v0.6.0

applygate checks every command a coding agent is about to run against your Terraform, OpenTofu and cloud infrastructure, and answers allow, ask or block with a reason the agent can act on. It runs locally as the agent's hook, with no model in the decision and no network calls by default.

What's new in v0.6.0

• An allow-list in protected environments. Only commands applygate fully understands (known programs, in shapes that run no other program) run without a prompt. Loops, bash -c, python3 -c, unknown programs and anything it cannot resolve get an ask. strict_shapes: false in your user config turns this off.
• Boundary checks. applygate doctor --boundary reports what protects you when the hook is wrong, as a level from L0 (the hook only) to L3: a managed install, credentials that cannot change production without a person (applygate doctor --creds asks AWS, Google Cloud, Azure and your clusters), a host sandbox and a reviewed apply path.
• Managed install. sudo applygate install --managed --exclusive puts the binary and its config where the agent's user cannot change them. It is the only setup where self-protection is a guarantee; without it, self-protection is best-effort.
• Repository config trust. A .applygate.yaml is read only after a person approves it with applygate trust, and it can only add protection; loosening settings come from your user config.
• MCP tools. In Claude Code and Codex, calls to known infrastructure MCP servers are judged as the command they are equivalent to.
• Tested live on Claude Code 2.1.314 and 2.1.322 (the ask prompt now shows in auto mode, Claude Code's default) and on Codex 0.166.0. applygate doctor tells you whether Codex will run the hook after /hooks.
• Security review. 11 rounds of red-team review before this release. Every finding is fixed and kept as a test: 918 reproductions and controls, plus an effects test in CI that runs generated commands under bash, zsh, dash and sh.

Upgrading from an earlier release

Several changes alter behaviour: reinstall the hooks (and re-trust the Codex hook with /hooks), trust your repository configs, and note that one-time approvals are now off by default. The full list is in docs/upgrading.md.

Install

brew install Flurit/tap/applygate

Or use the installer, which verifies the cosign signature, go install, or the GitHub Action Flurit/applygate@v0.6.0. Checksums are signed keylessly with cosign and each archive has an SBOM and a build-provenance attestation; how to verify them is in docs/install.md.

Every change: CHANGELOG.md.

