Releases: tylerbutler/repoverlay
v0.12.0 - 2026-03-27
Release Notes
Command: apply
Added
Add overlay composition via extends and includes
Overlays can now inherit files from other library overlays using two new repoverlay.ccl sections. Multi-level chains are supported with cycle detection.
extends inherits all files from a parent overlay. The child's own files take precedence on conflict, making this ideal for creating specialized variants of a base overlay:
extends =
overlay = base-config
Use case: a claude-config-strict overlay that extends claude-config and overrides just the CLAUDE.md file while inheriting everything else.
includes cherry-picks specific files from other overlays, useful when you only need a few shared files without full inheritance:
includes =
overlay = shared-dotfiles
files =
.editorconfig
.prettierrc
Use case: multiple overlays that each need the same .editorconfig from a shared dotfiles overlay, without duplicating the file.
Both features are restricted to library overlays.
Command: create
Fixed
Fall back to tracked config files when using create --yes
When --yes is used and no AI config files are found, create now falls back to tracked config files (.envrc, .gitignore, .vscode/settings.json, etc.) instead of bailing. The auto-select priority is: AI configs first, tracked configs second, then error with a helpful message.
Command: edit
Fixed
Allow edit add without git remote origin
edit add with a short-form overlay name (e.g., my-overlay) no longer requires a git remote origin. Previously, the command called detect_target_repo() to resolve org/repo for an error message hint, but this is unnecessary for the actual operation. Now uses the same inline name extraction as edit remove and edit --interactive.
Directory exclusions now persist across remove/reapply cycles
Directories removed via edit remove no longer reappear when the overlay is removed and reapplied. The ExcludedFile struct now tracks whether an exclusion is for a file or directory, and directory exclusions match descendant paths. Also fixes trailing-slash handling (.vscode/ is now treated the same as .vscode) and makes external state backup failures a hard error to ensure exclusions are always persisted.
Install repoverlay 0.12.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/tylerbutler/repoverlay/releases/download/v0.12.0/repoverlay-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/tylerbutler/repoverlay/releases/download/v0.12.0/repoverlay-installer.ps1 | iex"Install prebuilt binaries via Homebrew
brew install tylerbutler/tap/repoverlayDownload repoverlay 0.12.0
| File | Platform | Checksum |
|---|---|---|
| repoverlay-aarch64-apple-darwin.tar.xz | Apple Silicon macOS | checksum |
| repoverlay-x86_64-apple-darwin.tar.xz | Intel macOS | checksum |
| repoverlay-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| repoverlay-aarch64-unknown-linux-gnu.tar.xz | ARM64 Linux | checksum |
| repoverlay-x86_64-unknown-linux-gnu.tar.xz | x64 Linux | checksum |
v0.11.1 - 2026-03-17
Release Notes
Fixes
Fixed
Allow overlay operations when git exclude updates fail
Apply, remove, and switch no longer abort when .git/info/exclude cannot be updated (e.g. in codespace worktrees with non-portable absolute paths). A warning is shown and the operation continues — overlay files may appear as untracked in git status.
Install repoverlay 0.11.1
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/tylerbutler/repoverlay/releases/download/v0.11.1/repoverlay-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/tylerbutler/repoverlay/releases/download/v0.11.1/repoverlay-installer.ps1 | iex"Install prebuilt binaries via Homebrew
brew install tylerbutler/tap/repoverlayDownload repoverlay 0.11.1
| File | Platform | Checksum |
|---|---|---|
| repoverlay-aarch64-apple-darwin.tar.xz | Apple Silicon macOS | checksum |
| repoverlay-x86_64-apple-darwin.tar.xz | Intel macOS | checksum |
| repoverlay-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| repoverlay-aarch64-unknown-linux-gnu.tar.xz | ARM64 Linux | checksum |
| repoverlay-x86_64-unknown-linux-gnu.tar.xz | x64 Linux | checksum |
v0.11.0 - 2026-03-17
Release Notes
Fixes
Fixed
Write git exclude entries to the common git directory for worktrees
Git reads info/exclude from the shared .git/ directory, not the worktree-specific $GIT_DIR. Overlay files applied in worktree checkouts would show as untracked because exclude entries were written to the wrong location. Now uses git rev-parse --git-path to resolve the correct path.
