// CHANGELOG

Releases.

Every version of agentjail and what changed in it.
Check detailed commits on GitHub releases.

  1. v1.1.0
    Latest

    # Codex and Cursor Get the Full Shield

    Codex and Cursor now get the same OS sandbox, policy enforcement, and visible protection state as Claude Code. Typed adapters preserve policy meaning across each agent protocol, while stricter validation keeps custom Rego rules from changing the resolver or weakening locked policies.

    • Added Codex lifecycle attestation reports whether the sandbox and policy daemon are active at startup, resume, clear, compact, and stop boundaries.
    • Added The opt-in PATH shim now launches Claude Code, Codex, and Cursor through the OS sandbox, with upgrade and uninstall support for all three wrappers.
    • Added Complete Codex and Cursor hook adapters normalize shell commands, file reads, patches, MCP calls, approvals, and outcomes before policy evaluation.
    • Added Decision records, logs, and UI state now separate the canonical policy action from the effective action sent through an agent protocol, with adapter and translation details.
    • Added Cursor gets a persistent protection badge while preserving and restoring any existing status command.
    • Added A clean-VM conformance scenario verifies installed Claude Code, Codex, and Cursor hook behavior.
    • Changed Codex ask decisions fail closed at PreToolUse: policy still records ask, while the adapter sends deny because the hook cannot open an approval prompt.
    • Changed Policy inputs now share one canonical shape across supported agents, including paths, commands, MCP calls, sessions, and tool-call correlation.
    • Changed Daemon restart now uses the installed supervisor instead of starting an unconfigured daemon process.
    • Fixed Uninstall probes only the daemon socket under the requested home, preventing false aborts that leave hooks and shell profile entries installed.
    • Fixed Logs select the newest matching decisions, print them chronologically, and traverse every matching SQLite page with --no-follow.
    • Fixed Sandbox attribution now requires failure evidence, so successful output that mentions EPERM or a denial is not recorded as blocked.
    • Fixed Static, non-expanding git commit messages no longer trigger the sensitive-path rule.
    • Security OPA AST validation allows custom rules to add candidate entries but rejects resolver and helper declarations at policy add and daemon load.
    • Security Separating canonical and effective actions prevents agent protocol limits from being misreported as policy decisions.
  2. v1.0.0

    # Network Visibility

    See what your coding agent sends its model. On Linux, agentjail has captured that traffic through its transparent tunnel for releases; v1.0.0 brings the same full visibility to macOS - a plain "agentjail claude" records the full POST /v1/messages (request and response, bodies encrypted at rest) with no system extension, via a base-URL capture gateway. The tunnel gains HTTP/2 and gRPC on both platforms and an opt-in IPv6 datapath on macOS, all verified against a real agent on the installed build. A Network tab surfaces per-session request timelines, filters, and a body viewer.

