v0.6.0

applygate checks every command a coding agent is about to run against your Terraform, OpenTofu and cloud infrastructure, and answers allow, ask or block with a reason the agent can act on. It runs locally as the agent's hook, with no model in the decision and no network calls by default.

What's new in v0.6.0

• An allow-list in protected environments. Only commands applygate fully understands (known programs, in shapes that run no other program) run without a prompt. Loops, bash -c, python3 -c, unknown programs and anything it cannot resolve get an ask. strict_shapes: false in your user config turns this off.
• Boundary checks. applygate doctor --boundary reports what protects you when the hook is wrong, as a level from L0 (the hook only) to L3: a managed install, credentials that cannot change production without a person (applygate doctor --creds asks AWS, Google Cloud, Azure and your clusters), a host sandbox and a reviewed apply path.
• Managed install. sudo applygate install --managed --exclusive puts the binary and its config where the agent's user cannot change them. It is the only setup where self-protection is a guarantee; without it, self-protection is best-effort.
• Repository config trust. A .applygate.yaml is read only after a person approves it with applygate trust, and it can only add protection; loosening settings come from your user config.
• MCP tools. In Claude Code and Codex, calls to known infrastructure MCP servers are judged as the command they are equivalent to.
• Tested live on Claude Code 2.1.314 and 2.1.322 (the ask prompt now shows in auto mode, Claude Code's default) and on Codex 0.166.0. applygate doctor tells you whether Codex will run the hook after /hooks.
• Security review. 11 rounds of red-team review before this release. Every finding is fixed and kept as a test: 918 reproductions and controls, plus an effects test in CI that runs generated commands under bash, zsh, dash and sh.

Upgrading from an earlier release

Several changes alter behaviour: reinstall the hooks (and re-trust the Codex hook with /hooks), trust your repository configs, and note that one-time approvals are now off by default. The full list is in docs/upgrading.md.

Install

brew install Flurit/tap/applygate

Or use the installer, which verifies the cosign signature, go install, or the GitHub Action Flurit/applygate@v0.6.0. Checksums are signed keylessly with cosign and each archive has an SBOM and a build-provenance attestation; how to verify them is in docs/install.md.

Every change: CHANGELOG.md.

