wyrd/tools
esc

    ↑↓ Move ↵ Open Search by Pagefind

    Releases

    The latest release of each tool, newest first. Subscribe via RSS

    1. mnemonic

      Coding harness plugin · 0.1.0 ·

      Breaking

      • First release: the mnemonic 1.0.0 MCP server for Claude Code and Codex, started under envconsul so its Xolotl embedding key comes from Vault.

    3. wyrwood

      App · 0.7.0 ·

      Breaking

      • The controller database moves to schema 5, and the controller sends a binding’s directory in the policy set. A 0.6.1 controller refuses a schema 5 database at startup and leaves it unchanged, and a 0.6.1 agent closes the session when it receives a binding with a directory, so mixed versions do not stay connected. Use the stopped rollout: stop every agent, back up the controller state directory, upgrade the controller, upgrade every agent while it is stopped, then start the agents. Going back needs that backup.

      Features

      • A container can now be bound by a key that is not name before it exists. On Add binding, Bind by typed key opens a bind screen where you choose an approved agent, type a devcontainer, compose, or name key, and, for a key other than name, a directory name. The agent creates that consumer directory and its sockets right away, so a container created with that key and a mount of the directory finds working sockets on its first start and reads its secrets through vault.sock. Every container the binding governs uses the directory, also when its name differs; the token follows the container as for a name binding. A directory name is required when no agent reports a container with the key. It uses the rule a container name follows, and another binding on the same agent cannot use it. The binding screen shows it. wyrwood bind takes no directory name and binds as before.

        The controller moves its database to schema 5 when it starts, keeping every binding as it was. A 0.6.1 controller refuses a schema 5 database and leaves it unchanged, so going back needs the state directory backed up before the upgrade. A policy set now carries the directory name of such a binding, which a 0.6.1 agent rejects: stop all agents, back up the controller state, upgrade the controller, then upgrade the agents.

      • When you approve an operator key, you now choose its agents and policies from lists of the approved agents and the stored policies, or select all agents or all policies. You can still type a name that does not exist yet, such as a policy the key will create. Before you approve, the form states what the key can and cannot do with each action, on which agents and policies, and that the grant cannot be changed after approval. Before, you typed each name, and the form did not show what the grant allowed.

      Fixes

      • OpenBao keys and the policy editor list Transit keys again after a key is imported into the Transit mount. OpenBao then lists an import/ directory beside the keys, and the controller tried to read it as a key, so both pages showed no Transit key and said OpenBao did not answer. A key that cannot be read no longer empties the list: the page names that key and the failure, such as permission refused, and lists the others. “OpenBao did not answer” now shows only when OpenBao did not answer; a refused list says permission refused.
      • Sign-in now works with an identity provider whose key set also holds an elliptic-curve key on a curve Wyrwood cannot use, or an RSA key larger than it accepts. Wyrwood ignores such a key and verifies with the other keys. Before, the whole key set failed to load, and sign-in failed.
      • Below 792 pixels wide, the web interface shows the navigation as a bar with a Menu button, so the page heading, its actions, and the policy editor’s tabs start in the first screen on a phone. The tabs of the policy editor and the binding editor stay in one row that you scroll sideways; an edge with more tabs beyond it fades, and a tab you focus or select scrolls into view. Menu shows every destination with its pending count, the OpenBao status, Report an issue, and Account. Escape closes it.
      • When you rename a policy to its current name, the policy page now says that the name did not change. Before, the page opened with no message. The rename still changes nothing.

    4. trowel

      App · 0.3.0 ·

      Breaking

      • Start the devcontainer Feature’s Trowel service only after the Ansible Feature’s ansible-setup s6-rc oneshot succeeds when that service is installed, and install after the Ansible Feature. Without the Ansible Feature, Trowel starts as before, and the OpenBao Agent dependency stays independent.