Command: library
Added
Add in-repo overlay library (repoverlay library)
You can now store overlays directly in your repository at .repoverlay/library/, making them shareable with your team via version control. The new library subcommand group provides full lifecycle management:
-
library list— see what's in the library -
library import <path-or-name>— add an overlay (accepts filesystem paths or applied overlay names) -
library export <name> <dest>— copy an overlay out of the library -
library remove <name>— delete from the library
Library overlays integrate throughout the tool:
-
apply my-overlayresolves from the library first (highest priority) -
apply my-overlay --from @librarytargets the library exclusively -
create --into librarycreates overlays directly in the library -
browseincludes library overlays alongside configured sources -
browseworks with library-only repos — no external sources required
The library path defaults to .repoverlay/library/ but is configurable via library_path in your repo's repoverlay.ccl config. .gitignore is automatically updated to ensure library contents are tracked by git.
Command: browse
Added
Show last-updated timestamps for applied overlays in browse UI
Applied overlays now display relative timestamps (e.g. '2 days ago') in the browse selection UI instead of a plain 'already applied' label, making it easier to see how recently each overlay was synced.
Auto-detect flat folder layout for local sources
Local directory sources no longer require org/repo/name nesting. Flat directories are auto-detected: a directory with overlay files is treated as a single overlay, and subdirectories are each treated as separate overlays.
Changed
Promote browse as the primary overlay workflow
Updated help text, README, and CLI reference to recommend browse as the primary entry point for interactive use. The apply command remains available for scripting and power users. Improved the error message when no sources are configured.
Command: create
Added
Support glob patterns in --include flag
The --include flag on create now accepts glob patterns (e.g., *.md, .claude/**) in addition to exact file paths. Globs are expanded relative to the source repository root using standard glob syntax.
Fixed
Discover committed config files in source repositories
create now discovers tracked config files (e.g., .envrc, .vscode/, justfile, Cargo.toml, Dockerfile) in addition to AI configs, gitignored, and untracked files. Detection uses an exclusion-based heuristic that filters out source code, documentation, and media rather than trying to allowlist config patterns. Also fixes output path to create overlay at output/<name>/ subdirectory.
Performance
Fix UI hang on large repos during overlay creation
Skip transient tool state directories (worktrees/, todos/) during AI config directory walking, reducing discovered files from ~59K to ~22 on repos with large .claude/ directories. Also fix O(n²) ancestor traversal in the selection UI with a pre-built parent lookup map, and add a progress spinner with Ctrl+C support for git clone/pull operations.
Command: edit
Fixed
Fix edit add failing on directories with "Is a directory" error
The edit add command now correctly handles directories (e.g., .claude/commands) by using recursive directory copy, directory symlinks, and EntryType::Directory in overlay state. Rollback logic also properly restores directories on failure.
Remove git remote requirement for locally-applied overlays
edit add no longer requires a git remote origin when working with overlays applied from local paths. Remote detection is deferred to only when needed for overlay repo auto-commit.
Persist edit exclusions across remove/reapply cycles
Files removed via edit remove now stay removed when an overlay is removed and reapplied. Exclusions are tracked in overlay state and persisted in the external backup so they survive the full lifecycle.
Command: restore
Fixed
Restore broken symlinks without requiring --force
restore no longer errors when an overlay's state exists but its symlinked files have been deleted. Since restore's purpose is to re-create missing files, it now always forces past the "already applied" check.
Command: source
Added
Support local directory sources for overlays
Register directories as overlay sources using source add ./path. Local sources are stored in a per-repo config file (.repoverlay/config.ccl), which is automatically git-excluded. Paths must start with /, ./, or ~ to be recognized as local (otherwise treated as git URL/shorthand). Local sources skip cloning and caching — overlays are read directly from the filesystem. Use source list and source remove to manage both global git sources and repo-local sources.
Command: switch
Added
Add --dry-run support to switch command
The switch command now supports --dry-run to preview what would change without making modifications, consistent with apply, remove, restore, and update.
