubuntu/Python CI matrix runs the full test suite; the rehearsal does
 not run it again. Package and actual installer/recovery rehearsals run on both
 Ubuntu 24.04 and 26.04, using each host's native Python for the installed runtime. Its receipt binds source, interpreter, distribution/SBOM hashes
@@ -1184,3 +1194,26 @@ it does not make PR-edited workflows immutable or establish independent human
 review. Zero required approvals and CODEOWNERS enforcement remain separate policy
 choices. Restore settings only from a reviewed prior ruleset, preserving required
 check identity; removing an aggregate is not an equivalent rollback.
+
+
+### Classifier scan gates (patterns version 17)
+
+Tier-3 matching partitions common rules from delete rules requiring whitespace
+followed by a dash/slash, and format rules requiring a colon. Necessary-syntax
+gates skip only families that cannot match; the complete regex is assembled from
+the same sources and retained as a differential-test reference. Privilege-context
+parsing runs only when the original text contains a privilege keyword. Reader
+replacement removes whole command segments and cannot introduce such a keyword.
+No command text is truncated, no flags are normalized and no policy mode, denial,
+confirmation or audit behavior changes. Keep the existing absolute timing limits
+and run the complete test suite plus fuzz tests when modifying these gates.
+
+ASCII-only inputs also use equivalent ASCII regex variants for common Tier-3
+and Tier-2 scans. Inputs containing any non-ASCII character retain the original
+Unicode regexes; replacing a published table disables its optimized variant.
+Differential tests cover both paths.
+
+Audit-tail reads (plain and gzip) and chain-verification opens use the same
+regular-descriptor validation. This also prevents a regular-to-FIFO replacement
+from blocking between a path check and the actual read. Invalid paths and an
+unavailable home directory degrade initialization through the existing fallback.

{relay_shell-0.5.0 → relay_shell-0.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "relay-shell"
-version = "0.5.0"
+version = "0.5.2"
 description = "A highly reliable, maximally capable MCP server for complete shell and SSH mastery: a governed relay in the shell/SSH path."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -45,7 +45,7 @@ dev = [
   # -e ".[dev]"` without the development lock no longer provides it. Declared explicitly
   # because a package the suite imports should never be a transitive.
   "httpx>=0.28,<1",
-  "ruff==0.17.1",
+  "ruff==0.17.2",
   "mypy>=1.13,<3",
   "coverage[toml]>=7.6,<8",
   "pre-commit>=4.0,<5",

{relay_shell-0.5.0 → relay_shell-0.5.2}/renovate.json5

@@ -137,7 +137,8 @@
         "requirements-build.txt",
         "requirements-sbom.txt",
         "requirements-audit.txt",
-        "requirements/*.txt"
+        "requirements/*.txt",
+        "requirements-bootstrap.txt"
       ],
       "enabled": false
     },
@@ -196,7 +197,7 @@
   },
   "pip-compile": {
     "managerFilePatterns": [
-      "/^requirements-(?:build|sbom|audit)\\.txt$/",
+      "/^requirements-(?:build|sbom|audit|bootstrap)\\.txt$/",
       "/^requirements/(?:runtime|development)-py3\\.(?:12|14)\\.txt$/"
     ]
   }

{relay_shell-0.5.0 → relay_shell-0.5.2}/requirements/README.md

@@ -34,3 +34,15 @@ A lock fixes selected package bytes; it does not establish provenance by itself,
 absence of vulnerabilities, cross-platform qualification or reproducible native
 compilation. CI exercises each selected profile. The package is installed after
 dependencies with --no-deps; source builds require the separately locked backend.
+
+The requirements-bootstrap.txt lock, generated from requirements-bootstrap.in,
+pins installer pip independently of application profiles and build dependencies.
+The installer upgrades this hash-locked, binary-only bootstrap in its disposable
+builder and in the stopped, transaction-protected runtime before installing their
+dependency closures. Pip remains excluded from application-inventory reconciliation;
+that exception does not mean its bootstrap version is unmanaged.
+Regenerate the lock with its recorded command, review hashes/advisories, and run
+the actual installer/recovery rehearsals on both qualified OS/Python profiles.
+The pip-audit workflow audits this lock explicitly; Renovate's pip-compile manager
+owns its generated output. Bootstrap failure retains the installer's existing
+rollback and stopped-service behavior.