      Features

      • Read configuration snippets from the conf.d directory beside the config file, such as /etc/trowel/conf.d. Their webhooks and subjects are added in file name order, a snippet that sets server, nats, or vault already set elsewhere is an error, and Trowel reloads when a snippet is added, changed, or removed. DEB and RPM packages and the devcontainer Feature create an empty /etc/trowel/conf.d.

      Fixes

      • Publish the public docs from docs/user in the wyrd.foo format, and point the demo recorder at docs/user/assets.

    7. xolotl

      App · 0.6.1 ·

      Features

      • NATS export: with [export.nats], xolotl publishes each exported exchange to a NATS JetStream stream, and ClickHouse loads the stream with its NATS table engine. Rows published while ClickHouse is down wait in the stream; rows waiting while NATS restarts are held in xolotl’s queue and retried until NATS takes them. A row too large for a message has its bodies cut, or is refused and counted. Xolotl checks at startup that the stream exists and takes xolotl.exchanges.>. The new NATS export page gives the stream, consumer and table commands, permissions, sizing and alerts. The direct ClickHouse export is unchanged. Building from source needs Rust 1.89.
      • Anthropic and OpenAI API accounts: the new provider kinds anthropic and openai take an API key (personal, project or service account) and serve the same endpoints as Claude and Codex subscription accounts, so a client can use either. An Anthropic account serves /v1/messages and /v1/messages/count_tokens natively, with the key in x-api-key and the subscription OAuth beta flag dropped, so Claude Code requests and their cache breakpoints reach the API unchanged; an OpenAI account serves /v1/responses and /v1/chat/completions natively. Alias a model to a subscription and an API account to move to the API account when the subscription is at its limit. In the config file, an Anthropic or OpenAI account can authenticate with workload identity federation (workload_identity) instead of a key: xolotl exchanges a JWT from a file for a service account access token and renews it before it expires. The Accounts page documents both.
      • Provider accounts: a provider is now one more kind of account. Add and remove Vercel, Mistral and OpenAI-compatible providers at runtime, on the web UI’s Add account screen or with xolotl accounts add-provider, without editing the config file. The Accounts screen lists provider accounts next to pool accounts; the Providers & models screen is now Models. Config-file providers and their stored keys keep working.
      • The ClickHouse and NATS exports now cover every kind of account, not only the sessions of subscription accounts: provider accounts (Vercel, Mistral, OpenAI-compatible) and API key accounts are exported too, and so are requests without a session, such as embeddings, OCR and passthroughs. A new account_kind column names the kind of the account that served each row. Responses that are not text, such as audio, and passthrough uploads that are not JSON are exported without their bodies. A table made earlier keeps receiving rows without the new column; the ClickHouse and NATS export pages give the ALTER TABLE that adds it.

      Fixes

      • Codex shows its usage limits when the Codex pool runs out. When every Codex account is cooling down, the 429 now carries the x-codex-* usage headers of the account that comes back first. A quota error at the start of a stream keeps the account’s usage headers and uses the error shape Codex reads. Before, Codex showed no limits at that point. The Codex client guide explains where Codex gets its limits through xolotl, and why /status has none before the first turn.

    10. menagerie

      App · 0.4.2 ·

      Fixes

      • An interview of more than one batch of questions moves on from a batch accepted as shown: a re-answered upgrade no longer asks that batch again. The web UI now sends every question it shows, the untouched ones with their defaults, and the template service answers a question a submission leaves out with its default.

    11. dcb

      CLI · 0.3.0 ·

      Breaking

      • Expand native command and configuration compatibility, including create-only container provisioning through the CLI and Go library.

      Features

      • Generate local Feature READMEs with dcb features generate-docs and the features.GenerateDocumentation library API, including options, notes, customizations, publication references, and deprecation notices. Typed publication values retain object properties and repeated values until rendering uses them.

      • Query published Feature manifests, tags, and Mermaid dependency graphs with dcb features info and the features.Info library API.

        Report configuration Feature dependencies with dcb features resolve-dependencies and features.ResolveDependencies, including local and HTTPS Features, OCI lockfile pins, dependency graphs, and ordered installation options.