    • Added Base-URL capture gateway for LLM providers (AGE-259, ADR 0109): current Claude Code runs on Bun and its inference client ignores every CA trust store, so a transparent MITM cannot decrypt POST /v1/messages. Instead the shield points the agent's own ANTHROPIC_BASE_URL at a per-session loopback proxy - nonce-gated, egress-guarded, a user-set base URL preserved - that records the full request/response (bodies encrypted at rest) and forwards to the real provider over TLS. Runs in both plain and --tunnel modes, no privileged extension; fail-closed for a detected provider with a --no-provider-gateway opt-out.
    • Added HTTP/2 and gRPC through the tunnel (ADR 0102): the transparent-tunnel MITM negotiates ALPN and serves h2 with full parity to the HTTP/1.1 path (body capture, policy, deny, recording), preserving gRPC status and trailers. Long-lived streams no longer stall - request bodies forward without pre-draining.
    • Added IPv6 datapath for the macOS tunnel (AGE-262, opt-in): v6 egress used to reset and evade capture; the gateway now provisions a v6 address end to end. Enable with --tunnel-ipv6 while the installed app is being attested dual-stack.
    • Added Network flag precedence + doctor sourcing (ADR 0110): one canonical order for every network knob (CLI flag > env var > policy.yaml > default), and "agentjail doctor" prints each knob's effective value and where it came from. --netproxy is documented as deprecated.
    • Added Network visibility UI: a Network tab with per-session request timelines, column filters, and a body viewer, over an on-disk capture store. Session "active" state reflects the owning shield PID's liveness (ADR 0100).
    • Added Encrypted body capture with keychain/file KEK tiers so doctor never overstates protection (ADR 0095/0097); "agentjail ui --trusted-host" to reach the local UI behind a same-host reverse proxy (ADR 0099); "agentjail-daemon --retention-interval" so retention and WAL checkpoint re-run periodically, not just at startup (ADR 0101).
    • Added Every action shows its true final outcome and who enforced it (ADR 0112): the Monitor tab and "agentjail logs" report the combined policy+sandbox result, so a command policy allowed but the OS sandbox blocked (cat ~/.ssh/id_rsa) renders as "blocked · sandbox" and never a misleading green allow. PreToolUse records the policy verdict and a new PostToolUse hook detects the sandbox's EPERM signature to record the real outcome.
    • Added One session identifier end to end (AGE-111): the Network tab now groups, filters, names, and perma-links on the same Claude session id the Monitor tab and the policy daemon use - instead of a separate per-capture id - backfilled for rows captured before the id was known.
    • Changed The OS sandbox is the default: "agentjail claude" runs shielded, with a --no-sandbox opt-out for hook-only policy on hosts that cannot sandbox.
    • Fixed Streaming responses stalled on the macOS tunnel (ADR 0108): the gVisor pump dropped outbound packets when its queue was full, hanging long SSE streams. It now applies backpressure instead of silently dropping.
    • Fixed The tunnel silently fell back to netproxy on installed builds (ADR 0103): the TUN re-exec resolved the wrong executable and misdispatched to the CLI (now dispatched by argv[0]); the tunnel holder died mid-session on a retired thread (now socket-based liveness); DNS was unreachable inside the netns on systemd-resolved hosts (now a bind-mounted resolver).
    • Fixed Decrypted bodies were not persisted on the darwin tunnel (AGE-259) because a non-alphanumeric session id was rejected; retention enforced its window only at startup so a long-lived daemon grew unbounded (AGE-225); dev builds reported version "dev" (AGE-247); h2 request trailers were dropped on streamed bodies.
  3. v0.9.0

    # Monitor Mode, Verified Attestation & Control-Plane Auth

    Monitor mode lets the daemon evaluate every tool call and enforce nothing, recording what a rule set would allow, deny, or ask about so you can try it against your real workflow before turning it on. Attestation now verifies the policy daemon end to end (UNSECURED when unshielded, degraded by default when the daemon is unreachable, so a green badge is a verified claim), and every privileged control-socket verb requires a token the shield withholds from the sandboxed agent.

    • Added Monitor mode (ADR 0091): a new enforcement mode where the daemon evaluates every tool call and enforces nothing, recording the verdict that would have fired. "agentjail monitor" shows what policy would have stopped, so you can dial in rules against your real workflow before turning them on.
    • Added Control-plane token authentication across the daemon, netproxy, and secrets broker (ADR 0067/0068/0069): every privileged control-socket verb now requires a token that the shield withholds from the sandboxed agent, so the guarded agent cannot call the guard's control plane to weaken it.
    • Added agentjail doctor --fix (ADR 0086) repairs what it diagnoses - a dangling PATH shim, a stale supervisor, missing role symlinks - instead of only reporting it.
    • Added The status line always attests: it shows UNSECURED when not shielded, and it attests the policy daemon by pinging it, not just the shield (ADR 0064/0085).
    • Added The store redacts secrets by value, not only by key name (ADR 0084), and Rego input is type-checked against the HookInput schema with "policy add" failing closed on an unknown input.* reference (ADR 0080).
    • Changed Degraded is the default posture when the daemon is unreachable, not silent allow (ADR 0074).
    • Changed Uninstall is total (ADR 0063/0065): it stops the daemon before unhooking, verifies it stopped, aborts rather than tearing down half-way, and restores any chained status line. AGENTJAIL_SHIELDED=1 now means actually sandboxed, not merely that the shield ran (ADR 0087).
    • Changed Daemon durability: a WAL checkpoint replaces VACUUM-on-start, SIGHUP reloads are coalesced and rate-bounded (ADR 0075), and buffered decisions survive shutdown. Policy reload moved off the agent-reachable socket onto the privileged control socket (ADR 0066).
    • Fixed The status badge no longer reads "secured" while the daemon is down and enforcing nothing (the signature was shield activations climbing while recorded decisions stayed flat); a wedged daemon is no longer badged as secured. The fail-open notice now surfaces where the user can see it, and Codex users are warned during a daemon-down window too.
    • Fixed Shield: canonicalizes aliased paths in the control-socket guard, works from a git worktree, never launches silently unrecorded, and emits macOS control-socket denies last with SSH_AUTH_SOCK preserved. Install repairs the deployed supervisor, not just the template, and the Linux daemon restarts after the auto-updater's clean exit (ADR 0070).
    • Security Control-plane token auth closes a privilege-escalation path: a sandboxed agent could previously reach the daemon, netproxy, and secrets control sockets. Every verb but the fingerprint challenge now requires a token the shield withholds from the agent.
    • Security Honest attestation (ADR 0074/0087): the guard reports UNSECURED or degraded instead of a green badge when enforcement is not actually running, and secrets are redacted by value so one pasted into an unexpected field is still masked in the audit log (ADR 0084).
  4. v0.8.2