Changelog

• 146bcb9 Allow-list stage 1: writers and output-capable programs by exact option
• 96d15f5 Allow-list stage 2: curl, wget, zip, yq, rg, printf, tflint, actionlint by exact option
• d324d4c Allow-list stage 3: positive redirect and cd grammars in plain commands
• 04e3dce Allow-list stage 4: terraform, aws, az, gcloud, kubectl, helm, vault by subcommand and option
• db1e258 Allow-list stage 6: git by subcommand and option list, docker/gh/trivy/opa and eight more programs, outputOpts next to the entries
• b362222 Allow-list stage 7: one table of write rules, cloud CLIs by option, gcloud and az credential audit
• e96ae38 Allow-list stages 3 to 5: grammars, verbs and an effects oracle
• edd513a Boundary contract: doctor --boundary, assurance levels L0-L3, and the README promise restated
• 7323fcf Build and vet on Windows again
• 62f1c80 CI: give the race-detector test run 25 minutes (the harness replays 790 scenarios in two formats and reached the 10-minute default on macOS)
• d18b0dd Conformance test: gunzip is a script that runs gzip, so gzip is not a canary for it
• 9ea34e6 Conformance test: temporary files go to their own directory (yq writes one per run); correct which programs CI runs
• a6f33b2 Docs: label what is unverified, fix the IAM Identity Center MFA guidance, 19 audited actions
• 76fd792 Effects oracle: cloud effects, saved plans, generated spellings, CI gate; fix a here-document backslash bypass it found
• 2ef75a8 Enable the cross-directory rule: unseen code is judged at the most protected tier under the root
• baaf60d Go 1.26.11 for net/http GO-2026-6859
• 8d22472 Guard hook files at the git root and the session directory; removals count only what they can weaken
• ceeaabd Guard the repository's hook files when its config is untrusted
• 9f98aa1 Hold the latency target on a normal build
• 31468e0 Loosen the log test's time bound for the race detector
• ff1419f Merge main into allow-list stage 1
• ae09ee3 Merge main into claude/prepare-v0.6.0
• 29d36e2 Merge main into fix/round-6
• 6b5a68b Oracle: skip the zsh-only sanity atoms where zsh is not installed (Ubuntu CI)
• 2e50ad3 Pre-launch: git rewrites ask at configured roots, capability inventory, docs pass
• 64555a2 R2-2: managed install, binary pin, more guard paths, docs
• 360636b R2-3: analyzer and tier fixes from red-team round 2
• c22b63f R2-4: MCP and model-judge fixes from red-team round 2
• 6e5d8ce R2-5: data, supply-chain and docs fixes from red-team round 2
• b877bf7 R7-2 option A: applygate doctor --creds and the credentials guide
• ba70595 Reassessment of the design after round 11
• 6917598 Reassessment root fixes: unknown values carry a reason, a positive rule for Terraform configuration, recovered panics fail closed
• 7e69cd3 Red-team round 10 report: not releasable
• 87e1866 Red-team round 11 report: not releasable
• 82b9ce9 Red-team round 3 report: not releasable (4 critical, 36 findings)
• 2af9684 Red-team round 4 report: not releasable (19 critical, 82 findings)
• c8b0b15 Red-team round 5 report: not releasable
• 7f12fd5 Red-team round 6 report: not releasable
• 0bedf46 Red-team round 7 report: not releasable
• a84ed4e Red-team round 8 report: not releasable
• 469c2d8 Red-team round 9 report: not releasable
• 3072d13 Round-10 fixes by family: per-invocation followed, unmodelled shell semantics, shape options, state surgery, judge and scans
• 3b9333a Round-11 fixes by family: state files by rule, zsh semantics, unreported directory, runner environments, buckets, options, plan gate, judge and logs
• eb70a86 Round-3 fixes: trust, managed mode, shell start-up and lookup, HCL backends
• 7f61b84 Round-4 fixes: managed guarantee, strict shapes, tier criticals
• 17aecac Round-5 fixes: exact shapes, repository git state, bounded criticals
• c844936 Round-6 fixes, R6-2: strict shapes check what programs read
• 744662f Round-6 fixes, milestone R6-1: bounds, managed judge, guards, directories
• 0376671 Round-7 fix plan: the R7-2 backstop design
• f0dbbcb Round-7 fixes, R7-1: a step written earlier makes a terraform call unknown
• 474fbec Round-7 fixes, R7-1: ask git and the HCL parser rather than imitate them
• b0fed97 Round-7 fixes, R7-1: attack pack, measurement and docs
• 929117f Round-7 fixes, R7-1: shapes, zsh, containers, find, terragrunt units, guard
• 2da8052 Round-7 fixes, R7-1: the managed judge and host out of the user's reach
• a4b2f4e Round-7 fixes, R7-1: unresolved tier signals are unknown, not absent
• 151151e Round-7 fixes, R7-3: the high findings
• f81c35a Round-8 fixes: rules for the criticals and highs
• 56cc762 Round-9 fixes: rules for the criticals and highs
• 600c2d4 Treat /dev/null as an empty credentials file, not an unreadable one
• f9817d5 Treat network requests with a body or a non-GET method as writes
• 5f10e84 analyzer: exact or unresolved (milestone 2, review findings C1-C14, H1)
• cc397c8 build(deps): bump github.com/hashicorp/hcl/v2 from 2.24.0 to 2.25.0
• aea4988 build(deps): bump github.com/z...

v0.5.0

Changelog

• 7eb8f26 approve: let a person allow one asked call on agents that cannot ask
• 7332680 site: count visits and button clicks with Umami; fix two stale README links
• 9224c17 site: search and share text for all supported agents; structured data

v0.4.0

Changelog

• d12573c Add hook adapters for Cursor, Copilot CLI, Gemini CLI, Windsurf, Devin, OpenCode and Cline
• c9ac9c4 Claude Code plugin: find or fetch the applygate binary instead of needing it on PATH
• d3285ef Log MCP tool calls without judging them
• 1533826 harness: run.py reads Cursor's exit 2 as a block, as Cursor's docs say

v0.3.2

Changelog

• 54dba05 Plan gate: flag code execution and exposure only where the plan acts
• ecce092 review: false-positive study of the plan gate on real plans
• 48edb60 review: keep the per-plan JSONL results out of the repository

