Five agents, one audit, fewer places to hide a command.
Actualis reads the transcripts your coding agents already write and reports what actually ran. 0.4 adds Gemini CLI and Qwen Code beside Claude Code, Codex and Copilot CLI. The shell audit and download inventory now read commands the way bash does, so comments, quoting and heredocs no longer hide them; credentials are masked in full; and the CI gate refuses flag combinations it used to ignore.
Both are read by default, or alone with --agent gemini and --agent qwen. Their shell commands, credentials and downloads join the same audit, inventory and gate as every other agent’s. Gemini CLI records no approvals, so every Gemini call’s approval shows as unknown; a call a person declined or a policy blocked counts as a refusal. Qwen Code records its approval mode per turn, and yolo and auto count as unasked. Models with no published price show their tokens and no cost, never a guessed one.
Nowhere to hide a command
The shell audit and the download inventory now share one bash-aware lexer. Comments, $'…', quoting, heredocs, here-strings, line continuations and wrappers no longer hide a command or a download; before, several of these let --ioc … --fail-on high pass on a listed package. New high remote-exec shapes such as cat <<EOF | sh and eval "$(curl …)" are flagged, and a download that cannot be resolved is network-ioc-unresolved instead of passing clean.
Secrets masked in full
A credential longer than 256 characters used to be masked only up to 256 characters; masks now cover the whole value. PEM and armored PGP private keys, bare JWTs, every pair in a Cookie: header or curl -b list, .netrc lines, --token VALUE options and quoted passwords with spaces are masked and counted. A colour code or an invisible character inside a token no longer dodges the mask.
A gate you can trust in CI
A failing --fail-on piped into something that exits early (| head) used to exit 0 or 120; it now keeps exit 3. Flag combinations that used to be silently dropped, including a second mode, now exit 2 and name both flags. A failed --self-check exits 4, not 3. AF013 (rate table age) is still reported but no longer fails the gate.
0.4.0 — Upgrading from 0.3: the same transcripts can give a different exit code. Gemini CLI and Qwen Code are read by default, --fail-on can newly exit 3, and combinations that were ignored now exit 2. Figures and counts move too, so take a fresh --diff baseline. The changelog’s what can change a gate lists every case.
Spread the word
Found Actualis useful? Tell the people you build with. Copy a post, make it sound
like you, and the link at the end shows the image above.
Each post gives both ways to install: Homebrew on macOS and Linux, and uv
(or pipx) on any OS, Windows included. Both install the same release from
PyPI,
the one place Actualis is published, so readers can check the version, the licence and
that it has no dependencies before they run anything.