    # Daemon Single-Instance Guard

    Enforcement-integrity fix: exactly one agentjail-daemon can own the policy socket now, regardless of how it was installed (Homebrew vs curl) or started (service vs manual). A second daemon stands down instead of hijacking daemon.sock and orphaning the incumbent.

    • Fixed Daemon single-instance guard (ADR 0060): the agent-facing policy socket was bound with a blind unlink and no single-instance lock, so a second daemon - a different install channel, a manual run, or an upgrade transition - could double-bind it and leave two daemons alive with hooks split across them, opening a fail-open window during the handoff. The daemon now takes an exclusive flock before binding and replaces the blind unlink with a stat, a ControlOpPing liveness probe, and a remove-only-if-stale step. A healthy incumbent makes the newcomer stand down cleanly; a foreign or wedged process squatting on the socket is never unlinked.
    • Added A side-effect-free wire.ControlOpPing liveness op backs the probe, so a bare connect() cannot be mistaken for a live daemon.
  5. v0.8.1

    # Release-Gate Hardening (macOS testbed)

    Release-tooling only, no shipped-binary change: the macOS release gate (make e2e-release) no longer flakes with a misleading "VM never got an IP", now runs exactly one testbed VM at a time, and stops it on exit so a run never leaves an orphan.

    • Fixed macOS release gate surfaces the real tart run error (notably the macOS Virtualization.framework concurrent-VM cap, "The number of VMs exceeds the system limit") and fails fast, instead of swallowing it and blaming a DHCP-lease timeout after 120s.
    • Fixed The gate waits for SSH to become reachable before provisioning (sshd comes up a few seconds after the VM gets its IP), fixing an intermittent provision-time SSH timeout.
    • Fixed The gate enforces a single testbed VM: it stops other running testbed VMs up front to guarantee a free slot, and stops its own VM on exit (success, failure, or interrupt) so a run never orphans a VM.
  6. v0.8.0

    # Multicall Binary Consolidation (6 to 2)

    agentjail now ships two binaries instead of six: the daemon, shield, netproxy, and secrets roles fold into one multicall agentjail binary, with the role names kept as symlinks. Smaller install, updates that cannot half-apply, and the latency-critical hook still on its own lean path.

    • Changed Multicall agentjail binary (ADR 0059): the daemon, shield, netproxy, and secrets roles are folded into one agentjail binary that dispatches on its invocation name, so agentjail now ships 2 real binaries (agentjail + agentjail-hook) instead of 6 - half as much to build, sign, notarize, and self-update.
    • Changed The four role names (agentjail-daemon/-shield/-netproxy/-secrets) are now relative symlinks to agentjail, reconciled on every install, update, and uninstall. Existing launchd/systemd definitions, PATH shims, and hook config keep working, and a role can no longer drift out of sync with the build it should track.
    • Changed agentjail-hook deliberately stays a separate lean binary: it runs on every tool call, so folding the daemon's policy engine and database into it would tax the hot path. Verified it still links no OPA/SQLite and starts in ~5ms.
    • Fixed Release-blocking version stamp: after the refactor the CI build's version ldflag no longer reached the version symbol, so every tagged release would have reported its version as "dev". Fixed before tagging by unifying on a single shared version symbol.
    • Fixed agentjail no longer writes a degenerate empty Codex hook group or a null Cursor event entry when reconciling a coding agent's hook config, avoiding malformed hooks.json the agent would warn on.
  7. v0.7.0

    # Clean-VM Testbed Engine, Secrets-Broker Auto-Start, Shield $HOME Fix

    A clean-VM testbed engine records every CLI flow and gates releases on a real end-user machine, the credential broker auto-starts on demand, and a Linux shield read-leak that exposed ~/.ssh when launching from $HOME is sealed.