Command: sync
Fixed
Skip non-syncable overlays gracefully in --all mode
sync --all no longer fails when only locally-applied overlays are present. The overlay repo manager is now lazily initialized, only created when a syncable overlay is encountered. Local and GitHub overlays are skipped with a warning message.
Install repoverlay 0.11.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/tylerbutler/repoverlay/releases/download/v0.11.0/repoverlay-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/tylerbutler/repoverlay/releases/download/v0.11.0/repoverlay-installer.ps1 | iex"Install prebuilt binaries via Homebrew
brew install tylerbutler/tap/repoverlayDownload repoverlay 0.11.0
| File | Platform | Checksum |
|---|---|---|
| repoverlay-aarch64-apple-darwin.tar.xz | Apple Silicon macOS | checksum |
| repoverlay-x86_64-apple-darwin.tar.xz | Intel macOS | checksum |
| repoverlay-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| repoverlay-aarch64-unknown-linux-gnu.tar.xz | ARM64 Linux | checksum |
| repoverlay-x86_64-unknown-linux-gnu.tar.xz | x64 Linux | checksum |
v0.10.1 - 2026-03-05
Release Notes
Command: sync
Fixed
Fix sync <name> using wrong org/repo for overlays applied via upstream fallback
When syncing a single overlay by name in a fork repository, the sync command detected the org/repo from the git remote (e.g., alexvy86/FluidFramework) instead of using the org/repo saved in the overlay state (e.g., microsoft/FluidFramework). This caused sync to fail with "does not exist in overlay repo" because the fork's org/repo path doesn't exist in the overlay repo. Now uses the org/repo from the saved state, matching the behavior of sync --all.
Install repoverlay 0.10.1
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/tylerbutler/repoverlay/releases/download/v0.10.1/repoverlay-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/tylerbutler/repoverlay/releases/download/v0.10.1/repoverlay-installer.ps1 | iex"Install prebuilt binaries via Homebrew
brew install tylerbutler/tap/repoverlayDownload repoverlay 0.10.1
| File | Platform | Checksum |
|---|---|---|
| repoverlay-aarch64-apple-darwin.tar.xz | Apple Silicon macOS | checksum |
| repoverlay-x86_64-apple-darwin.tar.xz | Intel macOS | checksum |
| repoverlay-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| repoverlay-aarch64-unknown-linux-gnu.tar.xz | ARM64 Linux | checksum |
| repoverlay-x86_64-unknown-linux-gnu.tar.xz | x64 Linux | checksum |
v0.10.0 - 2026-03-05
Release Notes
Command: apply
Added
Auto-detect configured source when applying via GitHub URL
When applying an overlay via a GitHub URL that matches a configured source, resolve it as an overlay repo (editable and syncable) instead of a read-only GitHub source. URLs with an org/repo/name subpath redirect to three-part resolution; bare repo URLs use interactive browse mode with the matched source.
Command: sync
Fixed
Fix sync <name> failing for GitHub-sourced overlays that match a configured source
The single-name sync path was missing the try_upgrade_github_source() call that was added to sync --all, edit, and edit add in #171. This caused GitHub-sourced overlays to be rejected as non-syncable instead of being lazily upgraded to editable overlay repo sources.
Fixed
Improve error display and add SIGPIPE handling
Fixed error output formatting to use Display instead of Debug format. Added SIGPIPE signal handling so piped output to commands like head exits cleanly without "Broken pipe" errors.