v0.3.1

Changelog

• 6e0aed5 Add a project page published with GitHub Pages
• eae1836 README: add the Homebrew tap to the install options
• ff8231a README: drop the v1 pack counts, which change as scenarios are added
• 1e1d992 README: lead with the demo, a one-minute start and the benchmark
• 959fa57 Record the Codex 0.166.0 hook payload capture and the command-directory cell
• 97e8845 Record the live T3.10 confirmation on Codex 0.166.0
• d8b9f92 Record the replay of the Codex 0.166.0 payload shape through the hook
• ea14b4b Report the module version for go install builds; record macOS host evidence
• 9c76774 Unwrap dotenvx, sops and secrets runners without --
• f7840a3 Update the T3.10 status after the live confirmation
• 70c4091 packaging: draft Homebrew formula for applygate (unpublished)

v0.3.0

Changelog

• 9176986 Add applygate apply: the human door with typed confirmation
• 88a20fc Add applygate suggest: a proposed config from the observe-mode log
• 83062fb Add opt-in telemetry: anonymous verdict counts, off by default
• a6de38b Merge main (CI door) into human-apply; keep both doors in README, changelog and roadmap
• 4c58085 Merge main (applygate suggest) into telemetry; Go 1.26.10
• 2d6a928 Plan gate in CI: GitHub Action, portable script, Terragrunt hook recipe

v0.2.0

Changelog

• 0610aca Host capability matrix; fail closed on an unknown command directory; user-scope hooks
• 3f2e683 Rename seatbelt to applygate

v0.1.4

Changelog

• adc3bb4 Add the Contributor Covenant 2.1 code of conduct
• fe1c16d Add the agent-driven observe-mode trial harness
• bd1ac4c Allow file-only interpreter edits; stop the prod hint matching non-prod
• bf8ee24 Commit only the trial's evidence, keep raw output out of git
• 5c3ba51 Drop the duplicate security link from the issue chooser
• b7e52b1 Harden the file-only interpreter check after review
• 9b9bbfa Judge a mismatched plan by the plan workspace's tier
• 149ab67 Merge PR #23: docs: point install and verify steps at v0.1.3
• 8233eb6 Merge PR #24: Tidy the repository for open-source readers
• 82d345d Merge PR #25: Add the Contributor Covenant 2.1 code of conduct
• 4318353 Merge PR #26: bump actions/checkout to v7.0.1 and actions/setup-go to v7.0.0
• 6e92e22 Merge PR #27: Drop the duplicate security link from the issue chooser
• 68d2f0b Merge PR #28: Report the v0 guard comparison in aggregate
• d05abc8 Point the acceptance note at PR #33
• 8f5ef6c Record the agent-driven observe-mode trial results
• a142c53 Record the captured Codex 0.165.0 hook input
• 092f345 Report the v0 guard comparison in aggregate
• 99673d8 Resolve Codex commands against their workdir when the hook sends one
• 53fd8fe Tidy the repository for open-source readers
• d59a867 build(deps): bump the actions group with 2 updates

v0.1.3

Changelog

• ab46f38 Drop a committed .pyc and ignore Python bytecode
• 08a3c1b Merge PR #19: Prod name hints on backend values (both backend paths)
• 2864c3d Merge PR #20: unknown-wrapper backstop
• 068ab79 Merge PR #21: harness/run.py: a seatbelt fail-closed error or missing reason is never a pass
• f1a2535 Merge PR #22: Read unquoted -backend-config values; test D80's case without a backend type
• 07c6f88 Merge origin/main (PR #19) into unknown-wrapper-backstop
• 8f75da6 config/policy: prod name hints on backend values, on both backend paths
• a791893 docs/review: document the backstop; corpus re-run finds no text-mention FPs
• b4675fc harness/run.py: a seatbelt fail-closed error or missing reason is never a pass
• f0b5233 preflight/harness: read unquoted -backend-config values; test D80 without a backend type
• e4aef0a shell: backstop for unrecognized wrappers; env runners; wrappers config

v0.1.2

Changelog

• 48a1d26 Merge PR #16: docs: point install and verify steps at v0.1.1
• 593d6ff Merge PR #17: Open-source corpus trial; fix credential-wrapper bypass and false positives it found
• e55ac0f Merge PR #18: Policy: init -reconfigure -backend-config is read-only; ask on AWS SDK code
• 8114d9b docs/review: open-source corpus trial on 5 public Terraform repositories
• 50eb142 policy: init -reconfigure -backend-config is read-only; ask on AWS SDK code
• 93db560 review/oss-corpus: keep local work-directory paths out of results
• b5db759 shell/classify: unwrap credential runners; fix FPs found in the corpus trial