feat: v0.6.10 guardrails + esoteric bug sweep — 45 fixes + 10 guardrails

.githooks/pre-commit

@@ -115,4 +115,12 @@ if ! git config --get user.signingkey >/dev/null 2>&1; then
 fi
 echo "  signing check: done"
 
+# 12. ci_guards.py — bug-class pattern detection (non-atomic writes, OOM reads, curl, etc.)
+if command -v python3 >/dev/null 2>&1; then
+    python3 scripts/ci_guards.py --staged 2>&1 || {
+        echo "FAIL: guardrail violations found. Mark with // GUARDED: intentional if a false positive."
+        exit 1
+    }
+fi
+
 echo "[guard] All checks passed."

.github/workflows/ci.yml

@@ -35,6 +35,9 @@ jobs:
           bad=$(grep -rn "\.ok();" crates/ --include="*.rs" 2>/dev/null | grep -v "GUARDED: intentional\|test\|#\[cfg\|\.and_then\|filter_map\|\.ok()?\|// ok" || true)
           if [ -n "$bad" ]; then echo "FAIL"; echo "$bad"; exit 1; fi
 
+      - name: ci_guards.py (bug-class detection)
+        run: python3 scripts/ci_guards.py || { echo 'ci_guards FAIL — see above for violations'; exit 1; }
+
       - name: CLI docs check
         run: |
           cmds=$(grep -A50 "^pub const CLI_COMMANDS" crates/reliary-agent/src/main.rs 2>/dev/null | grep '"' | grep -oP '"[a-z][a-z-]+"' | tr -d '"' | sort -u || true)

Cargo.toml

@@ -15,7 +15,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.6.6"
+version = "0.6.11"
 edition = "2021"
 description = "Grammar-free code intelligence daemon, CLI, MCP server, and API proxy."
 license = "MIT"

README.md

@@ -496,6 +496,14 @@ your upstream from agent configs, or you can set `RELIARY_UPSTREAM_URL` as a fal
 
 ## Troubleshooting
 
+### "Claude Code returns 501 Not Implemented"
+
+The proxy currently supports OpenAI-compatible chat completions only. Anthropic
+`/v1/messages` requests receive a 501 with a clear error. To use Claude Code
+through the proxy today, route it to an OpenAI-compatible proxy (LiteLLM,
+OpenRouter, or a self-hosted OpenAI-compatible endpoint) via
+`RELIARY_UPSTREAM_URL`, or run the agent without the proxy.
+
 ### "Proxy is not compressing anything"
 
 ```bash

crates/reliary-agent/Cargo.toml

@@ -28,6 +28,7 @@ regex = "1"
 once_cell = "1"
 regex-lite = "0.1"
 rlimit = "0.10"
+getrandom = "0.2"
 dirs = "6.0"
 rustc-hash = "2"
 rayon = "1"
@@ -39,7 +40,7 @@ futures-util = "0.3"
 tokio-stream = "0.1"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "time"] }
-tower-http = { version = "0.6", features = ["cors"] }
+tower-http = { version = "0.6", features = ["cors", "limit"] }
 walkdir = "2"
 
 [dev-dependencies]

crates/reliary-agent/pi/gate.js

@@ -2,7 +2,7 @@ const { execFileSync, spawnSync } = require("child_process");
 const { existsSync, readFileSync, readdirSync, statSync, unlinkSync } = require("fs");
 const { createHash } = require("crypto");
 
-const GATE_VERSION = "0.6.5";
+const GATE_VERSION = "0.6.10";
 
 // ── Log levels (matching RELIARY_LOG convention) ──
 const LOG_LEVELS = { error: 1, warn: 2, info: 3, debug: 4, trace: 5 };