        Generate Feature lockfiles and update requirements with dcb upgrade and features.Resolver.Upgrade, including dry-run output and existing integrity pins.

      • Package local Features and collections with dcb features package and the features.Package library API, producing archives and collection metadata.

      • dcb up, exec, read-configuration and run-user-commands accept --git-prefix, and workspace.Options.GitPrefix takes the same value: the prefix of the host Git’s build. A Git include.path of %(prefix)/ followed by a relative path is then read below that prefix, as Git reads it, so a file there that Git rejects gives no workspace Git root, and the workspace folder is mounted. Without the setting, such an include is not read, as if the included file were missing. workspace.Options.GitRoot finds the Git root with that prefix.

      • Report current, wanted, and latest OCI Feature versions with dcb outdated and the features.LoadVersionInfo library API, including lockfiles, digest metadata fallback, ordered JSON, and a text table.

      • Generate local Template READMEs with dcb templates generate-docs and templates.GenerateDocumentation, including options, notes and metadata links.

      • Read published Template metadata with dcb templates metadata and the templates.Metadata library API, including manifest digest verification.

      Fixes

      • Honor an explicitly empty workspaceMount without adding a default workspace bind, while retaining additional mounts.

        Honor top-level Dockerfile build contexts. Reject object values for Compose file lists and build cache sources, and nested lifecycle command objects, which are not upstream configuration forms.

        Preserve string appPort publishing and Docker mount options across workspace, additional mounts, and runArgs, including CSV quoting and volume defaults.

        Preserve Docker runArgs boolean assignments, combined and attached short forms, stdin, TTY, automatic removal, and host environment inheritance. Accept overridden entrypoints as in the upstream CLI.

        Accept Docker environment and label files with native file precedence, and apply merged feature flags after runArgs.

        Accept Docker health and logging run arguments with native value precedence and conflict checks.

        Preserve exact Docker NanoCPU values and CPU period, quota, and realtime flags.

        Preserve Docker swappiness and block I/O weight, native integer forms for CPU shares, PID limits and OOM scores, and native OOM disable boolean spellings.

        Preserve Docker per-device block I/O weights and byte/IOPS throttle lists, including native validation, size units, repeated devices, and zero values.

        Preserve Docker storage options and Windows CPU and system-drive I/O creation controls with native value parsing and final-value precedence.

        Preserve native Docker network attachments, endpoint addresses, aliases, MAC addresses, and per-network options through Engine container creation.

        Preserve Docker umask through native creation and daemon confirmation; validate the deprecated kernel-memory flag without applying it.

        Honor upstream Docker stdout/stderr attachment, native stream validation and interactive stdin, with detach conflict checks. Reserve and write cidfile paths on the client before start, retaining written IDs and removing failed reservations.

        Accept common-only configuration reads while requiring sources for build and up. Discover Compose files for empty file arrays from the caller’s environment and workspace. Validate environment value types and preserve upstream remote null behavior in exec and lifecycle commands.

        Map build.options —network to native BuildKit Dockerfile networking and request host entitlement for explicit host mode. Preserve final-value precedence and report unmapped build flags explicitly.

        Map build.options image labels to final native BuildKit image configuration with native array grammar, empty-key validation and last-key precedence.

        Build scratch-only Dockerfiles whose frontend result has no filesystem reference while retaining image configuration and normal nonempty filesystem builds.

        Map build.options build arguments to native Dockerfile solves with host inheritance, ordered precedence and independent config-only metadata and user inference.

        Map build.options target selection to authored and generated stages while retaining independent configured-target metadata and user inference.

        Map build cache options through native buildx parsing and BuildKit cache sessions, including inline cache, local export/import, ordering and contextual errors.

        Map build.options secret and SSH sources through native buildx parsing and BuildKit session providers for Dockerfile and generated feature builds.

        Execute initializeCommand on the host before every up, with upstream workspace, environment, command forms, parallel execution and failure semantics.

