v0.12.0 — Codex hook + CEL when + rate limiter + env + coverage + Discord

[0.12.0] - 2026-08-15

Added

• Codex CLI hook — agentgate install-codex-hook wires AgentGate into OpenAI Codex CLI as BeforeTool. Tool map (shell→Bash, apply_patch→Edit) keeps policies portable.
• CEL-lite when conditions — rules can carry a small expression gating match on event fields:

  rules:
    - id: deny-rm-elsewhere
      match: {tool: Bash, command_regex: 'rm -rf.*'}
      action: deny
      when: 'event.cwd != "/srv"'

  Supports == != in not-in > < >= <=, and or not, parens, literals.
• Per-rule token-bucket rate limiter — rate_limit: {capacity: 5, refill_per_sec: 0.1}. DENY rules bypass.
• Multi-environment policy manager — agentgate env add|list|show|use|remove|active for dev/staging/prod.
• agentgate coverage — reports dead rules + uncovered tools. --fail-under 80 for CI.
• Discord notify — AGENTGATE_DISCORD_WEBHOOK; precedence: Telegram > Discord > Slack > file.

Stats

• 206 tests (was 189)
• ruff 0 errors
• verify.sh 10/10 ✓

v0.11.0 — dry-run / hot-reload / Prometheus / Gemini / HMAC / docs / CI quality

[0.11.0] - 2026-08-15

Added

• dry-run mode — AGENTGATE_MODE=dry-run records the verdict but never blocks, so you can preview a policy change before flipping the switch
• PolicyWatcher — mtime-based hot reload for long-lived processes (proxy + dashboard pick up edits to policy.yaml without a restart)
• Prometheus /metrics endpoint — agentgate_events_total{action}, agentgate_db_size_bytes, agentgate_uptime_seconds, agentgate_info for Grafana / scrape pipelines
• Gemini CLI hook — agentgate install-gemini-hook writes .gemini/settings.json and translates BeforeTool payloads to the AgentGate event schema
• Webhook HMAC-SHA256 signing — Webhook.secret field; receivers verify with verify_signature(secret, body, header)
• Webhook exponential backoff — 5 attempts at 1, 2, 4, 8, 16s (configurable via max_attempts / base_backoff)
• docs/quickstart.md, tutorial.md, cli-reference.md, security.md — full documentation set, mkdocs-ready
• CI quality workflow — .github/workflows/quality.yml adds ruff + mypy + coverage ≥70% on every PR

Changed

• webhook.deliver() now signs and retries by default; backoff is time.sleep(base * 2^(attempt-1))
• ProxyAddon logs reload count on session done

v0.10.0 — init / mcp / ask-queue / webhooks / diff

[0.10.0] - 2026-08-14

Added

• agentgate init — interactive wizard generating a starter policy.yaml (3 presets: readonly/balanced/strict)
• MCP stdio server (agentgate mcp) — JSON-RPC 2.0 with policy_lookup, audit_recent, audit_count, policy_test_tool
• Ask queue dashboard (/asks + /api/asks/pending + /api/asks/resolve) — UI to approve/deny pending ASK events
• Webhook subscriptions (agentgate webhook add/list/remove/test) — fire external URLs on filtered audit events with retry/backoff
• agentgate policy diff <a.yaml> <b.yaml> — compare two policies: rule-level diff + decision-change detection across canary events
• Fail-closed on missing critical event fields (Bash.command, Read.file, WebFetch.url) — ASK synthetic rule with explicit reason

Fixed

• Rule.matches() now dispatches *_regex keys to re.search and *_glob keys to fnmatch.fnmatch (previously used fnmatch for all keys, causing command_regex rules to silently never match)
• load_policy() now reads default_action from YAML (was reading nonexistent default key, silently always defaulting to allow)
• Dashboard SSE handler rewritten to drop timing-fragile time.sleep(0.5) schema-check loop and unskip the SSE integration test

