Changelog
What changed in grith v0.3.1, and where to find the releases before it.
v0.3.1 - 2026-08-24
Team analytics were rebuilt end to end. grith now keeps a privacy-preserving analytics
projection alongside the local audit log - hourly and daily rollups of decisions, scores,
filter activity, sessions, model usage and cost, and never commands, file paths, prompts
or file contents. The local dashboard gained an Analytics page built on it, and paid
plans sync the same aggregates to the team dashboard every 30 seconds, per registered
device. Coverage is strictly prospective: nothing recorded before you consent is ever
uploaded. grith analytics status | enable | disable manages it.
Once a UTC day closes, paid plans also upload that day as a single file to encrypted
private storage, kept for 90 days. What the archive contains is stated in the consent
summary before sync turns on, and
grith analytics verify-archives downloads those days back,
checks each file byte-for-byte, rebuilds the numbers from it and exits non-zero if any
day disagrees. grith audit rebuild-analytics rebuilds the local
projection from the audit database and the cold archives.
The raw audit-record cloud sync is retired. Earlier versions uploaded every synced audit
record to grith.ai; the rollups replace it, and the route is gone.
grith pro sync still pulls team policies, configs and provider keys -
it just no longer uploads anything from your audit log.
grith exec --workspace-only fences a session to
its project: file reads and writes outside the workspace are denied rather than scored.
The permission prompt gained [b] Block dir, which refuses a whole subtree for the rest
of the session instead of widening access one call at a time.
D-Bus is now decided per method call rather than per connection, so a credential helper
reading your keyring stops prompting whilst StartTransientUnit still asks. A batch of
false positives went with it: Chromium's scratch files and its three read-only D-Bus
probes on every launch, mktemp scratch paths, docker commands that differed only in
their payload, a secret-shaped token in one command line that used to re-score every
later call from that process, and kernel-assigned ephemeral ports that looked like new
listeners. grith also stopped queueing its own control-plane traffic to grith.ai.
Copying out of the grith exec TUI now works the way terminals expect, including
drag-select, and the dashboard no longer rescans the audit log on every poll - which had
made a large database slow to open and slow to refresh.
Earlier releases
v0.3.1 is the current release; the one before it was v0.2.5. Full notes for every release are on GitHub.