    • Added Clean-VM testbed engine (ADR 0053): persistent, isolated VMs (Lima/QEMU on Linux, Tart on macOS) that install agentjail the true user way via the shipped install.sh. "make e2e-release" is the release gate, exiting non-zero on any enforcement failure.
    • Added Recorded CLI scenario suite: 15 scenarios captured with asciinema (compact JSON, not video), each with a structured pass/fail result, auto-sanitized of host-identifying data, rendered to a self-contained HTML report. Green on Linux and macOS.
    • Added On-demand secrets broker auto-start (ADR 0058): the broker is a loaded-but-not-running launchd/systemd definition that clients bring up on first use and that self-exits when idle (never tearing down live grants), so "agentjail secret set" and shield grants no longer need a manual "agentjail-secrets serve".
    • Fixed Linux shield $HOME read-leak: launching an agent with its working directory set to $HOME could expose ~/.ssh, ~/.aws, and ~/.gnupg. The shield now grants only the non-hidden home entries as a workspace and denies dotfiles/dotdirs by default, matching the macOS shield. A normal project cwd is unaffected.
  8. v0.6.2

    # CI Green-up + Daemon Idle-Timeout Race Fix

    A maintenance release: restore a green CI pipeline and fix a data race in the daemon's agent-connection idle-timeout handling that the race detector flagged. No shipped behavior changes.

    • Fixed Daemon agent-connection idle timeout moved from a mutable package global to an immutable per-server field, removing a data race the race detector flagged. Production behavior is unchanged (still a 5s idle deadline).
    • Fixed CI e2e/smoke/unit test harnesses pass again on macOS and Linux (red since v0.6.0): they now isolate HOME so the hook honors the test socket, and run sensitive-path fixtures against non-temp paths. Test-only changes; no shipped behavior affected.
  9. v0.6.1

    # Status Line Shows the Release Version

    The shielded status line now shows the enforcing build's version instead of a bare commit hash - it reads v0.6.1 on a release and v0.6.0+5 between releases, so you can tell at a glance which build is guarding the session.

    • Changed agentjail statusline renders the build version from git describe: an exact release tag (v0.6.1), +N commits past the last tag (v0.6.0+5), and a trailing * for a dirty tree. It falls back to the short commit hash when no version was embedded.
  10. v0.6.0

    # Credential Hardening, macOS Shield + SSH-Agent, Linux Install

    A hardening release: the credential broker and daemon get tougher, so a sandboxed agent still cannot read your master key, leak database passwords through process arguments, or reach cloud metadata. It also debuts the clean-VM testbed engine - a make e2e-release gate that installs agentjail the real user way and asserts enforcement on a true end-user machine. And it stays out of your way - ssh-agent now works transparently on macOS, .env.example templates no longer trip the guard, and there is a first-class Linux install.

    • Added Clean-VM testbed engine and a make e2e-release gate that installs through the real install.sh and asserts enforcement on a true end-user machine (ADR 0053). This is the foundation the v0.7.0 recorded-scenario suite builds on.
    • Added ssh-agent auth under the shield - SSH_AUTH_SOCK passthrough, agent-socket connect on the macOS seatbelt, and per-user temp + AF_UNIX local sockets.
    • Added Typed ssh-agent readiness prober, a doctor warning when keys are on disk but not loaded, and a one-shot hook advisory on the allow path.
    • Added Fix for the ssh-agent pinned-IdentityFile blind spot - the shield injects an agent-backed GIT_SSH_COMMAND with IdentitiesOnly=no (ADR 0056).
    • Added Daemon control-plane socket - policy reload over the control socket with SIGHUP fallback (ADR 0052).
    • Added daemon_unreachable policy knob with a hook-fallback sidecar the hook acts on (ADR 0050).
    • Added Linux install support via a systemd --user daemon service (ADR 0051).
    • Added Remediation hints on file_policy and command_policy denies, and the exact MCP server name in the unknown-server deny hint.
    • Changed Inverted the .env write-deny to a secret-form deny-list - only secret-bearing forms are denied; templates like .env.example and .env.docker are allowed (ADR 0057).
    • Changed Shell parsing now unwraps interpreter and process wrappers (python/node/perl/ruby/php), newlines, and command substitutions.
    • Changed The shield re-asserts the agentjail hook right before exec.
    • Fixed install.sh no longer aborts the outer script under set -eu.
    • Fixed Bounded concurrent agent-socket connections and added an idle read deadline on the daemon.
    • Security Protect the secrets-broker master key from agent reads (policy + shield).
    • Security Stop leaking postgres passwords via psql argv; grants auto-expire and requested TTL is capped.
    • Security Verify daemon peer UID and CWD instead of trusting self-reported claims.
    • Security Only honor AGENTJAIL_SOCKET when it resolves under ~/.agentjail; re-arm the fail-open sentinel on startup.
    • Security Block MCP-command credential-dir grants and deny .config credential subdirs; guard against cloud-metadata (IMDS) egress in port-only mode.
    • Security Trust-gate the per-project policy overlay before applying it, and extend store redaction to more credential shapes.
  11. v0.5.1

    # SSH/AWS Config Access, Landlock Test Fix

    Sandbox now allows read-only access to SSH and AWS config files for host resolution and region settings. Landlock test fix for AF_UNIX socket limitation.