Changelog

• 146bcb9 Allow-list stage 1: writers and output-capable programs by exact option
• 96d15f5 Allow-list stage 2: curl, wget, zip, yq, rg, printf, tflint, actionlint by exact option
• d324d4c Allow-list stage 3: positive redirect and cd grammars in plain commands
• 04e3dce Allow-list stage 4: terraform, aws, az, gcloud, kubectl, helm, vault by subcommand and option
• db1e258 Allow-list stage 6: git by subcommand and option list, docker/gh/trivy/opa and eight more programs, outputOpts next to the entries
• b362222 Allow-list stage 7: one table of write rules, cloud CLIs by option, gcloud and az credential audit
• e96ae38 Allow-list stages 3 to 5: grammars, verbs and an effects oracle
• edd513a Boundary contract: doctor --boundary, assurance levels L0-L3, and the README promise restated
• 7323fcf Build and vet on Windows again
• 62f1c80 CI: give the race-detector test run 25 minutes (the harness replays 790 scenarios in two formats and reached the 10-minute default on macOS)
• d18b0dd Conformance test: gunzip is a script that runs gzip, so gzip is not a canary for it
• 9ea34e6 Conformance test: temporary files go to their own directory (yq writes one per run); correct which programs CI runs
• a6f33b2 Docs: label what is unverified, fix the IAM Identity Center MFA guidance, 19 audited actions
• 76fd792 Effects oracle: cloud effects, saved plans, generated spellings, CI gate; fix a here-document backslash bypass it found
• 2ef75a8 Enable the cross-directory rule: unseen code is judged at the most protected tier under the root
• baaf60d Go 1.26.11 for net/http GO-2026-6859
• 8d22472 Guard hook files at the git root and the session directory; removals count only what they can weaken
• ceeaabd Guard the repository's hook files when its config is untrusted
• 9f98aa1 Hold the latency target on a normal build
• 31468e0 Loosen the log test's time bound for the race detector
• ff1419f Merge main into allow-list stage 1
• ae09ee3 Merge main into claude/prepare-v0.6.0
• 29d36e2 Merge main into fix/round-6
• 6b5a68b Oracle: skip the zsh-only sanity atoms where zsh is not installed (Ubuntu CI)
• 2e50ad3 Pre-launch: git rewrites ask at configured roots, capability inventory, docs pass
• 64555a2 R2-2: managed install, binary pin, more guard paths, docs
• 360636b R2-3: analyzer and tier fixes from red-team round 2
• c22b63f R2-4: MCP and model-judge fixes from red-team round 2
• 6e5d8ce R2-5: data, supply-chain and docs fixes from red-team round 2
• b877bf7 R7-2 option A: applygate doctor --creds and the credentials guide
• ba70595 Reassessment of the design after round 11
• 6917598 Reassessment root fixes: unknown values carry a reason, a positive rule for Terraform configuration, recovered panics fail closed
• 7e69cd3 Red-team round 10 report: not releasable
• 87e1866 Red-team round 11 report: not releasable
• 82b9ce9 Red-team round 3 report: not releasable (4 critical, 36 findings)
• 2af9684 Red-team round 4 report: not releasable (19 critical, 82 findings)
• c8b0b15 Red-team round 5 report: not releasable
• 7f12fd5 Red-team round 6 report: not releasable
• 0bedf46 Red-team round 7 report: not releasable
• a84ed4e Red-team round 8 report: not releasable
• 469c2d8 Red-team round 9 report: not releasable
• 3072d13 Round-10 fixes by family: per-invocation followed, unmodelled shell semantics, shape options, state surgery, judge and scans
• 3b9333a Round-11 fixes by family: state files by rule, zsh semantics, unreported directory, runner environments, buckets, options, plan gate, judge and logs
• eb70a86 Round-3 fixes: trust, managed mode, shell start-up and lookup, HCL backends
• 7f61b84 Round-4 fixes: managed guarantee, strict shapes, tier criticals
• 17aecac Round-5 fixes: exact shapes, repository git state, bounded criticals
• c844936 Round-6 fixes, R6-2: strict shapes check what programs read
• 744662f Round-6 fixes, milestone R6-1: bounds, managed judge, guards, directories
• 0376671 Round-7 fix plan: the R7-2 backstop design
• f0dbbcb Round-7 fixes, R7-1: a step written earlier makes a terraform call unknown
• 474fbec Round-7 fixes, R7-1: ask git and the HCL parser rather than imitate them
• b0fed97 Round-7 fixes, R7-1: attack pack, measurement and docs
