Changelog

v0.3.0 cli-update-spec + cli-feedback-spec

Adds self-update, self-installation, and feedback. Veil now implements four of the six agent-first CLI specs.

New commands

• veil update [--check|--force] — self-update from GitHub releases. Downloads, verifies sha256, smoke-tests, atomic swap with .bak rollback. cli-update-spec conformant.
• veil install [--prefix DIR] — copy the running binary to ~/.local/bin (default). Idempotent, never sudo. uninstall is a no-op success if not there.
• veil uninstall [--prefix DIR] — remove the binary. Never touches config/data.
• veil feedback "<msg>" [-kind bug|idea|praise|note] — relay-only dual-write to feedback.intrane.fr. Never fails the caller. FEEDBACK_RELAY=off disables. cli-feedback-spec conformant.

Spec compliance

• cli-output-spec — JSON stdout, typed errors, semantic exit codes, help-json
• cli-guide-spec — veil guide embedded mental model
• cli-update-spec — veil update, install, uninstall
• cli-feedback-spec — veil feedback relay-only
• cli-telemetry-spec — deliberately skipped (secret manager making network calls is a bad look)
• cli-daemon-spec — n/a (veil is CLI-only)

v0.2.0 leak audit fixes

Fixes two critical leaks found in non-interactive agent testing. 15/15 regression tests pass.

Fixes

• LEAK #3 (CRITICAL): exec no longer puts secrets in the command line (was visible in ps//proc). Now uses a temp env file (0600) that's deleted before the child runs.
• LEAK #6 (HIGH): Scrubber now catches reversed, space-separated, hex-encoded, and partial substring (>=8 chars) variants. Previously only exact/base64/URL-encoded.

Documentation

• Added known limitations section to README and docs site
• Added v0.2.0 leak test report (15/15 tests pass)
• Documented inherent limitations: same-user file access, /proc/environ, arbitrary transforms, set -v argv leak

v0.1.0 initial release

Clean-room reimplementation of the Phoenix Secrets concept in machin/MFL. Fixes three critical security flaws found in the Phoenix audit.

The 3 fixes

• Mandatory output scrubbing — veil exec captures child stdout/stderr and replaces every known secret with *** before emitting. Phoenix's exec used syscall.Exec with no interception, leaking secrets in child output. → The key fix.
• No raw secret output by default — veil get refuses to print to stdout without --raw (debug) or -o <file>. veil resolve returns opaque sealed tokens. Phoenix's resolve and get printed raw values.
• Sealed mode is the default — veil resolve always returns VEIL_SEALED:... tokens. Phoenix defaulted to plaintext MCP responses unless sealed mode was explicitly configured.

Features

• AES-256-GCM envelope encryption — master KEK wraps per-secret DEKs
• X25519 sealed responses — path/ref-bound opaque tokens agents can't decrypt
• Deny-by-default ACL — path-based permissions with glob matching, SHA-256 token hashing
• Agent management — veil agent create/list with per-agent permissions
• Stdin input — veil set --stdin avoids secrets in argv/process listings
• Atomic writes — tmp + rename for store and ACL files
• File permissions — master.key and seal.key are 0600
• Lume backup — encrypted backup transport via lume VCS
• Agent-first CLI — guide, help-json, semantic exit codes, JSON output (cli-output-spec v1.0)

Commands

veil init                          # Initialize ~/.veil
veil set <path> -v <value>         # Store a secret
veil set <path> --stdin            # Store from stdin
veil get <path> -o <file>          # Retrieve to file
veil list [prefix]                 # List secret paths
veil delete <path>                 # Delete a secret
veil exec --env K=veil://path -- cmd   # Run with env + scrubbing
veil resolve veil://path           # Get sealed token
veil seal-keygen                   # Generate X25519 key pair
veil agent create|list             # Manage agents
veil backup push|pull              # Backup via lume
veil guide                         # Mental model
veil help-json                     # Command catalog
veil version                       # Version

Verified

• Crypto round-trip (encrypt/decrypt)
• Tamper detection (AES-GCM auth tag)
• Output scrubbing: stdout, stderr, both streams
• Sealed resolve returns opaque tokens (no raw value)
• get refuses stdout by default (exit 82)
• Store encrypted at rest (no raw secrets in store.json)
• Agent management (create, list)
• Stdin input (no argv leak)
• Race-safe build (machin build --race-safe)
• Raw secret never appears in any agent-visible output (grep verified)

MFL language lessons

• MFL's parser counts braces inside comments — comments must not contain literal { or }
• No C-style for loops — use while or for k, v := range
• No interface{} — use map[string]string + string concatenation for heterogeneous JSON
• No nil comparisons — use len(x) == 0
• var x []string without initializer is invalid — use x := []string{}