{relay_shell-0.5.0 → relay_shell-0.5.2}/requirements/development-py3.12.txt

@@ -1522,25 +1522,25 @@ rpds-py==2026.9.1 \
     # via
     #   jsonschema
     #   referencing
-ruff==0.17.1 \
-    --hash=sha256:056c5d5fa0ac790051ae165d7035c7bf956d02de2db557f2e9b31d877a505fca \
-    --hash=sha256:1796c41eafec66f4635125dd1e074a7aa27b8d20c187d484360acf11d247fc4a \
-    --hash=sha256:1de0030a8aa78c65c5fecb84b2e5c390ac684c0452875a02afc7c083d49a496a \
-    --hash=sha256:29b454f18ca3eeaf37fbf140841dcf27d36109e29dee9aae8acecb68c26c6f74 \
-    --hash=sha256:42400b9a6ff8515ff27796f07f92e0195be011c86e81e381606f58ea5502fef4 \
-    --hash=sha256:4c0d6cb5f8fbac77eec9af49f4fc0eaf856b05545e372b0694d24b4e76b1c640 \
-    --hash=sha256:5bb796c5112e9fb9527f2ef2faa0a130d6312d19de92bcfaddd70dbb2d41020f \
-    --hash=sha256:5df76f16580fab58d0f6c98a3ac254a4abceb7b2489b8b678335869cff77b3d7 \
-    --hash=sha256:684154861a819bf1f433669d2a0ce9c3e54677c65b8ebb866cc2a7ec86345785 \
-    --hash=sha256:78beced4a3c94dfedbee4b999b95b6a27b35820fdc0afbacc6d37a8da26c1cd1 \
-    --hash=sha256:7feefc63921202894f0e158b0e32f45a5950d70a7fb693ccb9264816c25b1c05 \
-    --hash=sha256:80e53b0e5faa3c5667f035daaa032893ae42b7cfe708c886d39ed131e54688ab \
-    --hash=sha256:872e03dd231744d6c5ec5c8af6be52b71323fc6ee096e4c8b34d9f844ee3b978 \
-    --hash=sha256:8eadb09a788010be29c895418bdfa513e4e1c65e64b94e5b19e4cd381f6cc7fb \
-    --hash=sha256:8f9aa5b5bd5fa1937803ea609c8f153b8de39bf3e0e149897ae34b0c5b52f467 \
-    --hash=sha256:a6ef98e51de8ef38082f90653ceeb84944bd7673783eea13e1647c5b9b064189 \
-    --hash=sha256:bd8f5a55b10f371642eacd0e8665a42a8b97da15c9a7187c79e697b77b5e0ce4 \
-    --hash=sha256:ce05e6f3973611d9550a600e04bb531061e368baba31610eb57c1509a8f21a0a
+ruff==0.17.2 \
+    --hash=sha256:122258f6ecde0e0dd1bb60b24263c3edde4338caf723fca711cc729f9bfd414a \
+    --hash=sha256:195ad918027f817c119310ca89a42d347887dfc28934aaa869325e9c5dc9d962 \
+    --hash=sha256:1b59d447f197bef9ef48a22ba1a6016137753c6099e9bac9c36eb566e422424c \
+    --hash=sha256:2d086be452eed686aa51271ecf2cbe5037956517cc6ee39a17b4489ac12f8bbe \
+    --hash=sha256:39c5b55c960515cdb32be16e69efb5734c589c06a0eb38a22694524a336b889d \
+    --hash=sha256:583bd67bb9e7061dd09bc46a0a884bae2bbd214dbcd48e509813612619683869 \
+    --hash=sha256:5875a16b0de70b43cb81eabea5ae5e8f5d1b2fd1b5e6ed07f80cfe5019d0bd5a \
+    --hash=sha256:6bce7d1f5165701ae18f5df85c65afe78cddfa6c5fb4b9bdb0014d60388f3edd \
+    --hash=sha256:7cfd783590edf2b77317882631900f6a13ea2e8eacefe6ebf2370d2715299160 \
+    --hash=sha256:7f8fba429d6ac4128ab29cfb8fa6240d2fa671d04adf7f84d3b22fc7b6b6bea4 \
+    --hash=sha256:84d632402d14c23b488f941db23712d6736a013225162062d34558c3f3c780eb \
+    --hash=sha256:8c21b4ab24485358f17291a4f8dc5399b834e963b8efedd920fe4fdb02081bb4 \
+    --hash=sha256:92a80d2f44584dabb0189b3a6c393e37e525e04942838482010575cb81945be7 \
+    --hash=sha256:96a65e755d8dba094707fb23ab602111d9a31ec2835b3a6992a1914a8fcb211e \
+    --hash=sha256:b7d0906677d89bbf3cf73cde64b5bbe2ab35df3ae43e49ee2627301e91265bac \
+    --hash=sha256:ba405cbd5ec7bda1f555d5e52be1fd68d02608d4d95d24591bdac92cfacb579f \
+    --hash=sha256:c555a877f8f41447e318101cfefea9bf12dfa9f82eedf90c376e57e069f917d0 \
+    --hash=sha256:c60f93fec7142dba5b8f487f94bf2f6231dae24dc11e4c48648347c8b0720004
     # via
     #   -c requirements.txt
     #   relay-shell (pyproject.toml)
@@ -1630,7 +1630,7 @@ uvicorn==0.54.0 \
     #   -c requirements.txt
     #   relay-shell (pyproject.toml)
     #   mcp
-virtualenv==21.14.12 \
-    --hash=sha256:7820aeaef23f1f59a96458edfc7f9d3deac937155718de15f1c9a64471e15551 \
-    --hash=sha256:bbcfb78e36c22ad70c6917c4aecb5e63477d3c138e9f88c946f320e31859c76a
+virtualenv==21.14.13 \
+    --hash=sha256:5fbb04138a4861580b78ba9110d529a26bc48fcc93c8ec36bc0202eeed96a788 \
+    --hash=sha256:de5307ba4b9a0001d9c8ea02832d38f63ca432880f416c1bface61c4323fd905
     # via pre-commit