        Map Kubernetes image-source command overrides through native OCI image configuration and preserve Feature/configuration environment precedence.

        Preserve Kubernetes image-source runArgs booleans, short forms, stdin, TTY, host environment inheritance and merged security flag precedence.

        Preserve Kubernetes Compose primary service command defaults, explicit empty commands, image fallback, Feature entrypoints, literal dollars and configuration environment precedence. Report missing image configuration and unrepresentable image environment removals with primary service context.

        Preserve Kubernetes Compose sidecar empty command overrides and literal dollars. Use native image configuration for empty-command fallback and final environment unset checks, with contextual errors for unrepresentable image-owned removals. Normalize the native single-empty-string sidecar entrypoint reset.

        Preserve native Docker Compose command defaults, empty command overrides, image fallback, ordered Feature entrypoints and literal dollars. Keep remoteEnv exec-only, preserve environment precedence and remove unset image variables. Do not add stdin or TTY with the primary wrapper.

        Preserve the unconditional image-source wrapper and native image stop signal. Translate overridden Kubernetes entrypoints and report unsupported Pod automatic deletion instead of silently ignoring enabled runArgs —rm.

        Map build.options shared memory size and per-name resource limits to native BuildKit Dockerfile frontend settings with Docker parsing and precedence.

        Preserve native no-cache and pull build option booleans and generated flag precedence in both Dockerfile solve routes.

        Preserve native cgroup-parent build option strings, final value precedence and empty reset across standalone and nested Dockerfile solves.

        Preserve native extra host build options, CSV parsing, ordered IP mappings and Docker worker host gateway resolution on both Dockerfile solve routes.

        Resolve local environment and workspace variables in pre-container build inputs; let library callers select the environment used for build argument substitution.

        Create Docker and Compose containers without starting them through up --no-start and the Go host request NoStart field, then start them with ordinary up.

      • Workspace Git discovery rejects invalid core.autocrlf values in its full config read, including file includes and command-line config. Boolean values and input remain accepted.

      • Use the workspace folder as the Git root inside a bare repository or a .git folder.

      • Honor GIT_CEILING_DIRECTORIES when finding the workspace Git root without running git.

      • Workspace Git discovery reads command-line configuration from GIT_CONFIG_COUNT, its GIT_CONFIG_KEY_n/GIT_CONFIG_VALUE_n pairs, and GIT_CONFIG_PARAMETERS. Invalid syntax or a rejected include.path gives no Git root, so the workspace folder is mounted, as in the upstream CLI.

      • Validate Git common-directory pointers before selecting the workspace Git root.

      • Honor GIT_COMMON_DIR when selecting the workspace Git root.

      • Find no workspace Git root when Git rejects a config file that another config file includes with include.path, such as an included file with a syntax error, an unreadable included file or an include cycle, as Git and the upstream CLI do, so that the workspace folder is mounted instead of a parent repository. As Git does, the repository config is read again after setup, with its includes, a %(prefix)/ include followed by an absolute path names that path, and a relative config file or include name is looked up from the folder that the read starts at, without the length limit of that folder’s path and with only search permission on that folder. Linux release builds look up accounts in /etc/passwd only and skip a ~name/ include whose account is not there, so that a Git configuration that works for an account of another account service finds the same Git root.

      • Apply Git’s core.worktree setting when selecting the workspace Git root. The Git root is found with the credentials of the dcb process, which can differ from the credentials of a git that the upstream CLI starts.

      • Workspace Git discovery rejects invalid advice.detachedHead Boolean values in its full config read, including includes and command-line config.

      • Use the workspace folder as the default Git root when GIT_DIR explicitly selects a valid repository.

      • Stop at a file system boundary when finding the workspace Git root, unless GIT_DISCOVERY_ACROSS_FILESYSTEM is true, as Git does, so that a repository on another file system above the workspace is not mounted.