• 929117f Round-7 fixes, R7-1: shapes, zsh, containers, find, terragrunt units, guard
• 2da8052 Round-7 fixes, R7-1: the managed judge and host out of the user's reach
• a4b2f4e Round-7 fixes, R7-1: unresolved tier signals are unknown, not absent
• 151151e Round-7 fixes, R7-3: the high findings
• f81c35a Round-8 fixes: rules for the criticals and highs
• 56cc762 Round-9 fixes: rules for the criticals and highs
• 600c2d4 Treat /dev/null as an empty credentials file, not an unreadable one
• f9817d5 Treat network requests with a body or a non-GET method as writes
• 5f10e84 analyzer: exact or unresolved (milestone 2, review findings C1-C14, H1)
• cc397c8 build(deps): bump github.com/hashicorp/hcl/v2 from 2.24.0 to 2.25.0
• aea4988 build(deps): bump github.com/zclconf/go-cty from 1.19.0 to 1.20.0
• e4f5098 build(deps): bump golang.org/x/text from 0.39.0 to 0.43.0
• b31f7d6 build(deps): bump sigstore/cosign-installer
• 76da611 default-deny near guard files and hook hardening (round 2, R2-1)
• 482f268 experiment: compare Sonnet 5.5 and Opus 5.5 as the judge
• bcedf22 experiment: decision models answer facts, the tier table decides
• 2ba6e4d experiment: decision models scored on the fifth held-out set
• e27eedf experiment: escalate-only model judge for calls the rules do not recognize
• a76cb0a experiment: fifth held-out set from a new independent red-team agent
• 93e468d experiment: fourth held-out set from a new independent red-team agent
• 85a36d7 experiment: held-out judge set written by an independent red-team agent
• de87cef experiment: judge prompt v5 and a known-safe filter
• b23fe24 experiment: judge prompt v6, standard tier follows applygate's table
• ddebddb experiment: record the rewritten fifth-set commit and the RW06 rescoring
• fee8e5f experiment: score Haiku, Sonnet and Opus on the held-out set
• eb1f6b6 experiment: score prompt v5 and the known-safe filter on a second held-out set
• f8304de experiment: score prompt v6 on a third held-out set
• b3b06d4 experiment: second held-out set from a new independent red-team agent
• d036876 experiment: send every file write to the judge
• 2440ddc experiment: third held-out set from a new independent red-team agent
• 20a2128 fix: every tool reaches the hook, configs only tighten, plans written in the same command
• 122de7b guard: canonical guard paths, identity-based tampering, approvals off, apply without test flags
• 23f907a hosts, CI, supply chain and docs (milestone 5, review findings I1-I6, J1-J10)
• 368a61e judge, MCP, secrets, failure handling (milestone 4, review A13, F1-F12, G1, G2, H2)
• 9f5eebf judge: decision-model adapters report the provider's error message
• 137fca2 judge: decision-model adapters; Jev measured on the fourth held-out set
• 596e1fa judge: gpt-6-luna measured through the Decisions API adapter
• c606854 judge: measure Gemini 3.8 Flash through Google's compatible endpoint
• 0240e9a judge: measure the default endpoint live
• 6e379f3 judge: no default model; the docs compare the options
• e6f091c judge: opt-in model judge for calls the rules do not recognize
• bbf131b judge: prompt v7 measured on a fourth held-out set; credential reads reach the judge
• e03bd4d mcp: judge calls to known infrastructure MCP tools as the command they run
• 8863db6 measure strict shapes (workstream 9); builtins keep case; cache symlinks
• c8242d4 preflight: prefer the real git on macOS, keep TMPDIR, 4 s budget for the lock-file check
• 729434e review: round-2 fix plan and failing tests for every reproduced finding (R2-0)
• fa69a4f review: the model judge live in headless Claude Code
• 1be4605 review: v0.6.0 pre-release code and architecture review, and the fix plan
• c0f29b5 review: v0.6.0 red-team round 2 (blind, six reviewers): not releasable
• a02107f shell: name an unknown word's cause lazily, not at every nesting level
• 41bacc0 spec-alignment: list the hook-rewrite class
• c26359d tiers and plan gate (milestone 3, review findings D4-D8, E2-E5)
• 65c8bb2 tiers: Kubernetes contexts, GCP projects and Azure subscriptions pick the environment
• 0dd29a3 v0.6.0 live re-test: Codex hook trust in doctor, ask prompts in Claude Code's auto mode
• a621126 wip r2-2 trust
• a001de6 wip r2-2: nested agents, tmux, packages, PATH targets

