[uncoalesced]

Release v0.2.3: Code Mode, sandbox hardening from the pre-release bug check, anonymous link probes, and SECURITY.md.

Code Mode

• New wire_run tool. The agent writes one async JavaScript script against wire.read / search / feed / research / cite, and only the script's return value comes back. On the bundled offline benchmark, the same task costs 3,394 tokens over 2 round trips with the classic tools and 468 tokens in 1 round trip with a script (86% fewer).
• Scripts run in QuickJS (quickjs-ng). There's no filesystem, network, timers or modules. Each script gets 64 MB of memory, 5 s of CPU per step, 60 s in total, 40 calls and 16 in flight. Output goes through the same scrub and spotlight as other tools, and links a script fetched count as sources for wire_cite.
• wire serve --code-mode exposes only wire_run and wire_status. There's also a new wire run FILE|-|-e CODE command.
• SKILL.md, the wire-worker agent and the Cursor, Windsurf and Hermes rules now say when to use wire_run. The README has a Code Mode section.

Fixes from the bug check

• Sandbox
  • A microtask loop (for(;;) await 0) could freeze the whole server, because neither the CPU limit nor the wall clock fired. It now stops at the CPU limit.
  • A script could overwrite the host hooks or replace JSON and Promise methods, which crashed Python or forged call results. The hooks are now private, and the built-ins they use are captured before the script runs.
  • Lone surrogates in a script, its result, its logs or its errors crashed Python. They now become U+FFFD.
  • Cancelled calls are now awaited, so their cleanup runs right away.
• wire_run errors: capped at 500 chars and kept inside the UNTRUSTED_EXTERNAL_DATA block.
• CLI: wire run - and wire cite - read piped stdin as UTF-8. On Windows, é used to arrive as é.
• Citations: link probes are fetched anonymously, so a saved session is never sent, including on the retry after a login wall.

Security policy

SECURITY.md covers how to report (GitHub private vulnerability reporting), what's in scope and out of scope, and known limitations.

Not in this PR

The SSRF guard that blocks private and local URLs is in its own PR against dev.

Checks

• 319 tests pass on Python 3.14 and 3.11.
• ruff check and ruff format --check are clean, and uv lock --check passes.
• The built wheel was installed in a clean environment and runs wire run.
• Live stdio MCP: serve lists 8 tools and serve --code-mode lists 2. wire_run answered a live query, and wire_cite accepted a link from a script.

After merging, push the tag v0.2.3 to publish to PyPI.

CI and supply chain (added)

• Vulnerable dependencies: the new pip-audit job found 10 known vulnerabilities in the lockfile.
  • fastmcp 4.1.0 → 4.1.4 (GHSA-7xgj-8392-5q4r, GHSA-vqqp-x5qm-5qp4), and the floor is raised to 4.1.2.
  • certifi → 2026.10.23 and filelock → 4.2.4.
• XML feeds: RSS, Reddit, Google News and arXiv feeds are now parsed with defusedxml. Feeds that use DTD entities are refused instead of expanded.
• New security.yml:
  • pip-audit on every locked dependency, including extras.
  • bandit (medium severity and up).
  • zizmor on the workflows.
  • dependency review on PRs.
  • Runs weekly too.
• New codeql.yml: security-extended analysis for Python and Actions.
• ci.yml:
  • A separate lint job: ruff format, uv lock --check, and the temp-dir guard.
  • Tests also on 3.12 and 3.13.
  • twine check, and the wheel's version must match pyproject.toml.
  • A smoke job on all 3 OSes × 3.11/3.14 installs the built wheel and drives the real stdio MCP server in both modes, including a runaway script that must come back as an error.
• All workflows:
  • Actions pinned to commit SHAs.
  • persist-credentials: false on every checkout.
  • The release build doesn't use a cache.
• Dependabot: weekly grouped uv and Actions updates, targeting dev.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.