Tests

171/171 passing (+58 since v0.9.0): +init (9), +rule_matches regression (5), +mcp_server (10), +ask_queue (8), +webhooks (11), +policy_diff (8), +missing-fields (7)

v0.9.0 — 5 borrowed features

Added

• agentgate policy test + policy explain — dry-run events against a policy without side effects. Returns decision + matched rule + raw vs effective action + all candidates considered. Useful for debugging why a rule denied something.
• Enforcement modes (enforce / observe / ci) — AGENTGATE_MODE env var selects. CI mode auto-promotes ASK to DENY for non-interactive runs. Observe mode records decisions but never blocks.
• Unknown-tool fail-closed — unknown_tool_action + known_tools in policy schema. Surfaces MCP tools that aren'''t referenced in any rule.
• Approval provenance — event_provenance() SHA-256 hashes the event at ASK time; replay detects payload tampering with PROVENANCE MISMATCH.
• Hash-chain audit — every event row stores chain_hash = SHA256(prev_hash + own). agentgate audit verify walks the chain offline and returns exit 1 if any row was tampered.
• agentgate audit is now a group with show + verify subcommands.
• 22 new tests (91 → 113 total).

Internal

• Policy.evaluate_explain() returns both raw_action and effective_action so dashboards can show what the policy said vs what the mode allowed.
• Policy.is_known_tool(name) checks all rules for tool references.

v0.8.0 - Helm chart + chart.js + alerts + detect-agents

Highlights

• Helm chart for k8s deployments
• Dashboard time-series chart (chart.js stacked bar with 1h/6h/24h/3d/7d selector)
• agentgate alerts - YAML alert engine with time windows + thresholds
• agentgate detect-agents - auto-detect installed AI agents

Bug fixes

• counts_per_bucket SQL was splitting buckets per microsecond. Now uses CAST(... AS INTEGER).
• since_within returned dict with column indices off-by-one. Now correctly maps to actual events schema.

Tests

• Added tests/test_alerts.py (4 tests)
• Added tests/test_dashboard.py (3 tests)
• 92/92 tests passing

AgentGate v0.6.0 — polish + developer ergonomics

v0.6.0 — polish + developer ergonomics

A grab-bag of improvements that make AgentGate easier to install, debug, lint, and ship.

Highlights

• agentgate doctor — one command prints Python version, deps, optional tools, notification channel config, port availability, and policy validation. The first thing a new user should run.
• agentgate lint policy.yaml — catches duplicate rule IDs, deny rules without a reason, empty match blocks, dead _glob/_regex keys. --strict turns warnings into errors.
• agentgate stats --by-source / --by-rule — break down the audit log by where events came from (claude-code, proxy, manual) or which rule fired.
• /api/events?action=...&source=...&since=...&limit=... — the dashboard's JSON API now accepts filters so CI / monitoring tools can query exactly the rows they want.
• docs/architecture.md — a Mermaid-rendered map of every component, plus sequence diagrams for the deny and ask round-trip flows.
• docs/dashboard.svg — inline-rendered dashboard preview in README.md (works without JavaScript, no external assets).
• Makefile — make install / test / verify / lint / format / build / publish / release / clean / doctor / run-dashboard / run-proxy / run-approval.
• .devcontainer/devcontainer.json — one-click dev environment in GitHub Codespaces or VS Code Remote.
• Windows paths — the file-fallback and approval DB paths now use tempfile.gettempdir() instead of hard-coded /tmp/. Tests updated to use AGENTGATE_ASK_FALLBACK.
• CONTRIBUTING.md — full release flow (bump, build, publish to PyPI, verify install, tag, GitHub release).

Tests

83 → 90 unit tests (+7 for doctor + lint). All 90 pass; 10/10 e2e verify steps still green; CI green on Py 3.12 + 3.13.

Install

uv tool install --upgrade agentgate-firewall
agentgate doctor    # verify your install

AgentGate v0.5.0 — DNS sinkhole + SSE live dashboard + hosted team mode

v0.5.0 — DNS sinkhole + live SSE dashboard + hosted team mode

Three big additions expand AgentGate's scope beyond local-only:

1. DNS sinkhole (python -m agentgate.dns_sinkhole)

Zero-config alternative to the mitmproxy proxy for blocking agent egress:

• Spins up a UDP DNS server on 127.0.0.1:5300 (default)
• Returns 0.0.0.0 for denied domains → connection fails fast
• Forwards allowed domains to your real upstream resolver
• Configure AGENTGATE_POLICY and start; no HTTP_PROXY env vars needed

Why DNS instead of eBPF? eBPF requires Linux + clang + libbpf + sudo. DNS interception works on macOS, Linux, and Windows, with zero native dependencies. The tradeoff: cannot block by URL path (only by domain).