      • Find the workspace Git root from the physical parent folders of a workspace folder reached through a symbolic link, as Git does, and keep the workspace folder’s path for the root, as the upstream CLI does, so that the same repository is mounted.

      • Workspace Git discovery rejects invalid core.filemode boolean values in its full config read, including file includes and command-line config.

      • Workspace Git discovery rejects invalid core.fsyncObjectFiles boolean values in its full config read, including file includes and command-line config.

      • Find no workspace Git root when Git rejects one of its global config files, such as a ~/.gitconfig or GIT_CONFIG_GLOBAL file with a syntax error, as Git and the upstream CLI do, so that the workspace folder is mounted instead of a parent repository. Relative paths are read again from Git’s working folder after setup, as Git does.

      • Match Git HEAD syntax when selecting the workspace Git root.

      • Workspace Git discovery rejects invalid core.ignorecase boolean values in its full config read, including file includes and command-line config.

      • Workspace Git discovery rejects invalid core.ignorestat boolean values in its full config read, including file includes and command-line config.

      • Workspace Git discovery rejects invalid core.lockfilePid Boolean values in its full config read, including file includes and command-line config.

      • Honor GIT_OBJECT_DIRECTORY when selecting the workspace Git root.

      • Workspace Git discovery rejects invalid pager.color and color.pager Boolean values in its full config read, including includes and command-line config.

      • Workspace Git discovery rejects invalid core.precomposeUnicode boolean values in its full config read, including file includes and command-line config.

      • Workspace Git discovery rejects invalid core.protectHFS boolean values in its full config read, including file includes and command-line config.

      • Workspace Git discovery rejects invalid core.protectNTFS boolean values in its full config read, including file includes and command-line config.

      • Workspace Git discovery rejects invalid core.quotepath boolean values in its full config read, including file includes and command-line config.

      • Workspace Git discovery reads repository config and active config.worktree files as streams, including FIFOs, in both the repository format check and the full read after setup. Invalid syntax or typed values stop the read, as in Git.

      • Apply the repository extension rules of Git 2.55 built without Rust when finding the workspace Git root without running git.

      • Apply Git’s repository format check and core.bare when selecting the workspace Git root.

      • Workspace Git discovery rejects invalid core.safecrlf values in its full config read, including file includes and command-line config. Boolean values and warn remain accepted.

      • Workspace Git discovery rejects invalid sparse.expectFilesOutsideOfPatterns Boolean values in its full config read, including includes and command-line config.

      • Workspace Git discovery rejects invalid core.sparseCheckout boolean values in its full config read, including file includes and command-line config.

      • Workspace Git discovery rejects invalid core.sparseCheckoutCone boolean values in its full config read, including file includes and command-line config.

      • Workspace Git discovery rejects invalid advice.statusHints Boolean values in its full config read, including includes and command-line config.

      • Workspace Git discovery rejects invalid core.symlinks boolean values in its full config read, including file includes and command-line config.

      • Find no workspace Git root when Git rejects the system config file that GIT_CONFIG_SYSTEM names, or a GIT_CONFIG_NOSYSTEM value, as Git and the upstream CLI do, so that the workspace folder is mounted instead of a parent repository. A system or global config file that is a FIFO is read as Git reads it, until its writer closes it, instead of giving no Git root.

      • Workspace Git discovery rejects invalid core.trustctime boolean values in its full config read, including file includes and command-line config.

      • Find no workspace Git root when the workspace folder or a parent folder holds a .git entry that stat fails on for a reason other than a missing entry, or a gitfile that Git cannot read, such as a symbolic link loop or a gitfile that cannot be opened, as Git and the upstream CLI do, so that the workspace folder is mounted instead of a parent repository or a failed command.

      • Workspace Git discovery rejects invalid user.useConfigOnly Boolean values in its full config read, including includes and command-line config.

      • Honor GIT_WORK_TREE when selecting the workspace Git root without running git.

      • Match Git’s gitfile format and size limit when selecting the workspace Git root.