What's Changed

• docs: record the v0.5.0 release check; sync Homebrew; pin the plugin by @blissfulldev in #75
• mcp: judge calls to known infrastructure MCP tools as the command they run by @blissfulldev in #76
• tiers: Kubernetes contexts, GCP projects and Azure subscriptions pick the environment by @blissfulldev in #77
• judge: opt-in model judge for calls the rules do not recognize by @blissfulldev in #78
• judge: measure the default endpoint, Gemini, Jev and gpt-6-luna live by @blissfulldev in #79
• experiment: decision models with fact questions, and a fifth held-out set by @blissfulldev in #80
• judge: no default model; docs compare the options by @blissfulldev in #81
• test: every v0.6.0 review finding as a failing test (milestone 0) by @blissfulldev in #82
• fix: milestone 1 of the v0.6.0 review: self-protection by @blissfulldev in #83
• fix: milestone 2 of the v0.6.0 review: exact-or-unresolved shell analysis by @blissfulldev in #84
• fix: milestone 3 of the v0.6.0 review: tier resolution and the plan gate by @blissfulldev in #85
• fix: milestone 4 of the v0.6.0 review: judge, MCP, secrets, failure handling by @blissfulldev in #86
• fix: milestone 5 of the v0.6.0 review: hosts, CI, supply chain, docs by @blissfulldev in #87
• review: v0.6.0 red-team round 2, fix plan, failing tests by @blissfulldev in #88
• fix: round 2, R2-1: default-deny near guard files, hook hardening by @blissfulldev in #89
• R2-2: repository-config trust, managed install, nested agents, binary pin by @blissfulldev in #90
• R2-3: analyzer and tier fixes from red-team round 2 by @blissfulldev in #91
• R2-4: MCP and model-judge fixes from red-team round 2 by @blissfulldev in #92
• R2-5: data, supply-chain and docs fixes from red-team round 2 by @blissfulldev in #93
• Red-team round 3 report: not releasable (4 critical) by @blissfulldev in #94
• Round-3 fixes: trust, managed mode, shell start-up and lookup, HCL backends by @blissfulldev in #95
• Red-team round 4 report: not releasable (19 critical) by @blissfulldev in #96
• Round-4 fixes: managed guarantee, strict shapes, tier criticals by @blissfulldev in #97
• Red-team round 5 report: not releasable by @blissfulldev in #98
• Round-5 fixes: exact shapes, repository git state, bounded criticals by @blissfulldev in #99
• Red-team round 6 report: not releasable by @blissfulldev in #101
• Round-6 fixes, R6-2: strict shapes check what programs read by @blissfulldev in #103
• Build and vet on Windows again by @blissfulldev in #100
• Round-6 fixes, milestone R6-1: bounds, managed judge, guards, directories by @blissfulldev in #102
• Red-team round 7 report: not releasable by @blissfulldev in #107
• Round-7 fixes: R7-1 rules and R7-2 credential audit by @blissfulldev in #108
• Round-7 fixes, R7-3: the high findings by @blissfulldev in #109
• Red-team round 8 report: not releasable by @blissfulldev in #110
• Round-8 fixes: rules for the criticals and highs by @blissfulldev in #111
• Red-team round 9 report: not releasable (17 critical) by @blissfulldev in #112
• Round-9 fixes: rules for the criticals and highs by @blissfulldev in #113
• Enable the cross-directory rule by @blissfulldev in #114
• Red-team round 10 report: not releasable by @blissfulldev in #115
• Round-10 fixes by family by @blissfulldev in #116
• Red-team round 11 report: not releasable by @blissfulldev in #117
• Round-11 fixes by family by @blissfulldev in #118
• Reassessment: can the design carry the promise? by @blissfulldev in #119
• Treat network requests with a body or a non-GET method as writes by @blissfulldev in #120
• Allow-list stage 1: writers and output-capable programs by exact option by @blissfulldev in #121
• Allow-list stage 2: curl, wget, zip, yq, rg, printf, tflint, actionlint by exact option by @blissfulldev in #122
• Allow-list stages 3 to 5: grammars, cloud and terraform verbs, effects oracle (found a bypass) by @blissfulldev in #123
• Boundary contract: doctor --boundary and the promise restated by @blissfulldev in #124
• Docs: label what is unverified, fix IAM Identity Center MFA guidance by @blissfulldev in #125
• Reassessment root fixes: unknown reasons, positive Terraform rule, panics fail closed by @blissfulldev in #126
• Effects oracle: cloud, saved plans, generated spellings, CI gate (+ here-document bypass fix) by @blissfulldev in #127
• Allow-list stage 6: git per subcommand, docker/gh/trivy/opa and others by @blissfulldev in #128
• build(deps): bump github.com/hashicorp/hcl/v2 from 2.24.0 to 2.25.0 by @dependabot[bot] in #104
• build(deps): bump golang.org/x/text from 0.39.0 to 0.43.0 by @dependabot[bot] in #106
• Allow-list stage 7: one table of write rules, cloud CLIs by option, gcloud and az credential audit by @blissfulldev in #129
• Guard the repository's hook files when its config is untrusted by @blissfulldev in #130
• Guard hook files at the git root and the session directory; removals count only what they can weaken by @blissfulldev in #131
• Pre-launch: git rewrites ask at configured roots, capability inventory, docs pass by @blissfulldev in #132
• v0.6.0 live re-test: Codex hook trust in doctor, ask prompts in Claude Code's auto mode by @blissfulldev in #135
• build(deps): bump github.com/zclconf/go-cty from 1.19.0 to 1.20.0 by @dependabot[bot] in #133
• build(deps): bump sigstore/cosign-installer from 4.1.2 to 4.1.3 in the actions group across 1 directory by @dependabot[bot] in #134
• docs: prepare v0.6.0 by @blissfulldev in #136

Full Changelog: v0.5.0...v0.6.0