{relay_shell-0.5.0 → relay_shell-0.5.2}/requirements/development-py3.14.txt

@@ -1522,25 +1522,25 @@ rpds-py==2026.9.1 \
     # via
     #   jsonschema
     #   referencing
-ruff==0.17.1 \
-    --hash=sha256:056c5d5fa0ac790051ae165d7035c7bf956d02de2db557f2e9b31d877a505fca \
-    --hash=sha256:1796c41eafec66f4635125dd1e074a7aa27b8d20c187d484360acf11d247fc4a \
-    --hash=sha256:1de0030a8aa78c65c5fecb84b2e5c390ac684c0452875a02afc7c083d49a496a \
-    --hash=sha256:29b454f18ca3eeaf37fbf140841dcf27d36109e29dee9aae8acecb68c26c6f74 \
-    --hash=sha256:42400b9a6ff8515ff27796f07f92e0195be011c86e81e381606f58ea5502fef4 \
-    --hash=sha256:4c0d6cb5f8fbac77eec9af49f4fc0eaf856b05545e372b0694d24b4e76b1c640 \
-    --hash=sha256:5bb796c5112e9fb9527f2ef2faa0a130d6312d19de92bcfaddd70dbb2d41020f \
-    --hash=sha256:5df76f16580fab58d0f6c98a3ac254a4abceb7b2489b8b678335869cff77b3d7 \
-    --hash=sha256:684154861a819bf1f433669d2a0ce9c3e54677c65b8ebb866cc2a7ec86345785 \
-    --hash=sha256:78beced4a3c94dfedbee4b999b95b6a27b35820fdc0afbacc6d37a8da26c1cd1 \
-    --hash=sha256:7feefc63921202894f0e158b0e32f45a5950d70a7fb693ccb9264816c25b1c05 \
-    --hash=sha256:80e53b0e5faa3c5667f035daaa032893ae42b7cfe708c886d39ed131e54688ab \
-    --hash=sha256:872e03dd231744d6c5ec5c8af6be52b71323fc6ee096e4c8b34d9f844ee3b978 \
-    --hash=sha256:8eadb09a788010be29c895418bdfa513e4e1c65e64b94e5b19e4cd381f6cc7fb \
-    --hash=sha256:8f9aa5b5bd5fa1937803ea609c8f153b8de39bf3e0e149897ae34b0c5b52f467 \
-    --hash=sha256:a6ef98e51de8ef38082f90653ceeb84944bd7673783eea13e1647c5b9b064189 \
-    --hash=sha256:bd8f5a55b10f371642eacd0e8665a42a8b97da15c9a7187c79e697b77b5e0ce4 \
-    --hash=sha256:ce05e6f3973611d9550a600e04bb531061e368baba31610eb57c1509a8f21a0a
+ruff==0.17.2 \
+    --hash=sha256:122258f6ecde0e0dd1bb60b24263c3edde4338caf723fca711cc729f9bfd414a \
+    --hash=sha256:195ad918027f817c119310ca89a42d347887dfc28934aaa869325e9c5dc9d962 \
+    --hash=sha256:1b59d447f197bef9ef48a22ba1a6016137753c6099e9bac9c36eb566e422424c \
