CodeMender updates (v0.17.0)

CodeMender updates (v0.17.0)

This release introduces updates to CodeMender:

• Support bundle diagnostics: Introduce cm support-bundle to collect environment metadata, configuration policies, health reports, and session logs into a compressed archive for streamlined troubleshooting.
• Plain output mode: Add the persistent --plain flag (configurable via the CM_PLAIN environment variable or output.plain in config.yaml) to suppress decorative emojis, ANSI escape sequences, and Unicode borders for compatibility with screen readers and CI/CD log pipelines.
• Dedicated exit codes for setup failures: Assign distinct exit codes (such as code 10 for credential issues) to configuration and authentication failures, preventing CI/CD pipelines from confusing environment setup issues with security findings.
• Tailored CI/CD credential guidance: Provide environment-specific authentication guidance when running inside automated CI/CD systems such as GitHub Actions, GitLab CI, Buildkite, and Jenkins instead of interactive login prompts.
• Single-line JSONL statistics: Add the --jsonl flag to cm stats to output single-line JSON records with model and team attribution for seamless integration with Cloud Logging and log aggregation pipelines.
• Granular sandbox and policy flags: Replace the overloaded --unrestricted flag with orthogonal flags (--sandbox=false) and configurable command policies to decouple container sandboxing from execution safety controls.
• Sandbox configuration protections: Mount .git/hooks, .git/config, and .codemender read-only within writable execution sandboxes during cm fix and cm verify to prevent modifications to repository security policies.
• Bug fixes:
• Added a security warning when commands are executed with both sandbox isolation disabled and interactive approval skipped.
• Enforced allowedRoots path boundaries across host discovery and remediation file operations to prevent traversal via dangling symlinks.
• Supplied exact finding line ranges to remediation agents during cm fix to eliminate manual file scanning overhead.
• Updated cm report import to properly treat findings without location data as file-level findings rather than defaulting to the first line.
• Ensured cm session cancel routes requests to the session's original region regardless of local environment overrides.
• Fixed finding status tracking in cm verify so unexploitable verdicts update the local state database rather than leaving findings open.

For more information, see the CodeMender documentation.