    • Added Read-only access to SSH config and AWS config in the sandbox - agents can resolve SSH host aliases (via ssh-agent, no private key access) and read AWS region/profile settings.
    • Fixed Landlock ctl_connect test downgraded from assertion to log - Landlock cannot prevent AF_UNIX connect() (FS-only LSM); grant-socket isolation on Linux requires Tier 2+.
  12. v0.5.0

    # Daemon Grant Server, Policy Simplification, Self-Update Fixes

    Grants moved from netproxy to daemon with PID-based session binding, removed overly broad no-hook-self-disable rule, and self-update fixes.

    • Added Daemon-hosted grant server (ADR 0047) - grant control on daemon-ctl.sock with PID-based session binding via SO_PEERCRED/LOCAL_PEERPID; transactional claim-grant workflow with audit trail.
    • Added agentjail grants --log flag to display grant audit history from the daemon SQLite store.
    • Added file_policy/hook_config ask rule protecting ~/.claude/settings*.json from silent overwrites that could remove agentjail hooks.
    • Added make dev-install target to build, install, sync policy rules, restart daemon, and verify with SHA-256 checksums.
    • Added Fail-open one-time warning sentinel mechanism.
    • Added SSH port 22 allowed in sandbox fallback ports.
    • Changed Grant commands auto-detect backend - agentjail grants queries daemon first, falls back to netproxy only when available; merged listing with SOURCE column.
    • Changed Peer PID extraction via SO_PEERCRED/LOCAL_PEERPID for session binding without agent-supplied identity.
    • Fixed Removed no-hook-self-disable rule that blocked legitimate plugin operations (claude-mem) due to overly broad Bash regex matching >= and => as shell redirects.
    • Fixed PATH shim regenerated on upgrade so brew/curl installs pick up the current template.
    • Fixed Daemon restart via launchctl kickstart instead of stop+start.
    • Fixed Landlock test updated to use daemon-ctl.sock (was still referencing old netproxy-ctl.sock path).
    • Security daemon-ctl.sock denied on macOS via sbpl network-outbound deny, mirroring the netproxy control socket isolation - agent cannot self-approve grants.
  13. v0.4.0

    # Session-Aware Network Proxy, Project Overlays & Runtime Grants

    Per-session network allowlists over a control plane, direnv-style project policy overlays with agentjail trust, and interactive runtime host grants with anti-self-grant policy.

    • Added Session-aware network proxy - control-plane server with session registry, per-token data plane, and lease reaper; shield registers a per-session allowlist with netproxy.
    • Added Per-folder project policy overlays - direnv-style trust gate with agentjail trust/untrust/trust list CLI; shield applies trusted overlay additively.
    • Added Runtime host grants - agentjail allow host and grant approve/deny CLI with daemon-hosted grant server; works without --netproxy, peer-PID session binding, transactional persist-on-approve, and grants --log audit history.
    • Added macOS code signing and notarization wired into the release pipeline.
    • Added Netproxy decision logging to a file for observability, including target host on non-CONNECT rejects.
    • Changed Domain-driven interface-first architecture (ADR 0035) - extracted hookwatch, credential, sandbox, envaudit, and policyeval into internal packages; policyctl domain service replaces 12 copy-pasted audit ceremonies.
    • Changed Shared sandbox contract for darwin/linux parity - hybrid allowed_hosts model with non-removable essential hosts and user-configurable extended hosts.
    • Changed Netproxy egress enforcement is now opt-in via --netproxy.
    • Security Policy denies agent-issued grant verbs - approve/deny/persist/trust cannot be invoked by the agent itself, only by the human operator.
    • Security Narrowed agent grant on ~/.agentjail to daemon.sock only.
    • Security macOS keychain access hardened for Claude Code as part of darwin/linux sandbox parity.
  14. v0.3.0

    # Sessions subsystem + Cobra CLI

    Session tracking with PID-based active detection, Cobra CLI migration for automatic --help and shell completions, and platform-specific process tree walking.