Install repoverlay 0.10.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/tylerbutler/repoverlay/releases/download/v0.10.0/repoverlay-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/tylerbutler/repoverlay/releases/download/v0.10.0/repoverlay-installer.ps1 | iex"Install prebuilt binaries via Homebrew
brew install tylerbutler/tap/repoverlayDownload repoverlay 0.10.0
| File | Platform | Checksum |
|---|---|---|
| repoverlay-aarch64-apple-darwin.tar.xz | Apple Silicon macOS | checksum |
| repoverlay-x86_64-apple-darwin.tar.xz | Intel macOS | checksum |
| repoverlay-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| repoverlay-aarch64-unknown-linux-gnu.tar.xz | ARM64 Linux | checksum |
| repoverlay-x86_64-unknown-linux-gnu.tar.xz | x64 Linux | checksum |
v0.9.2 - 2026-03-04
Release Notes
Command: edit
Changed
Split edit into edit add and edit remove subcommands
The --add and --remove flags used greedy num_args = 1.. parsing, which consumed trailing arguments and required the overlay name to appear before any flags. This was confusing and the help text couldn't convey the constraint clearly. The edit command now uses proper subcommands:
repoverlay edit add my-overlay file1.txt file2.txt repoverlay edit remove my-overlay oldfile.txt repoverlay edit my-overlay # interactive file selection repoverlay edit # select overlay then edit interactively
Running edit with no overlay name now presents an interactive overlay picker (auto-selects when only one overlay is applied). The old --add/--remove/--interactive flags still work but are hidden from help and print a deprecation warning.
Install repoverlay 0.9.2
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/tylerbutler/repoverlay/releases/download/v0.9.2/repoverlay-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/tylerbutler/repoverlay/releases/download/v0.9.2/repoverlay-installer.ps1 | iex"Install prebuilt binaries via Homebrew
brew install tylerbutler/tap/repoverlayDownload repoverlay 0.9.2
| File | Platform | Checksum |
|---|---|---|
| repoverlay-aarch64-apple-darwin.tar.xz | Apple Silicon macOS | checksum |
| repoverlay-x86_64-apple-darwin.tar.xz | Intel macOS | checksum |
| repoverlay-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| repoverlay-aarch64-unknown-linux-gnu.tar.xz | ARM64 Linux | checksum |
| repoverlay-x86_64-unknown-linux-gnu.tar.xz | x64 Linux | checksum |
v0.9.1 - 2026-03-04
Release Notes
Command: edit
Fixed
Fix edit --add dropping existing git exclude entries
When adding files to an applied overlay, the git exclude section was rewritten with only the newly added files, silently removing entries for previously managed files. This caused those files to reappear in git status after the add operation. Rebuilt the full exclude list from overlay state, matching the pattern already used by edit --remove.
Changed
Clarify that overlay NAME must precede --add/--remove flags
The --add and --remove flags accept multiple values and greedily consume trailing arguments. Running edit --add file.txt name fails because name is parsed as a second file. Updated help text to document the required argument order.
Install repoverlay 0.9.1
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/tylerbutler/repoverlay/releases/download/v0.9.1/repoverlay-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/tylerbutler/repoverlay/releases/download/v0.9.1/repoverlay-installer.ps1 | iex"Install prebuilt binaries via Homebrew
brew install tylerbutler/tap/repoverlayDownload repoverlay 0.9.1
| File | Platform | Checksum |
|---|---|---|
| repoverlay-aarch64-apple-darwin.tar.xz | Apple Silicon macOS | checksum |
| repoverlay-x86_64-apple-darwin.tar.xz | Intel macOS | checksum |
| repoverlay-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| repoverlay-aarch64-unknown-linux-gnu.tar.xz | ARM64 Linux | checksum |
| repoverlay-x86_64-unknown-linux-gnu.tar.xz | x64 Linux | checksum |
v0.9.0 - 2026-03-02
Release Notes
Added
Always sync cache and overlay repos before operations
All commands that read from the overlay repo or GitHub cache now pull the
latest by default. The --update flag is replaced with --no-update to
opt out (e.g., for offline use). Affected commands: apply, browse,
list, switch, create, and sync.
BREAKING: The --update flag has been removed. Use --no-update to
skip syncing.
Install repoverlay 0.9.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/tylerbutler/repoverlay/releases/download/v0.9.0/repoverlay-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/tylerbutler/repoverlay/releases/download/v0.9.0/repoverlay-installer.ps1 | iex"Install prebuilt binaries via Homebrew
brew install tylerbutler/tap/repoverlayDownload repoverlay 0.9.0
| File | Platform | Checksum |
|---|---|---|
| repoverlay-aarch64-apple-darwin.tar.xz | Apple Silicon macOS | checksum |
| repoverlay-x86_64-apple-darwin.tar.xz | Intel macOS | checksum |
| repoverlay-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| repoverlay-aarch64-unknown-linux-gnu.tar.xz | ARM64 Linux | checksum |
| repoverlay-x86_64-unknown-linux-gnu.tar.xz | x64 Linux | checksum |
v0.8.0 - 2026-02-28
Release Notes
Command: apply
Added
Add interactive conflict resolution mode
Use --interactive (-i) to be prompted for each file conflict during apply, restore, and update. When a conflict is detected, you can choose to overwrite the file, skip it, view a diff, or abort the operation. The --force flag can also be written as --overwrite.
