Skip to content

v0.9.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Jul 15:20
v0.9.0
f07ef00

The first release where the flagship enforcement ships in the box: every binary below is built with the sandbox feature, and --lockdown is zero-config.

Highlights

  • Confined runs out of the box — agentstack run --sandbox and --lockdown work from these binaries directly (Docker required for the runs themselves). Lockdown pulls its egress-proxy sidecar automatically from GHCR, pinned to this exact version — no env vars, no image builds.

  • Honest posture labels — every run is labeled in the banner, --plan, and agentstack report: HOST / ADVISORY, SANDBOX / PROXIED · DIRECT ROUTE OPEN, LOCKDOWN / ENFORCED · NO DIRECT ROUTE. ENFORCED is reserved for lockdown, on purpose.

  • The enforcement matrix — docs/ENFORCEMENT.md states, per mode and per policy dimension, what is enforced / coarse / unsupported. "Trusted" is not "confined"; the docs now make that impossible to misread.

  • Machine-policy presets — ready-made compatible / developer / locked-down / ci policies in examples/policies/, and doctor reports your machine-policy posture.

  • Flight recorder fill-out — sandbox run logs now record tool calls (outcome + rule + args digest, never values) and secret refs touched (names only); agentstack report renders it all.

  • Supply chain — release binaries and the sidecar image carry GitHub build-provenance attestations; workflows are SHA-pinned. Verify any asset:

    gh attestation verify agentstack-<target>.tar.gz --repo Tarekkharsa/agentstack

Breaking

  • Trust store moved to ~/.agentstack/trust.json (the trust crate no longer parses TOML). There is no migration: existing projects read as untrusted — fail-closed by design. Re-run agentstack trust . per project.
  • Egress policy patterns accept an optional :port (api.example.com:443); the compiled ruleset version bumped, and older enforcers refuse newer rulesets rather than misread them.

Install

curl -fsSL https://raw.githubusercontent.com/Tarekkharsa/agentstack/main/install.sh | sh

Start here: the ten-minute journey — untrusted repo → review → trust → confined run → readable report.

Egress proxy image: ghcr.io/tarekkharsa/agentstack-egress-proxy@sha256:e8e0580ab161a8daae78d72701cc6ce58919e66c756bc134b1a957cc552559f4

Assets 8
Loading