v0.2.0: Beta release#2

Merged

O6lvl4 merged 22 commits into

mainfrom

Apr 8, 2026

Commits on Apr 8, 2026

Add roadmap from objective evaluation: 6 critical/high items for alpha→beta
O6lvl4
committed
Enforce capability checks on porta.exec and porta.http builtin tools
O6lvl4
committed
Always validate WASM imports via wt_inspect, remove empty_wasm shortcut
O6lvl4
committed
Split mod.almd into cli, engine, ops, build, project modules
O6lvl4
committed
Fix JSON-RPC to use Content-Length for proper message framing
O6lvl4
committed
Wire max_memory, entry, cwd, env, secrets.from-env to actually work
O6lvl4
committed
Default-deny network outbound in native sandbox profile
O6lvl4
committed
Add security-focused tests for sandbox profile and MCP enforcement
O6lvl4
committed
Move Full Almide Migration to on-hold
O6lvl4
committed
Add beta roadmap: exec sandbox, http allowlist, run caps, detach, sandbox honesty
O6lvl4
committed
Route porta.exec through sandbox, eliminate sh -c command injection
O6lvl4
committed
Rewrite porta.http allowlist to check hostname, not just port
O6lvl4
committed
Make run mode respect manifest capabilities like serve does
O6lvl4
committed
Forward all CLI options to detached daemon child process
O6lvl4
committed
Align sandbox messaging with actual enforcement level
O6lvl4
committed
Improve CLI: grouped help, --help flag, -e shorthand, complete command docs
O6lvl4
committed
Document sandbox-exec host limitation, keep port-based network rules
O6lvl4
committed
Update README for beta: network deny-by-default, two-layer security, module structure
O6lvl4
committed
Unify run and run-native into single porta run with auto-detection
O6lvl4
committed
Add exec replace for interactive native commands (porta run claude works)
O6lvl4
committed
Change license from MIT to Apache-2.0
O6lvl4
committed
Default network open for native commands, --allow-net restricts
O6lvl4
committed