v0.1.10: fix npm wrapper race condition

Fixes ETXTBSY error when running warden via npm.

v0.1.9: Docker test fix, honest landing page

What's changed

Fixes

• Docker integration test: Fixed TestDockerBlocksUngrantedRead — the test was passing the test binary as the proxy bridge instead of the real warden binary. All 256 tests pass.
• Landing page: Removed all unverified attack-simulation numbers. Replaced with six verifiable guarantees backed by the escape test suite.
• Backend statuses: Linux and Windows verified, macOS code-complete.

Platform status

Platform	Status
Linux (amd64/arm64)	Verified
Windows (amd64)	Verified
macOS (amd64/arm64)	Code-complete — verification pending

Binaries

All statically linked Go executables. Check SHA256SUMS for integrity.

v0.1.7

Changes

Sandbox error messages

• Unified fail-closed error messages across all backends (Windows, Linux, macOS, Docker)
• Added shared sandboxerr.RefuseToRun type with consistent 'fails closed by design' framing
• CLI prints refusal messages directly without prefix for better readability
• Added regression test ensuring 'fails closed by design' cannot be silently removed

Landing page

• Added Proof section with attack simulation results (Windows AppContainer backend)
• Honesty disclaimer noting internal-only test results, not yet independently audited

v0.1.6

Full Changelog: v0.1.5...v0.1.6

v0.1.5

Full Changelog: v0.1.4...v0.1.5

v0.1.4

Full Changelog: v0.1.3...v0.1.4

Full Changelog: v0.1.3...v0.1.4

v0.1.3

warden-sandbox-cli v0.1.3

Highlights

• Windows: real ETW auditing, fail-closed. Each run starts a real-time Kernel-File/Kernel-Network ETW trace session scoped to the sandboxed process tree and maps Kernel-File events into the JSONL audit log. If the audit session cannot start, warden run refuses to run (the security gate).
• Windows CI. A windows-latest job runs the AppContainer/WFP/ETW escape and lifecycle tests elevated, instead of skipping them.
• Audit escape test. Asserts a blocked network request lands in the audit log as an allowed=false event.
• Docs truth-sync. Windows backends documented as Ready with elevation (WFP/ETW require admin) and audit-visibility caveats.
• npm wrapper fix. bin/warden had the wrong file mode, so npm dropped the warden command on 0.1.0–0.1.2 installs. Fixed here — 0.1.3 ships a working warden bin.

Binaries

The warden-sandbox-cli npm package downloads the matching binary below on first run. Verify checksums against SHA256SUMS.

Install

npm install -g warden-sandbox-cli