Guardian Agent v2.0.0-alpha.7 — Diagram hover positioning

Diagram hover details now appear close to the inspected node or edge label instead of inheriting the embedded editor's offset and appearing far away.

• Position the shared inspector in viewport coordinates, with a small right/down offset.
• Move the card to the left when necessary and keep its position inside the viewport.
• Anchor node details to the node bounds, and convert isometric hover positions to viewport coordinates.
• Preserve pointer transfer into the details card and the existing compact-screen presentation.

Validation: desktop Edge checks exercised node hover, edge-label hover, left-side placement near the viewport boundary, and pointer transfer into the card. A narrow-screen smoke check passed with no page errors. The operator confirmed the fix in the live app. Isometric coordinate conversion was type-checked but not visually exercised.

Upgrade: rebuild and refresh the browser to load this frontend fix. No backend restart is required for the hover change.

This is a source release retaining alpha version naming, with no signed native installers. See installation and known issues.

Release checks: all 4,300 tests across 355 files passed under Node 24, plus backend/frontend type checks, build, dependency contract, zero-vulnerability dependency audit, clean production-install smoke test and packaging/Windows launcher checks.

Windows, macOS and Linux CI all passed: https://github.com/Threat-Vector-Security/guardian-agent/actions/runs/34317005994

CodeQL status at publication: Actions analysis passed; JavaScript/TypeScript analysis remains in progress. The existing Rust analysis configuration fails because the repository has no Rust source. No code-scanning settings were changed. Details: https://github.com/Threat-Vector-Security/guardian-agent/actions/runs/34317004782

Guardian Agent v2.0.0-alpha.6 — AWS host authentication

Guardian can now enroll the AWS account available to its host process at startup, so an existing AWS CLI profile or cached SSO session can support read-only collection without manually configuring account and region pins.

• Discover and verify host identity within a bounded startup request, then pin the account and region for the process lifetime. Explicit account/region pins remain supported.
• Show credential mode, profile, account, region, identity verification and recovery instructions in Integrations. Refreshing status does not collect AWS inventory.
• Explain external AWS CLI/SSO login, profile selection, session renewal, Node 24 requirements and when a backend restart is needed. Clarify that Entra sign-in to Guardian is separate from AWS authentication.
• Keep account checks before collection, pinned AWS service endpoints, scoped authorization, and honest coverage for unavailable services or missing permissions. No AWS credentials or discovered enrollment are persisted.
• Add regression coverage for discovery, profile/region resolution, timeouts, account changes, authorization and startup without AWS configuration.

Upgrade: use Node.js 24.14 or later, build the updated source, then restart Guardian with the intended AWS profile and the existing port/data directory. Rebuilding alone does not replace a running backend. Restarting ends sessions and clears memory-only AI provider keys. For SSO, authenticate outside Guardian with aws sso login --profile YOUR_PROFILE first. See installation and the AWS operator guide.

Local Windows acceptance: startup identity verification succeeded with an existing SSO profile under Node 24, and the operator confirmed collection works after the backend restart. This establishes acceptance for that setup, not every account or platform. GuardDuty and Security Hub availability still depends on service configuration and permissions.

This is a source release with alpha version naming. No signed native installers are included. Existing diagram/GRC limitations remain listed in known issues.

Validation: all 4,300 tests across 355 files passed on Node 24, along with backend/frontend type checks, build, dependency contract, zero-vulnerability dependency audit, production-only clean-install smoke test, and packaging/Windows launcher checks. Windows Edge browser checks covered healthy host and pinned enrollment, unavailable/expired-session presentation, expanded authentication guidance and responsive layouts at desktop and narrow widths with no page errors. AWS success/error presentation was mocked in those browser checks; the separate local acceptance above used a real authenticated account.

Windows, macOS and Linux CI all passed: https://github.com/Threat-Vector-Security/guardian-agent/actions/runs/34180817328

CodeQL status at publication: GitHub Actions analysis passed; JavaScript/TypeScript analysis is still running. The Rust job fails because GitHub default setup includes Rust although this repository has no Rust source, as in the previous release. No code-scanning settings were changed. Details: https://github.com/Threat-Vector-Security/guardian-agent/actions/runs/34180816973

Guardian Agent v2.0.0-alpha.5 — UI layout polish

Guardian and ContextCypher now have more consistent layouts across desktop and narrow screens.

• Align form actions and field heights, improve card spacing, and wrap long text in Guardian pages.
• Keep system names readable and fit diagram, toolbox, and GRC analysis panels to the embedded workspace.
• Adapt GRC forms and grids to their available width while keeping wide tables independently scrollable.
• Prevent GRC navigation from shifting the workspace sideways and improve provider-setting labels.
• Add a browser layout regression check covering all seven pages, every GRC section, nested configuration, and settings at widths from 320 to 1440 pixels.

Validation: 4,270 passing tests, backend/frontend type checks, build, dependency contract and audit, production-only runtime smoke test, and packaging policy/Windows launcher checks. Windows Edge UI checks cover responsive layouts, save/reload, import/export, sidebar resizing, environment collection, keyboard shortcuts, and approval review. Native file-picker API calls are stubbed in unattended export tests; no antivirus scan is executed.

This is a source release, retaining the alpha version naming. No signed native installers are included. The existing GRC rename/resync, browser import formatting, and read-only viewer issues remain open; see known issues.

See installation for updating from source. Rebuild and refresh the browser to load the new UI.

Windows, macOS and Linux CI passed: https://github.com/Threat-Vector-Security/guardian-agent/actions/runs/34171062017

CodeQL status at publication: GitHub Actions analysis passed; JavaScript/TypeScript analysis is still running. The Rust job fails because default setup includes Rust although this repository has no Rust source; the same configuration failure occurred on alpha.4. No code-scanning settings were changed. Details: https://github.com/Threat-Vector-Security/guardian-agent/actions/runs/34171062003

Guardian Agent v2.0.0-alpha.4 — Updated documentation

Guardian Agent's documentation now focuses on the current local security application.

