Repository navigation
Releases: SVGreg/surfaceguard
Releases · SVGreg/surfaceguard
Release list
v0.6.3
0.6.3 (2026-10-07)
Bug Fixes
- hooks: gate builtin-named local skills, reject path-like names, fail closed on errors (#387) (891db50)
- rules: an all-composite reports every first-branch match, so suppress is per line (#403) (e5ef4fd)
- rules: narrow SG-SEC-001 — "Local Storage" counts only in path form (#393) (567e04b)
- rules: SG-INJ-011 tells a device-code login from ClickFix by where the text goes (#402) (89977f4)
- skill: reject named pipes and other non-regular files instead of blocking on them (#397) (2dbc63e)
v0.6.2
v0.6.1
0.6.1 (2026-10-01)
Features
- rules: add SG-MCP-002 — MCP tool preference manipulation (AST04) (closes #89) (#370) (f858b3c)
- rules: section-scoped context rules cap prose under a prohibition heading (closes #280) (#375) (d140035)
- rules: SG-MCP-003/004 — remote tool-source registration, disclosed and judged (AST02) (closes #289) (#376) (3c1b7fe)
- rules: SG-NET-002 catches a decoded blob piped or eval'd into a shell (closes #118) (#371) (47a16a3)
- skill: scan .tsx/.jsx/.rs/.go/.lua/.fish/.vbs as scripts (closes #187) (#374) (2bdbc52)
Bug Fixes
v0.6.0
0.6.0 (2026-09-28)
Features
- action: scan a folder of skills from the default path (M9-09) (#359) (67b3d71)
- cli: scan --installed and surfaceguard locations (M9-07) (#356) (124e9d8)
- cli: scan <path>... — folder discovery and many paths (M9-05) (#354) (a55408c)
- cli: verify many skills — folders, paths and --installed (M9-10) (#360) (d7f452c)
- locations: embedded registry of agent skill locations (M9-06) (#355) (5d3155b)
- policy: waive a whole skill pinned to its Merkle root (#363) (9f7227f)
- report: multi-bundle SARIF — one run, root-relative URIs (M9-04) (#353) (c4ef94a)
- scan: multi-bundle scan engine and aggregate text/JSON report (M9-03) (#352) (cc52439)
- skill: Discover() — bounded, symlink-safe, deterministic bundle discovery (M9-02) (#350) (b438ac2)
Bug Fixes
- guard: verdict cache served stale decisions after a signature swap, a waiver expiry or an attestation expiry (#357) (9799aa6)
- rules: widen and narrow SG-EXE-004 — systemd/Windows/login-item persistence; crontab and rc leaves no longer fire on prose or SQL (#361) (9ac13ea)
- skill: classify .mcp.json, per-IDE and one-file-per-tool MCP manifests as configs (#187) (#362) (99f9db5)
Miscellaneous Chores
- release 0.6.0 (58066e0)
v0.5.5
0.5.5 (2026-09-27)
Features
- rules: add SG-EVA-004 — reviewer-directed verdict manipulation (AST08) (#331) (e9ccd1b)
- rules: widen SG-MTA-001 to the verbatim YAML tag, Ruby Psych gadget tags and %TAG handles (AST04) (#346) (a2fd91e)
- rules: widen SG-SEC-001 to CLI-printed and env-held credentials (AST03) (#332) (cc70ff6)
Bug Fixes
- evaluation: fetch_clawhub and fetch_skillsmp honour OUTROOT and LEDGER_SOURCE (#347) (9ecff67)
- oms: refuse a statement whose subject root disagrees with its resources (#334) (750c772)
- rules: narrow and widen SG-NET-002 — table pipes, argument-less mentions, data to interpreters; sudo -E, /bin/bash, env, tee (#341) (dff88fe)
- rules: narrow SG-INJ-011 — the relay verb must start a clause, so a negated relay no longer fires (#342) (aaec47c)
- rules: narrow SG-SEC-001 — the verb→path gap no longer crosses a sentence (#327) (00e30fa), closes #325
- verify: anchor keyless certificate validity on a proven log entry's time (#343) (71c6d5d)
v0.5.4
v0.5.3
0.5.3 (2026-09-16)
Features
- rules: add SG-EXE-010 — host security control disabled (AST01) (#300) (fb5cea8), closes #298
- rules: add SG-INJ-012 — falsified completion report (AST01) (#291) (f859c73), closes #288
- rules: add SG-INJ-013 — structural concealment by padding (AST01/AST04) (#310) (01b236e), closes #308
Bug Fixes
- cmd: reject a --ttl-days that makes an attestation born expired (#301) (f2ed805)
- eval: repair the skillsmp fetcher, which had been returning zero bundles (#304) (3992a78)
- policy: reject the two policy misconfigurations that still failed silently (#292) (be9f51a)
- rules: SG-AS-001 stops at command boundaries and at installs (#297) (12b7efa), closes #294
- rules: SG-EXE-003 detects privilege grants, not privileged commands (#287) (e38b4a7)
- rules: SG-INJ-002's comment leaf needs whole words (closes #277) (#281) (45df97b)
- rules: the documentary penalty no longer reads a leaf's own text as context (closes #143) (#283) (8ba1f1b)
- verify: a co-signature must not mask a revoked key (#311) (16700e7)
v0.5.2
0.5.2 (2026-09-12)
Features
- rules: add SG-CFG-003 — instruction to write the user's agent configuration (closes #251) (#273) (98229c8)
Bug Fixes
- rules: anchor SG-SEC-001's .aws alternative to a path separator (closes #260) (#268) (0f005a8)
- rules: SG-AS-001 no longer reads a bundle-relative sibling as snooping (closes #249) (#271) (c4a3eb6)
- rules: SG-AS-001 stops reading install instructions as snooping (closes #272) (#274) (0910314)
- rules: SG-DEP-001 no longer reads an IAM policy wildcard as a floating dependency (closes #263) (#275) (3d4adf7)
- rules: SG-EXE-001 ignores exec aliased to execFile via promisify (closes #246) (#278) (f14e116)
- rules: SG-INJ-002 ignores prose that documents a code point (closes #250) (#276) (6cfca0d)
- rules: SG-INJ-010 ignores a directive whose object is a quoted claim (closes #264) (#279) (5143cb6)
- rules: SG-REF-003 requires an external locator, SG-ANTI-001 drops "unlimited" (closes #262, closes #261) (#269) (a4404cf)
v0.5.1
v0.5.0
0.5.0 (2026-09-07)
⚠ BREAKING CHANGES
- remove every trace of the former name (#255)
- move schema identifiers to surfaceguard.svgreg.net, and gate apiVersion (#254)
Features
- eval: add install-ranked skills.sh corpus and vendor regression anchor (#247) (c2ba001)
- maintain: add sg-corpus-sweep — fetch fresh skills into quarantine, scan, mine (#253) (c4fc73d)
- move schema identifiers to surfaceguard.svgreg.net, and gate apiVersion (#254) (5644879)