2. Live SSE dashboard (/api/events/stream)

The dashboard now pushes new audit events in real time via Server-Sent Events. The browser opens an EventSource, and the server polls the DB every second for rows newer than the last seen id.

On a deny, the page border flashes red and (with permission) a desktop notification fires. No build tools, no React — vanilla JS embedded in the single HTML page.

3. Hosted team mode (pull-policy, push-events)

For teams that want a central source of truth:

• agentgate pull-policy --out policy.hosted.yaml downloads the canonical policy from your team endpoint
• agentgate push-events --db audit.db uploads new audit rows to the central collector
• Auth via AGENTGATE_HOSTED_TOKEN (bearer token)
• Cursor-based sync — only new rows are uploaded

The hosted protocol is plain HTTP so any backend (FastAPI, Cloudflare Worker, Lambda) can host the policy/event endpoints.

Tests

78 → 83 unit tests. New:

• tests/test_dns.py (6 tests)
• tests/test_dashboard_sse.py (1 end-to-end)
• tests/test_hosted.py (5 tests with in-process HTTP server)

Verify script

Still 10 end-to-end steps; CI runs pytest + e2e on Py 3.12 + 3.13.

AgentGate v0.4.0 — Continue.dev + Telegram + GitHub Actions

v0.4.0 — Continue.dev + Telegram + GitHub Actions

Three new integrations extend AgentGate's reach:

Continue.dev adapter (agentgate install-continue-hook)

Continue.dev reads the same PreToolUse hook format as Claude Code — so this adapter is the same wire format wrapped in a thin .continue/settings.json writer. Tests confirm the same payload works for both.

Telegram notification (AGENTGATE_TELEGRAM_BOT_TOKEN)

Telegram is now the first-priority notification channel when both Telegram creds are set:

• AGENTGATE_TELEGRAM_BOT_TOKEN (from @Botfather)
• AGENTGATE_TELEGRAM_CHAT_ID (chat or group ID)

Channel precedence: Telegram > Slack > file fallback.

GitHub Actions adapter (python -m agentgate.actions_annotate)

A post-step that runs after a coding agent (e.g. anthropics/claude-code-action) finishes in CI. Walks every changed line through AgentGate's policy and:

• Emits ::error file=…,line=…::AgentGate: … annotations (visible in PR checks)
• Posts a single PR review comment summarising denies/asks
• Fails the step if any change is denied

Example workflow:

- uses: anthropics/claude-code-action@…
- name: AgentGate review
  env:
    AGENTGATE_POLICY: ./policy.yaml
    AGENTGATE_DB: ./audit.db
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  run: python -m agentgate.actions_annotate

Tests

71 → 81 unit tests. New:

• tests/test_continue.py (4 tests)
• tests/test_notify.py (7 tests — Slack/Telegram/file fallback)
• tests/test_actions.py (3 tests — git diff parsing)

Verify script

scripts/verify.sh now runs 10 end-to-end steps (up from 8), including the new Continue and Actions adapters.

AgentGate v0.3.0 — CLI refactor + Aider adapter + e2e CI

Changelog

All notable changes to AgentGate are documented here. Dates are ISO 8601.

