Release notes · 0.5 · 31 October 2026
Actualis reads the transcripts your coding agents already write and reports what actually ran. 0.5 adds host reputation: actualis --network --reputation matches the hosts your agents reached against Google Safe Browsing hash lists cached on your disk, offline, and can fail a CI gate on a listed host. actualis never uses the network. The optional actualis-reputation command does, only when you run it, and tells you what it sends.
$ brew upgrade actualis # or: pip install -U actualis $ actualis --version
actualis --network --reputation, offlineMatches every host in the network inventory against Google Safe Browsing hash lists cached on your disk. It never uses the network. A match in the lists is a candidate, a possible match that is not confirmed. Private and local hosts are never matched or sent, and show as skipped. The report header shows how old the lists are.
actualis-reputation, the optional companionThe only part of actualis that uses the network, and only when you run it. update downloads the Safe Browsing lists. confirm checks local matches with 4-byte hash prefixes mixed with decoys, so Google never sees a host or URL. virustotal is opt-in and sends hostnames in plain text. status and forget never use the network. Each run prints a ⊕🌐 disclosure of what it will send and asks first; --yes is for CI, --dry-run previews, and --receipt records what was sent. You bring your own free Google Safe Browsing API key.
reputation-listed (high), and reputation-candidate, reputation-suspicious and reputation-stale (medium). --fail-on high gates on a listed host, as --ioc does for a known-bad package. With --fail-on and no usable lists, absent or corrupt, --reputation exits 2, so a gate cannot pass because its data was missing. --json gains network.items[].reputation and network.reputation, additive, with schema_version still 1.
The tray shows a network badge while actualis-reputation runs. When the Safe Browsing lists are more than a day old, the icon shows the amber update badge and the menu offers Update Safe Browsing Lists (N days old)…, which opens a terminal running actualis-reputation update, where you see what is sent and confirm. The tray itself never downloads anything or holds a key. Credential warnings still take priority over the badge.
0.5.0 — Licensing: the Google Safe Browsing API and the VirusTotal public API are free for non-commercial use only. Each user brings their own key. Full setup, what is sent and what is not, and accuracy: docs/reputation.md.
0.5.0 — Upgrading from 0.4: brew upgrade actualis or pip install -U actualis. Both install the actualis-reputation command too. Also new: actualis --explain reputation, and --self-check reports when actualis-reputation last used the network.
Found Actualis useful? Tell the people you build with. Copy a post, make it sound like you, and the link at the end shows the image above.
Each post gives both ways to install: Homebrew on macOS and Linux, and uv (or pipx) on any OS, Windows included. Both install the same release from PyPI, the one place Actualis is published, so readers can check the version, the licence and that it has no dependencies before they run anything.