      • Follow a relative gitfile target through the file system as Git does when selecting the workspace Git root, so that a symbolic link before .. leads to the repository Git uses.

      • Mount only the workspace folder when GIT_DIR names a missing repository or an invalid gitfile target.

      • Reuse verified release artifacts for publication retries and wait for npm visibility without republishing accepted packages.

      • Persist user environment probe results in the supplied container session data folder and reuse upstream-compatible mode-specific caches.

    16. gitpr

      CLI · 0.4.2 ·

      Features

      • Read comment text verbatim from a file or standard input with —text-file, preserving whitespace and shell-sensitive text.
      • Add gitpr review —summary for live review state and bounded interdiff file counts without patch or comment bodies.
      • Support lightweight and annotated tag review bases with preserved tag identity, atomic drift checks on verdicts, and external integration closure without changing tags.

      Fixes

      • Use adaptive brand blue accents across the TUI and picker, respect colour-off terminals, and refresh the demo.
      • Keep terminal navigation, read-only review, selection and adaptive colour working with Charm v2.
      • Build development binaries into the gitignored ./bin directory and use ./bin/gitpr in source-build instructions and UAT helpers.
      • Update ANSI handling and Git diff parsing dependencies, and remove unused syntax highlighting dependencies.
      • Restore the read-only TUI diff with live review basis, per-file hunks, thread discussions, scrolling, and refresh.
      • Refuse missing detected bases before creating a PR, with explicit-base recovery guidance, and preserve full remote default branch names.

    17. toha

      CLI · 0.4.1 ·

      Features

      • Preserve named user sections inside generated files on apply and update.
      • Create empty directories from rendered template paths with optional each and when rules. Preserve existing directories and their contents, preview missing directories, and create them during apply, baseline and update.

      Fixes

      • Allow applying templates into unborn worktrees of bare repositories and honor their working-tree attributes.
      • Validate the locked public-library consumer in hosted CI and document refreshing both release lockfiles.

    26. Ansible

      Dev container feature · 1.0.0 ·

      Graduates from 0.x to 1.0.0.

      Breaking

      • Adds the Ansible Feature. It installs Ansible, applies a playbook at container startup through the ansible-setup s6 oneshot, and provides the ansible-sync command to update the playbook source and apply the playbook again. The optional sudoUser option lets one user run sudo ansible-sync and nothing else.

    27. intentional

      CLI · 0.4.1 ·

      Fixes

      • init no longer fails on a package.json without a string name, such as a private manifest that only holds dependencies. Like a Cargo manifest without [package], it describes no versioned project, so it is not a discovery candidate. A repository with such a manifest can now run init, including the contract-1 upgrade.

    29. Wyrd base image

      Dev container image · 1.0.0 ·

      Features

      • An Ubuntu image that is based on the Microsoft Dev Container base image. It keeps the upstream tools, the non-root vscode user and the Dev Container metadata.
      • s6-overlay 3 runs as PID 1. Add services as s6-rc definitions.
      • Variants noble (Ubuntu 24.04) and resolute (Ubuntu 26.04), each for amd64 and arm64. Each tag names its Ubuntu release, so a tag never changes to another release.
      • The vscode user has passwordless sudo only for apt-get and apt update and install, and for s6-overlay service control (s6-svc, s6-svstat and s6-rc). All other sudo commands are denied.

    32. Go

      Dev container feature · 1.0.0 ·

      Features

      • Installs Go and common Go tools, including golangci-lint.
      • Based on the Microsoft Go feature. This feature does not request the Docker --init option, so the image keeps its own init system as PID 1.
      • Options version and golangciLintVersion select the versions to install.

    33. Grok CLI

      Dev container feature · 1.0.0 ·

      Features

      • Installs the Grok CLI for the Dev Container user with xAI’s native installer.
      • Adds grok to the PATH. The executable and its state stay owned by the user, not root.
      • The feature does not add the agent alias, so it does not replace another tool that provides agent.
      • Option version selects the version to install.