[0.3.0] — 2026-08-14

Added

• CLI split: cli.py (463 lines) split into 13 sub-modules under src/agentgate/cli/ for easier navigation and contribution.
• Three new policy examples: examples/policy-secure.yaml (deny by default), examples/policy-permissive.yaml (solo dev), examples/policy-team.yaml (shared repo + audit).
• metadata block in policies: optional YAML keys (author, name, version, last_reviewed, description) for compliance audits. agentgate validate renders them and warns if missing.
• docs/policy-reference.md: complete reference for the YAML format, match keys, glob/regex patterns, network policy, and examples.
• agentgate stats --json: machine-readable output for monitoring / Slack bot integration.
• agentgate eval --dry-run: evaluate without writing to the audit DB (useful when iterating on a policy).
• agentgate replay --audit-id N: re-evaluate a stored audit event against a (possibly new) policy. Highlights when the decision would have changed — useful for policy migrations.
• Audit.get(id): new method on the Audit class for the replay command.
• Better error messages:
  • Port collision in proxy, approval-server, dashboard now suggests an alternative free port (--port 8081 etc.).
  • YAML parse errors now point to the offending line/column.
• End-to-end smoke test in CI: scripts/verify.sh is now part of GitHub Actions (in addition to pytest).
• CONTRIBUTING.md: developer guide including a "50 lines to add a new agent adapter" recipe.

Changed

• Policy dataclass gains metadata field and three convenience properties: allowed_domains, denied_domains, require_https.
• All CLI subcommand modules use the delayed main.add_command(cmd) registration pattern to avoid circular imports.

[0.2.0] — 2026-08-14

Added

• Cursor hook adapter (agentgate.cursor_hook, agentgate install-cursor-hook) — supports Cursor's beforeShellExecution, beforeFileEdit, beforeFileRead events.
• evaluate_event() shared between Claude Code and Cursor hooks.
• 5 new tests for the Cursor adapter (53 total).

[0.1.1] — 2026-08-14

Fixed

• README install URL pointed at the placeholder you/agentgate instead of the real repo.

[0.1.0] — 2026-08-14

Initial public release. 48 unit tests, GitHub Actions on Py 3.12 + 3.13.

Day-by-day summary

• Day 1 — Project skeleton + Policy DSL + SQLite audit + CLI (init, eval, audit, stats, validate)
• Day 2 — Claude Code PreToolUse hook + real interception + install-hook / uninstall-hook
• Day 3 — Network egress proxy (mitmproxy add-on) + DNS/domain filtering
• Day 4 — Slack approval webhook + cross-process HTTP server + SQLite-backed approval store
• Day 5 — Dashboard HTTP server + single-page HTML viewer + README

Comparison: project at start vs. end

	Start (Day 0)	End (v0.3.0)
LOC	0	~1300
Tests	0	53
Adaptors	0	2 (Claude Code, Cursor)
Commands	0	13
Release	—	v0.3.0 on PyPI
CI	—	pytest + e2e on Py 3.12 + 3.13

AgentGate v0.2.0 — Cursor hook adapter

v0.2.0 — Cursor hook adapter

This release adds first-class support for Cursor's hooks (beforeShellExecution, beforeFileEdit, beforeFileRead), on top of the v0.1.x Claude Code support.

What's new

• agentgate.cursor_hook — Python module that reads Cursor's hook JSON payload, translates it to AgentGate's event schema, and routes it through the same policy + audit + approval flow as Claude Code.
• agentgate install-cursor-hook — writes .cursor/hooks.json for you, pointing at the project venv's Python.
• Shared evaluate_event() core — both Claude Code and Cursor hooks funnel through the same policy.evaluate → audit.record → notify_ask → wait pipeline. Adding a third adapter is now ~50 lines.
• 53 unit tests (up from 48), including a real-subprocess test for the Cursor hook.
• scripts/verify.sh now exercises 7 steps (up from 6), adding the Cursor hook end-to-end.

Installing for Cursor

cd your-project
agentgate install-cursor-hook \
  --policy ./policy.yaml \
  --db ./audit.db \
  --target .
# Restart Cursor to pick up the new hooks.

Caveats

• Cursor's hook schema isn't part of the public docs yet. The current mapping is inferred from community examples; if a future Cursor version renames fields, only src/agentgate/cursor_hook.py:_CURSOR_TO_AGENTGATE needs updating.
• The hook subprocess reads stdin (Cursor's payload) or AGENTGATE_PAYLOAD_FILE (for tests).

No breaking changes

All v0.1.x flags and config files still work. Same SQLite schema, same policy.yaml format, same Slack fallback.