    • Added agentjail sessions list -- new CLI command showing active and past agent sessions with PID-based active detection via process tree walking.
    • Added Session names from Claude Code metadata -- sessions display human-readable names instead of opaque IDs.
    • Added Cobra CLI framework -- migrated from hand-rolled subcommand dispatch to Cobra for automatic --help and shell completions.
    • Fixed Platform-specific procwalk -- split into _darwin.go (sysctl) and _linux.go (/proc) with //go:build constraints.
  15. v0.2.9

    # MCP inventory + per-project policy

    Full MCP surface inventory from agent configs, npm, pip, and Docker. Per-project policy cascading with a reverse MCP index. Per-skill and per-tool granular controls.

    • Added agentjail mcp inventory -- scans agent configs, npm packages, pip packages, and Docker containers for a full MCP surface map with security audit per server.
    • Added Per-project policy resolution -- policies cascade from global defaults to per-project overrides with a reverse MCP index.
    • Added Project selector UI -- web UI project selector with per-project policy view and override management.
    • Added Per-skill policy -- agentjail skill allow/block/ask for granular skill gating.
    • Added Per-tool policy CLI -- agentjail mcp tool allow/block/ask with session log discovery and remote MCP connectors.
  16. v0.2.8

    # MCP policy foundations + security hardening

    Per-MCP-tool blocked_tools and ask_tools granular controls. Live MCP tool discovery via protocol introspection. Security fixes for XSS, CSRF, credential leak, and goroutine safety.

    • Added Per-MCP-tool policy -- blocked_tools and ask_tools granular controls in policy.yaml for tool-level gating within MCP servers.
    • Added Live MCP tool discovery -- introspects running MCP servers via the MCP protocol to enumerate available tools with provenance metadata.
    • Added Policy management UI -- new tab in the web UI with an MCP tool matrix and inline config editor.
    • Security XSS sanitization, CSRF protection, credential leak prevention, DOM chip injection fix, goroutine safety for concurrent map access.
  17. v0.2.7

    # Interactive replay TUI

    Full-screen interactive TUI for replaying agent sessions -- vim keybindings, live filter, detail expansion, follow mode. Plus ANSI colors, agent glyphs, and 8-char session prefixes.

    • Added Interactive replay TUI -- agentjail replay -session <id> launches a bubbletea full-screen viewer with j/k scroll, / live substring filter, Enter to expand row details, f for follow mode, v for verbose.
    • Added Session prefix resolution -- short 8-char IDs from --list work directly with -session. Exact match takes priority over prefix.
    • Added Paginated loading -- sessions with 10k+ decisions load fully instead of silently truncating.
    • Added Replay ANSI colors -- colored action badges (green ALLOW, red DENY, yellow ASK), agent glyphs (Claude, Codex, Cursor), dim metadata, bold headers.
    • Added --basic flag -- forces plain text output. Auto-detected for piped output, TERM=dumb, and small terminals.
    • Added Terminal sanitization -- DB-sourced strings stripped of ANSI escapes and control characters before TUI rendering (prevents terminal injection).
    • Changed NO_COLOR keeps the TUI interactive but disables color. Only TERM=dumb falls back to basic mode.
    • Fixed Session IDs in replay --list truncated to 8 characters instead of truncated UUIDs with ellipsis.
  18. v0.2.6

    # Daemon auto-update

    The daemon now auto-updates itself - downloads, verifies (minisign + SHA256), swaps binaries, and restarts. Works on macOS (launchd) and Linux (systemd).

    • Added Daemon auto-update - periodically checks for new versions and applies them automatically (download → verify → swap → restart).
    • Added Linux systemd support - auto-update works with systemctl --user restart on Linux, in addition to launchd on macOS.
    • Added internal/selfupdate/ package - shared download, verification, and binary swap infrastructure used by both CLI and daemon.
    • Added ADR 0026 - documents the daemon auto-update decision.
    • Changed agentjail update (CLI) - refactored to use shared internal/selfupdate/ functions.
    • Security Same minisign + SHA256 verification chain as manual agentjail update. Dev builds and Homebrew installations skip auto-update.
  19. v0.2.5

    # Combined changelogs, UI polish, telemetry fixes

    Jumping multiple versions now shows what shipped in every release you skipped. Plus UI polish (session permalinks, scroll stability, wider sidebar) and telemetry fixes.