Prompt to save source on first use
When apply resolves a username or owner/repo reference for the first time, it now prompts the user to save it as a configured source for future use. The prompt is skipped if the source is already configured or in non-interactive mode.
Command: browse
Added
Allow browsing without a configured source
browse now accepts an optional source argument (GitHub username, owner/repo, or URL) to fetch and browse overlays without adding a persistent source. Existing behavior using configured sources is unchanged when no argument is provided.
Command: create
Added
Auto-apply overlay after creation (#144)
The create command now automatically applies the overlay to the source
repository after creating it. Files are replaced with symlinks, overlay
state is saved, and git exclude is updated. Both local and overlay-repo
modes are supported. Dry-run mode skips the apply step.
Command: edit
Fixed
Interactive edit handles non-OverlayRepo sources correctly (#148)
add_files_to_overlay is now source-type-aware and includes a rollback
mechanism. Local overlays copy files to the overlay directory; GitHub
overlays are rejected with a clear error. If any operation fails mid-way,
all completed operations are rolled back to prevent partial state.
Command: update
Fixed
Fix update showing incorrect source type for overlay repo sources (#145)
Running update on overlays from an overlay repo incorrectly displayed
messages meant for local sources. Each source type now shows the correct
label and update behavior.
Fixed
Fix apply and sync failing for local overlay sources (#143)
Overlays from local directory sources were incorrectly handled through the
remote overlay path, causing apply and dry-run to fail. Local sources now
resolve correctly.
Changed
Remove legacy overlay_repo config support (#79)
The deprecated overlay_repo configuration field and automatic migration
from the old format have been removed. Users must use the sources
configuration format. The OverlayRepoConfig struct is retained for use
by the sources system.
Remove deprecated commands: add, publish, list, create-local (#84)
Removed hidden/deprecated command variants that have been replaced:
add (use edit --add), publish (use create), list (use browse),
and create-local (use create --local).
Install repoverlay 0.8.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/tylerbutler/repoverlay/releases/download/v0.8.0/repoverlay-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/tylerbutler/repoverlay/releases/download/v0.8.0/repoverlay-installer.ps1 | iex"Install prebuilt binaries via Homebrew
brew install tylerbutler/tap/repoverlayDownload repoverlay 0.8.0
| File | Platform | Checksum |
|---|---|---|
| repoverlay-aarch64-apple-darwin.tar.xz | Apple Silicon macOS | checksum |
| repoverlay-x86_64-apple-darwin.tar.xz | Intel macOS | checksum |
| repoverlay-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| repoverlay-aarch64-unknown-linux-gnu.tar.xz | ARM64 Linux | checksum |
| repoverlay-x86_64-unknown-linux-gnu.tar.xz | x64 Linux | checksum |
v0.7.0 - 2026-02-18
Release Notes
Command: apply
Added
Show already-applied overlays as disabled in the overlay picker
The interactive overlay picker now displays already-applied overlays as dimmed, non-selectable entries so users can see what's active without leaving the selection UI.
Command: browse
Added
Add interactive overlay selection and apply to browse command
When running in an interactive terminal, browse now presents a multi-select picker to choose overlays and applies them directly. Already-applied overlays appear disabled. Non-interactive mode (piped output or --no-interactive) continues to list overlays as text. Also adds --target, --no-interactive, and --dry-run flags.
Command: remove
Added
Replace numbered list with multi-select picker for overlay removal
The remove command now uses an interactive multi-select picker with keyboard navigation, search filtering, and select-all toggling, replacing the old numbered-list prompt. Multiple overlays can be removed at once.
