Python v0.1.2

tenantguard-cli 0.1.2: expanded PyPI documentation (feature parity with sibling packages), added Sourav Nandy as co-author. Docs-only, no Go binary change.

Python v0.1.1

tenantguard-cli Python package release via PyPI Trusted Publishing.

v0.1.1

Changelog

• b4246a6 Add TA15: channel_instances reload_strategy blast-radius check
• 2625e5c Add TA16: extend SSRF audit to LLM provider connections (goclaw#1430)
• 3c07c81 TA14: add backend_isolation_mode so stateless browser backends stop scanning clean by omission
• 4830c8f ci: build golangci-lint from source to match Go 1.26 toolchain
• 1ac4583 ci: install golangci-lint v2 directly via go install, bypass action's goinstall path bug
• 6888fd7 ci: pin golangci-lint to v2.12.2 (v2) so goinstall resolves the v2 module path
• 9c78ec6 npm: add npx/npm-installable CLI package, fetch binaries at prepack time (not committed to git)

v0.1.0

Changelog

• 2463b00 Add README with real, reproducible benchmarks; humanize prose, strip em dashes
• 1b53c70 Add TA06: cron creator identity capture check
• c576eb9 Add TA07: sandbox container-privilege hardening rule
• d03be3f Add TA08: credential/OAuth token storage encryption declaration check
• 4f1c247 Add TA09: sandbox fail-closed posture declaration check
• 2763bdb Add TA10: per-agent config-override declaration completeness check
• 023989c Add TA11: channel/session cross-tenant identity-sharing rule
• 5d79ec9 Add TA12: owner/sysadmin recovery guarantee rule
• 16cae51 Add TA13: MCP/CLI bridge context integrity check
• c0b950a Add TA14: per-agent resource (browser/container profile) isolation
• ebe7b09 Add scoped_per_tenant declarative signal to TA01
• 25b7ef9 Correct TA06 README claim: goclaw#1129 is an open PR, not merged
• dd63227 Document the DNS-rebinding/TOCTOU limitation in TA02's finding text
• 26a9edc Extend TA02: real CIDR + hostname resolution, pinned-IP validation, MCP host allowlist, goclaw env adapter
• 7363ccb Extend TA04 to detect allow_chain_exec credential-chain leakage
• e0d7b76 Fix TA07 rego comments: tmpfs/cap_add finding is goclaw#524 only
• 221faaa Fix TA11 SARIF rule declaration and cover it in demo + tests
• 655e92f Initial TenantGuard v0.1: tenant-isolation scanner for self-hosted multi-agent platforms
• 3df03cf Merge TA06: cron job creator identity capture/replay check
• 5662096 Merge TA07: sandbox container-privilege hardening check
• 88c8e80 Merge TA09: sandbox fail-closed posture check
• d8b2a38 Merge TA10: per-agent config-override declaration check
• a18d4ce Merge TA11: channel/session cross-tenant identity-sharing check
• 93b59fb Merge TA12: owner/sysadmin recovery guarantees check
• 5b3d2c2 Merge TA13: MCP/CLI bridge context integrity (HMAC) check
• c9b7ee8 Merge TA14: per-agent resource isolation (browser/container profiles) check
• 6d97c67 Merge remote-tracking branch 'origin/fix/ta01-broaden-tenant-scoping'
• c638101 Merge remote-tracking branch 'origin/fix/ta02-mcp-url-validation-cluster'
• 506b7c5 Merge remote-tracking branch 'origin/fix/ta04-allow-chain-exec-leakage'
• 91990bf Merge remote-tracking branch 'origin/fix/ta08-credential-oauth-encryption'
• 2c9a064 Merge remote-tracking branch 'origin/main'
• 798f8b0 Name goclaw#1033 explicitly in the TA04 description string
• bb1d0ba Pin CI/CD supply chain: commit-SHA-pin all third-party Actions, add version input
• bd8e0af release: disable Homebrew publisher until tap repo exists
• 91ed465 security: require explicit action version pin, add CODEOWNERS