    • Added Combined changelogs on update - agentjail update shows what shipped in every release you skipped, not just the latest; backed by /v1/changelog?from=vX.Y.Z.
    • Added Session URL permalinks - selecting a session updates the URL; restored on page load and browser back/forward.
    • Added "All Sessions" back button - visible at top of sidebar when a session is selected.
    • Fixed Logs TUI local time - timestamps now display in local time instead of UTC.
    • Fixed Timeline scroll stability - scroll position preserved during SSE updates; expanded cards stay on correct row.
    • Fixed Timeline grid layout - Summary column is now flexible; no empty space on the right.
    • Fixed Worktree repo name - resolves real repo name inside worktrees.
    • Fixed Person properties - PostHog now builds person profiles with $set/$set_once.
    • Fixed Heartbeat reliability - CLI waits for heartbeat POST before exiting.
    • Fixed Install inflation - is_fresh_install distinguishes first-ever installs from refreshes.
    • Changed Sidebar width - default widened from 208px to 280px.
    • Changed Active session threshold - reduced from 15m to 10m.
    • Changed Releases Worker cache TTL - reduced from 5m to 1m.
  20. v0.2.4

    # Smarter UI sessions

    Session labels now show agent, git branch, and repo name instead of opaque UUIDs. Timeline gets a CWD column and the header shows a live event ticker.

    • Added Git-aware session labels - sessions display as agent · branch · repo (e.g. "claude-code · main · agentjail"); git info looked up once per session.
    • Added CWD column in timeline - event table shows the working directory basename.
    • Added Live event ticker - "last event: Xs ago" in the header bar, updated every second.
    • Fixed agentjail ui showed stale "NOT in v0.1.0-alpha release" label - now displays the actual version.
  21. v0.2.3

    # Install & update changelog

    Both the installer and agentjail update now show a "What's new" section with unicode-formatted bullet points, so users see what shipped at a glance.

    • Added Install-time changelog - curl | sh displays a compact "What's new" section with unicode bullet points extracted from the GitHub release notes.
    • Added Update-time changelog - agentjail update shows the same "What's new" section after a successful self-update.
    • Added Releases Worker changelog field - /v1/latest API response includes the release body so both installer and update can display it without an extra network call.
    • Changed Update confirmation - agentjail update now accepts Enter to proceed (previously required typing 'y'); stricter confirmation remains for policy disable and mcp allow/block.
    • Changed Update output - emoji progress indicators (📥 🔏 🔐 🔄 ✅) for download, verify, and restart steps.
    • Fixed agentjail ui showed stale "NOT in v0.1.0-alpha release" label - now displays the actual version.
    • Changed CHANGELOG.md backfill - added entries for v0.2.0, v0.2.1, and v0.2.2.
  22. v0.2.2

    # SQLite memory fix for logs

    Fixes agentjail logs getting killed by macOS jetsam on memory-constrained systems by reducing SQLite memory footprint and adding daemon.log fallback.

    • Fixed agentjail logs killed on memory-constrained systems - reduced SQLite read-only memory footprint: cache limited to 1 MB, memory-mapped I/O disabled, single connection. Prevents macOS jetsam (OOM killer) from killing the process on systems with <200 MB free RAM.
    • Fixed Graceful fallback - if SQLite open fails, agentjail logs now automatically falls back to streaming daemon.log instead of exiting with an error.
  23. v0.2.1

    # UI improvements

    Dynamic version display, cache-busting API headers, session CWD display, and active/recent session grouping in the web UI.

    • Added Session CWD display - each session in the sidebar shows the working directory basename.
    • Added Active/recent session grouping - sessions with activity in the last 15 minutes are grouped under "Active" (green); older sessions under "Recent" with relative timestamps.
    • Fixed UI version was hardcoded as v0.1.2 - now injected from the binary at runtime.
    • Fixed UI counters not refreshing on page reload - added Cache-Control: no-cache, no-store headers to API endpoints.
  24. v0.2.0

    # Layered self-protection & structured command parsing

    Eliminates self-protection false positives with structured command parsing, adds hook-config watchdog, and hardens the shield with hook config protection.

    • Added Structured command parsing - the daemon now parses shell commands into binary basenames (input.command_binaries) so Rego rules identify which binary is being invoked without regex-matching the raw command string. Eliminates false positives on git add cmd/agentjail/update.go, go build, and similar commands.
    • Added Hook-config watchdog - the daemon monitors hook configuration files (~/.claude/settings.json, ~/.codex/hooks.json, ~/.cursor/hooks.json) every 5 seconds and re-injects the agentjail hook if it is removed, with audit logging.
    • Added Shield hook-config protection - macOS Seatbelt profile now denies writes to ~/.claude/, ~/.codex/, ~/.cursor/ directories and com.agentjail.* LaunchAgent plists at the kernel level.
    • Changed Hook config edits (Write/Edit tool) downgraded from hard deny to ask - users can now approve legitimate agent config edits while the watchdog verifies hook integrity post-edit.
    • Changed library/no-daemon-kill moved from locked to disableable (with --force) - the daemon has launchd KeepAlive=true, so the rule is a UX speed bump rather than an absolute guarantee.
    • Fixed False positive: git add cmd/agentjail/update.go was blocked because "agentjail" appeared in the path and "update" in the filename.
    • Fixed False positive: ls ~/.claude/skills/ 2>/dev/null was blocked because the stderr redirect 2> matched the write-indicator regex.
    • Fixed Duplicate TestFindNetproxyBinary_NotFound test declaration that caused macOS CI build failures.
    • Security ADR 0025: layered self-protection model - regex rules are the UX/signals layer, shield (Seatbelt/Landlock) is the enforcement layer, watchdog verifies hook integrity, Tier 2 VM makes self-protection structural.
  25. v0.1.2

