h5i-dev/h5i v0.5.2

h5i v0.5.2

on GitHub

Install

One binary. h5i unifies web development, formal verification
with Lean 4, and red-teaming around a composable Rust framework.

Linux / macOS:

curl -L https://github.com/h5i-dev/h5i/releases/download/v0.5.2/h5i-v0.5.2-<TARGET>.tar.gz | tar -xz
sudo mv h5i /usr/local/bin/

Windows: download the .zip, extract h5i.exe, and add it to your PATH.

The browser

h5i browser open https://example.com
h5i browser snapshot
h5i browser requests     # what it asked for, and what was refused
h5i browser audit        # the whole session, afterwards

A session is Chromium, driven through
agent-browser
(npm install -g agent-browser), and captured at a proxy this
binary runs: every request is policy-checked and written down
before it moves.

The websec workbench

h5i-websec is a separate archive, and installing it is a
deliberate act:

curl -L https://github.com/h5i-dev/h5i/releases/download/v0.5.2/h5i-websec-v0.5.2-<TARGET>.tar.gz | tar -xz
h5i plugin install websec --from ./h5i-websec

It holds no privilege of its own: every verb runs the h5i browser
verbs a person would type, through the same policy, budget and
receipts.

The recon ledger

h5i-recon is the other plugin, and it arrives the same way:

curl -L https://github.com/h5i-dev/h5i/releases/download/v0.5.2/h5i-recon-v0.5.2-<TARGET>.tar.gz | tar -xz
h5i plugin install recon --from ./h5i-recon

It records what a target exposes, where each candidate came from,
and which stored message confirmed it. Discovery only: a URL read
out of a bundle stays a candidate until a request answers for it,
and nothing here is called a vulnerability.

Security regression tests

h5i-test replays repository-owned attack flows and hands their
evidence to repository-owned external oracles:

curl -L https://github.com/h5i-dev/h5i/releases/download/v0.5.2/h5i-test-v0.5.2-<TARGET>.tar.gz | tar -xz
h5i plugin install test --from ./h5i-test
h5i test .h5i-tests/tests --target http://localhost:3000

It writes JSON and JUnit. OpenAPI coverage is report-only unless
--min-coverage is explicitly supplied.

Every request it makes is checked against an allowlist — every
request and every redirect hop — and written to the log before any
bytes move. A request that is not in h5i browser requests did not
happen. What a box adds, with --in, is that the record gains a
witness outside the browser; on a bare host that part is not
claimed.

Available targets

Intel Macs have no published build: Rosetta 2 translates x86_64 to
arm64, not the reverse, so the aarch64-apple-darwin archive will
not run there. Build from source instead:
cargo install --git https://github.com/h5i-dev/h5i

Each archive is accompanied by a .sha256 checksum file.

What's Changed

• Koukyosyumei patch 1 by @Koukyosyumei in #749
• Koukyosyumei patch 1 by @Koukyosyumei in #750
• improve docs by @Koukyosyumei in #751
• Improve slide by @Koukyosyumei in #752
• Koukyosyumei patch 1 by @Koukyosyumei in #753
• Expand demo proof story and clarify testing captions by @Koukyosyumei in #754
• Decouple CUDA runtime from tutorial kernels by @Koukyosyumei in #755
• Refresh contributor and security docs by @Koukyosyumei in #756
• Bump up to v0.1.3 by @Koukyosyumei in #757
• Update README.md by @Koukyosyumei in #758
• Improve docs SEO and Rust verification guide by @Koukyosyumei in #759
• Improve skill by @Koukyosyumei in #760
• Clarify formal verification case in pitch deck by @Koukyosyumei in #761
• describe plugins in top-level help by @Koukyosyumei in #763
• update traction numbers by @Koukyosyumei in #766
• Pre proved auth by @Koukyosyumei in #762
• Update README.md by @Koukyosyumei in #767
• Saturate HmacAuth token expiry and test the authenticator by @hiroki-abe-58 in #764
• h5i-app-pg: refuse mixed-case schema names in with_schema by @hiroki-abe-58 in #765
• bump h5i to v0.5.2 and h5i-app to 0.1.4 by @Koukyosyumei in #768

New Contributors

• @hiroki-abe-58 made their first contribution in #764

Full Changelog: v0.5.1...v0.5.2