Skip to content

Release 2.1.171 (2026-08-05)

Bug fixes

  • revert C++ AUDIT to conan audit + cppcheck googletest lib (#2581) Revert the #2572 switch of the C++ AUDIT command from conan audit to OSV-Scanner. T11 (#2558) proved OSV.dev carries no ConanCenter package data, so osv-scanner over conan.lock reported a false all-clear. AUDIT returns to [conan, audit, scan, .] (reading its provider token from CONAN_AUDIT_PROVIDER_TOKEN_CONANCENTER), keeping the best-effort conan graph info license surface. Decision reversal: vergil-project/.github#209.

Also add --library=googletest to the cppcheck LINT argv: T11 found cppcheck throws a syntaxError on GoogleTest's TEST() macro, and the images ship googletest.cfg. GoogleTest is the documented default framework.

Features

  • inject Conan audit token into VM agent env (#2580) Deliver CONAN_AUDIT_PROVIDER_TOKEN_CONANCENTER into the VM agent environment, mirroring the Anthropic-token injection pattern.

  • identity.py: add conan_audit_token_path to the Identity dataclass and parse it from the conan_audit_token_path key in identities.toml (expanded at injection time, like claude_token_path).

  • vm_guest.py: add _inject_conan_token, called from inject_credentials and gated on identity.conan_audit_token_path. It reads the bare token from the host file and writes a shell-quoted export line into ~/.config/vergil/conan.env (chmod 600), plus an idempotent ~/.bashrc source line. Transport-agnostic, so it serves both Lima and cloud guests.
  • vrg_vm.py: _session_inner also sources ~/.config/vergil/conan.env (peer to claude.env) so non-interactive sessions get the token.

The token value stays in a host file referenced by identities.toml; the code only reads that path and writes an export line, never hardcoding a value.

Tests mirror the claude-token injection tests across identity parsing, the injector (including shell-quoting), and session sourcing.

CI Evidence: All gates passed — full audit bundle available. Download →