    # SQLite store, AWS policy pack, shield hardening & web UI

    SQLite decision store with replay CLI, AWS policy pack, shield env-stripping and secrets broker, web UI with server-side filters and agent logos, plus a 20-assertion E2E test suite.

    • Added SQLite decision store - WAL-mode event store with redaction, retention cleanup, concurrent reader/writer support, and indexed queries.
    • Added AWS policy pack - no_aws_destructive library rule with per-account posture config (sandbox/prod/locked/custom).
    • Added Replay CLI - agentjail replay --session/--list/--verbose/--follow for session playback.
    • Added Shield hardening - env-stripping, environment audit (root/ambient creds/IMDS), Landlock network rules, netproxy per-host egress.
    • Added Secrets broker - agentjail-secrets with AES-256-GCM, Unix socket RPC, and scoped env var injection via shield grant/revoke.
    • Added Web UI - agentjail ui local replay viewer with server-side filters, resizable panes and columns, agent logos (Claude/Cursor/Codex/OpenCode), collapsible audit, and GitHub links.
    • Added E2E test - make e2e runs 20 assertions covering the full new-user journey; CI on ubuntu + macOS.
    • Fixed AfterID cursor, session filter consistency, UI connection pooling, SSE connect status, DSN path encoding, limit clamping.
    • Security ADRs 0020-0024: environment audit at launch, Landlock network rules, netproxy, secret server, env-stripping.
  26. v0.1.1

    # Plugin MCP discovery, log rotation & brew telemetry fix

    Auto-whitelists Claude Code plugin MCP servers, adds built-in daemon log rotation, and fixes brew install telemetry attribution.

    • Added MCP plugin discovery - agentjail install now auto-whitelists Claude Code plugin MCP servers (e.g. PostHog, Context7, claude-mem). Previously only manually-added servers from ~/.claude.json were discovered; plugin-registered servers from ~/.claude/plugins/ are now a fourth discovery source.
    • Added Built-in log rotation - the daemon manages its own log file with size-based rotation (10 MB, 5 backups) instead of relying on launchd's StandardErrorPath, which truncated logs on every restart.
    • Fixed Brew install telemetry - Homebrew formula now sets AGENTJAIL_INSTALL_METHOD=brew so brew installs are properly attributed in PostHog (previously showed as "None").
  27. v0.1.0

    # First public release

    The first public release of agentjail: hook-based policy guardrails that evaluate every coding-agent tool call locally - before it runs - with one install that discovers and protects every supported agent on your machine.

    • Added One-line install (curl | sh) auto-discovers and wires every supported coding agent - Claude Code, Codex, and Cursor - with an interactive picker when several are present.
    • Added Hook-based enforcement evaluated before each tool call, with no changes to the agent required.
    • Added Local OPA/Rego policy daemon with fail-closed defaults; p95 under 5ms warm.
    • Added Built-in policy packs: sensitive-path file denies, dangerous-shell-command guards, and MCP server allow/block gating.
    • Added agentjail mcp allow/block/list, plus trust-on-install that seeds the MCP servers you already use so existing setups keep working.
    • Added User-tunable policy: enable/disable rules and add your own, with an audit log of every change.
    • Added OS-native sandbox (agentjail-shield) and a per-host HTTPS egress proxy for kernel-level file and network containment on macOS and Linux.
    • Added agentjail try live walkthrough, agentjail logs real-time decision stream, agentjail help, and automatic ~/.agentjail/bin PATH setup.
    • Security Always-on no-daemon-kill and no-hook-self-disable rules - an agent cannot disable its own guardrails to escape enforcement.
    • Security Denies reads of credential stores (~/.ssh, ~/.aws, ~/.npmrc, ~/.git-credentials, keychains, and more) and gates publish/destructive commands before they run.