Command: status
Added
Add --json flag to status command for machine-readable output
Outputs applied overlay state as structured JSON including overlay name, source info, applied timestamp, and per-file status (ok or missing). Useful for scripting and CI integration (e.g. repoverlay status --json | jq ...). Works with --name filter to output a single overlay.
Add --quiet flag to status command for exit-code-only checks
Exits with code 0 if overlays are applied, 1 if none. Produces no output. Useful for conditional scripts (e.g. if repoverlay status -q; then ...).
Command: sync
Added
Add --all flag to sync all applied overlays at once
Only syncs overlays sourced from the overlay repo. Overlays from local or GitHub sources are skipped with a warning. Supports --dry-run.
Fixed
Fix sync --all skipping overlays from the overlay repo GitHub source
Overlays applied via two-part browse mode (e.g., repoverlay apply owner/repo-overlays) are stored with a GitHub source type rather than an OverlayRepo source type. The sync command now detects these by checking if the GitHub URL matches a configured overlay source and the subpath contains a valid org/repo/name reference.
Added
Auto-filter overlays by current repository
When browsing or selecting overlays, the current repository is auto-detected from git remotes (origin and upstream). Matching overlays are shown first; non-matching overlays are labeled "different repo" in the interactive picker. Text listing filters to matching overlays by default. Use --show-all to see all overlays.
Add documentation site at repoverlay.tylerbutler.com
Full docs site with installation instructions, quick start guide, concept explanations (overlay repos, sources, fork inheritance, configuration), usage guides, and CLI reference.
Changed
Rationalize command vocabulary and deprecate old commands before 1.0
Several commands have been renamed or consolidated for consistency. The old names still work but are hidden from help output and print a deprecation warning. They will be removed in 1.0.
list → browse — Browse available overlays from the overlay repository. Flags (--filter, --update) are unchanged.
create-local → create --output <path> — Local overlay creation is now a mode of the create command. Pass --output to write to a local directory instead of the overlay repository; the overlay name becomes optional in this mode.
cache clear → cache remove --all — Cache removal is unified under cache remove. Use --all to clear everything, or pass a specific owner/repo to remove a single cached repository.
publish → create — Overlay publishing is now handled by create, which auto-detects the target repository from the git remote or accepts an explicit org/repo/name path.
add → edit --add — Adding files to an existing overlay is now a flag on the edit command. Use --add (repeatable) to include new files and --remove to drop files in a single invocation.
Security
Reject symlinks that escape the overlay source directory during copy
Malicious overlay repositories could include symlinks pointing outside their directory tree (e.g., to /etc/passwd). The copy operation now checks each entry with symlink_metadata and rejects any symlink whose target resolves outside the source root. Also adds a recursion depth limit (64) to prevent stack overflow from circular symlinks.
Validate overlay repository URL scheme before cloning
Only https://, ssh://, and git@ URLs are now accepted for overlay repository sources. This prevents file:// and other local schemes from being used to read files from the host filesystem. URLs starting with - are also rejected to prevent git flag injection.
Validate overlay path components against directory traversal
The org, repo, and overlay name components used to construct filesystem paths are now validated to reject .., /, \, and leading . characters, preventing path traversal attacks via crafted overlay references.
Install repoverlay 0.7.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/tylerbutler/repoverlay/releases/download/v0.7.0/repoverlay-installer.sh | shInstall prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/tylerbutler/repoverlay/releases/download/v0.7.0/repoverlay-installer.ps1 | iex"Install prebuilt binaries via Homebrew
brew install tylerbutler/tap/repoverlayDownload repoverlay 0.7.0
| File | Platform | Checksum |
|---|---|---|
| repoverlay-aarch64-apple-darwin.tar.xz | Apple Silicon macOS | checksum |
| repoverlay-x86_64-apple-darwin.tar.xz | Intel macOS | checksum |
| repoverlay-x86_64-pc-windows-msvc.zip | x64 Windows | checksum |
| repoverlay-aarch64-unknown-linux-gnu.tar.xz | ARM64 Linux | checksum |
| repoverlay-x86_64-unknown-linux-gnu.tar.xz | x64 Linux | checksum |