• Rewritten installation, usage, security policy and contributor guidance.
• Updated architecture, API and MCP guides, including scoped direct HTTP/CLI access for assistants.
• A GRC walkthrough covering all 15 sections and the diagram-to-risk workflow.
• A clean documentation home, current roadmap and known-issues page.
• Previous Guardian material moved into a separate archive; current guides no longer mix in old assistant instructions.

Validation: 4,270 tests passed; backend/frontend type checks and frontend build passed. All 138 current local documentation links and 49 npm command references checked. Dependency audit: zero vulnerabilities. Final patch credential scan: no detections.

This update changes documentation and version metadata. The known GRC rename/resync, browser import formatting and read-only viewer issues remain open: https://github.com/Threat-Vector-Security/guardian-agent/blob/main/docs/KNOWN-ISSUES.md

Start here: https://github.com/Threat-Vector-Security/guardian-agent/blob/main/docs/README.md

Windows, macOS and Linux CI passed: https://github.com/Threat-Vector-Security/guardian-agent/actions/runs/34035179627

Guardian Agent v2.0.0-alpha.3 — Project navigation patch

Project navigation and browser reload patch for the Guardian security workspace.

• Creating, importing and selecting a system now updates its URL. Same-page project links load the requested system, and late responses cannot replace a newer selection.
• Cancelling navigation preserves the unsaved draft and complete project URL.
• Reload page fetches the current app; the top bar displays its build version.
• Updated README, release links, operator documentation and repository About information.

For an older tab showing #systems?project=Not%20reported, refresh once and select the created system from the saved-system list. The saved system is retained.

Verified the real Edge/backend collection → preview → editable system → save → reload flow, plus project creation/import, navigation, malformed-link recovery, dirty guards and delayed responses. See the patch verification report in docs/test-results/SECURITY-WORKSPACE-ALPHA3-2026-09-06.md.

Source prerelease; no signed native installers. The original application remains available as v1.0.0. Local inventory, credentials and restricted reference texts are excluded.

Validation: 4,270 local tests passed; frontend build, TypeScript checks and dependency contract passed. The complete dependency audit reported zero vulnerabilities; the final patch credential scan found no leaks. Cross-platform CI: https://github.com/Threat-Vector-Security/guardian-agent/actions/runs/34021219725

Guardian Agent 2.0.0-alpha.2 — local security workspace

Guardian Agent 2.0.0-alpha.2 is the first published source prerelease of the local security workspace, combining Guardian security operations with the restored ContextCypher editor and GRC workflows. The earlier alpha.1 tag was an unpublished preflight snapshot; use this patched release.

Included

• Local workstation posture, passive network observations, Windows Defender status and approved scan requests; third-party antivirus inventory.
• Complete diagram editing, node/edge data, built-in examples, threat analysis, reports and GRC workflows. Automatic edge colours follow source zones; explicit overrides remain available.
• Standalone AI through configured providers, plus scoped HTTP, JSON CLI and MCP interfaces for coding assistants.
• Local environment and enrolled AWS inventory-to-diagram workflows; optional Microsoft Entra ID sign-in.
• Collapsible navigation, revision-checked save/autosave, draft retention on conflicts and native file-picker exports.

Seven reference datasets are bundled. IEC 62443 and CSA CCM texts are excluded because redistribution permission has not been established; users may import appropriately licensed control sets locally.

Run from source

Requires Node.js 24.14 or newer. Download the source archive or check out v2.0.0-alpha.2, then run:

npm ci
npm run build
npm run init
npm start

Open http://127.0.0.1:3000. Local browser access defaults to no access code; opt into access-token sign-in in Settings. Machine clients always need scoped credentials. Provider keys stay in backend memory and must be entered again after restart.

Validation and limits

Windows verification covered 4,270 repository tests, additional focused regressions, actual Edge workflows, live CLI/MCP authorization checks and a clean production-only installation. See the repository's docs/test-results/SECURITY-WORKSPACE-2026-09-06.md and docs/security-testing-results/PREPUBLICATION-2026-09-06.md for coverage and exclusions.

The full dependency audit includes browser libraries and build tools and reports zero advisories, as does the production-only audit. Credential checks found no live credentials in the release contents; historical local test tokens are documented in the prepublication report and public history has not been rewritten.

GitHub CI passed on Windows, macOS and Linux, including dependency audit, typecheck, build, security workspace tests and the clean-install runtime smoke check.

This is an alpha source release, without signed native installers or a claim of enterprise production readiness. Real macOS, customer Entra tenants and authenticated AWS acceptance remain platform-specific checks. This is not a kernel EDR or full LAN sensor. Microsoft/Azure resource discovery and project deletion are not implemented. Framework snapshots are historical references, not a claim to contain the latest standards.

The original application remains available as release v1.0.0. Guardian 2 uses ~/.guardianagent/security-v2; existing original profiles are not silently migrated.

Guardian Agent 1.0.0 — original application archive

This release preserves the original, general-purpose Guardian Agent immediately before the security-workspace conversion.

Exact source commit: 5ac3a501fb878ea154836680fd398c195230e9ec.

Use GitHub's source ZIP/tarball below, or check out tag v1.0.0. Follow the README and requirements from that tag, rather than the current main branch. This archive keeps the original assistant, orchestration, UI and integrations available independently of Guardian 2.

This is a source archive, not a new security certification or signed installer. It does not include local profiles, credentials, runtime data or user workspaces. Guardian 2 uses a separate data directory; retain your original installation/data when evaluating either version.