+    --hash=sha256:2d086be452eed686aa51271ecf2cbe5037956517cc6ee39a17b4489ac12f8bbe \
+    --hash=sha256:39c5b55c960515cdb32be16e69efb5734c589c06a0eb38a22694524a336b889d \
+    --hash=sha256:583bd67bb9e7061dd09bc46a0a884bae2bbd214dbcd48e509813612619683869 \
+    --hash=sha256:5875a16b0de70b43cb81eabea5ae5e8f5d1b2fd1b5e6ed07f80cfe5019d0bd5a \
+    --hash=sha256:6bce7d1f5165701ae18f5df85c65afe78cddfa6c5fb4b9bdb0014d60388f3edd \
+    --hash=sha256:7cfd783590edf2b77317882631900f6a13ea2e8eacefe6ebf2370d2715299160 \
+    --hash=sha256:7f8fba429d6ac4128ab29cfb8fa6240d2fa671d04adf7f84d3b22fc7b6b6bea4 \
+    --hash=sha256:84d632402d14c23b488f941db23712d6736a013225162062d34558c3f3c780eb \
+    --hash=sha256:8c21b4ab24485358f17291a4f8dc5399b834e963b8efedd920fe4fdb02081bb4 \
+    --hash=sha256:92a80d2f44584dabb0189b3a6c393e37e525e04942838482010575cb81945be7 \
+    --hash=sha256:96a65e755d8dba094707fb23ab602111d9a31ec2835b3a6992a1914a8fcb211e \
+    --hash=sha256:b7d0906677d89bbf3cf73cde64b5bbe2ab35df3ae43e49ee2627301e91265bac \
+    --hash=sha256:ba405cbd5ec7bda1f555d5e52be1fd68d02608d4d95d24591bdac92cfacb579f \
+    --hash=sha256:c555a877f8f41447e318101cfefea9bf12dfa9f82eedf90c376e57e069f917d0 \
+    --hash=sha256:c60f93fec7142dba5b8f487f94bf2f6231dae24dc11e4c48648347c8b0720004
     # via
     #   -c requirements.txt
     #   relay-shell (pyproject.toml)
@@ -1626,7 +1626,7 @@ uvicorn==0.54.0 \
     #   -c requirements.txt
     #   relay-shell (pyproject.toml)
     #   mcp
-virtualenv==21.14.12 \
-    --hash=sha256:7820aeaef23f1f59a96458edfc7f9d3deac937155718de15f1c9a64471e15551 \
-    --hash=sha256:bbcfb78e36c22ad70c6917c4aecb5e63477d3c138e9f88c946f320e31859c76a
+virtualenv==21.14.13 \
+    --hash=sha256:5fbb04138a4861580b78ba9110d529a26bc48fcc93c8ec36bc0202eeed96a788 \
+    --hash=sha256:de5307ba4b9a0001d9c8ea02832d38f63ca432880f416c1bface61c4323fd905
     # via pre-commit

relay_shell-0.5.2/requirements-bootstrap.in

@@ -0,0 +1 @@
+pip>=26.2.2,<27