Skip to content

0.6.0.md

Latest commit

 

History

History
83 lines (66 loc) · 5.31 KB

0.6.0.md

File metadata and controls

83 lines (66 loc) · 5.31 KB
Raw

Helm v0.6.0 — Runtime Guard & Provider-Agnostic Memory Index

Date: 2026-04-24

Helm 0.6.0 introduces two major capabilities: a deterministic command guard that classifies and risk-scores every command before execution, and a provider-agnostic discovery layer that detects any LLM provider or local model server without calling APIs. A SQLite query index over the JSONL task ledger and an atomic cross-platform JSONL writer round out the reliability improvements. 65 new tests bring the total to 180.

Added

  • Command Guard — deterministic command classification and risk scoring before execution (scripts/command_guard.py)
    • Absolute deny rules for catastrophic commands (rm -rf /, dd to device, mkfs, fork bombs)
    • Profile compatibility enforcement: inspect_local blocks writes/network, workspace_edit blocks network
    • Risk score calculation with configurable thresholds
    • --guard-mode {enforce,audit,off} and --approve-risk CLI flags
    • Guard policy file at references/guard_policy.json
  • Provider-Agnostic Discovery — detect any LLM provider without calling APIs (scripts/model_provider_probe.py, scripts/discovery.py)
    • API provider detection via environment variable presence (OpenAI, Anthropic, Gemini, OpenRouter, Azure, Bedrock, Vertex, Mistral, Groq, Together, Fireworks, Cohere, DeepSeek, xAI)
    • Local provider detection via short-timeout endpoint probes (Ollama, LM Studio, llama.cpp, vLLM)
    • Separate runtime_model_state and helm_intelligence_state concepts
    • Hardware profile detection (OS, architecture, memory, Apple Silicon)
  • SQLite Query Index — read-only index over JSONL source of truth (scripts/ops_db.py)
    • helm db init/rebuild/verify/status subcommands
    • Best-effort index updates after task execution
    • JSONL remains the append-only source of truth
  • Atomic JSONL Append — cross-platform file-locking JSONL writer (scripts/state_io.py)
  • Extended helm doctor — Discovery, Hardware, Runtime model state, Helm intelligence state, Guard, and Ops DB sections
  • Intelligence Tier Skeleton — documented L0-L4 extension points (scripts/intelligence_tier.py)

Security & Hardening

  • command_guard: 7 new command categories (database, cloud, package, credential, process, firewall, cron)
  • command_guard: Flag normalization (--recursive --force → -rf)
  • command_guard: Interpreter unwrapping (python3/perl/ruby/node -c/-e)
  • command_guard: Heredoc, base64 pipe, /dev/tcp bypass detection
  • command_guard: Fail-closed policy on malformed/unknown-version JSON
  • command_guard: Regex pattern support in guard_policy.json
  • command_guard: score_breakdown, evaluated_at, policy_version in audit output
  • run_with_profile: Guard evaluation before manual-remote (closes bypass)
  • run_with_profile: HELM_GUARD_MODE=off environment warning
  • run_with_profile: Fail-closed guard exception handling (require_approval on error)

Reliability

  • model_provider_probe: Empty string env var false positive fix
  • model_provider_probe: Required/optional/weak key combinations (AWS, GCP)
  • model_provider_probe: Response body validation (port_open_unverified status)
  • model_provider_probe: Runtime policy JSON loading with fallback
  • model_provider_probe: 5 new API providers (Replicate, Perplexity, HuggingFace, Cerebras, NVIDIA NIM)
  • model_provider_probe: Confidence field (high/low)
  • discovery: GPU/VRAM detection (NVIDIA + Apple Silicon)
  • ops_db: Streaming JSONL read (no OOM on large files)
  • ops_db: query_tasks() and query_guard_decisions() functions
  • ops_db: _connect helper with standard pragmas
  • ops_db: Auto-UUID for null task_id (prevents PK collision)
  • ops_db: Indexing failure warning (once, then silent)
  • state_io: Windows LK_LOCK with actual write size
  • state_io: Lock failure warnings

CLI

  • helm doctor --skip-discovery flag
  • helm db query subcommand with --status, --profile, --guard-action filters
  • Discovery failure diagnostics in doctor output

Tests

  • 65 new tests (180 total, was 115)

Changed

  • Migrated all tests from unittest.TestCase to pytest function style
  • Split helm.py into commands/ package for single-responsibility modules
  • run_with_profile.py now evaluates command guard before subprocess.run()
  • Task ledger entries now include guard and discovery payloads

Post-Release Hardening

The following fixes were applied after the initial 0.6.0 tag as part of the hardening pass:

  • AMD GPU (ROCm) detection and multi-GPU support — discovery now enumerates AMD/ROCm devices alongside NVIDIA and Apple Silicon, and reports per-GPU VRAM for multi-GPU hosts
  • Custom provider registry support — operators can supply a provider registry file to extend or override built-in provider detection without patching source
  • RiskCategory type completeness — all risk category literals are now covered in the type definition, eliminating gaps that could cause fail-open behaviour on unrecognised categories
  • dev_tcp_bypass risk category — /dev/tcp shell bypass patterns are now assigned their own named risk category instead of falling through to a generic bucket
  • Binary mode for atomic JSONL writes — state_io now opens the lock file in binary mode on all platforms, fixing a line-ending corruption issue on Windows