Skip to content

Agent Guard 0.2.8

Latest
Latest

Choose a tag to compare

View all tags
@XuebinMa XuebinMa released this 07 Oct 02:42
· 3 commits to main since this release
v0.2.8
8cde12a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Agent Guard 0.2.8

Security successor to the cancelled 0.2.7 publication. The historical v0.2.7 source tag is unchanged; no 0.2.7 packages were published.

  • Includes the cumulative defensive repairs from PR #170, the bounded control-byte and computed-command follow-up in PR #171, and conservative credential/path authorization fixes.
  • Adds a broker-first Linux Docker reference with required authenticated native acceptance. Passing this fixed synthetic profile is not proof of arbitrary-host or arbitrary-program containment.
  • Preserves the contract: shell parsing is defense in depth; credentials and privileged push approval must remain outside the agent. CLI receipts remain unsigned records of attempts, not credential-isolation proof.
  • Includes a self-pilot checklist and reproducible bounded snapshot-cost measurements. Actual maintainer task feedback and representative capacity acceptance remain pending.

Verified delivery

Release source: 8cde12a509e8533bc6bbd1612b8012534c7d96a1 (PR #171), with 21/21 main CI checks successful and the full release/supply-chain preflight successful. Eight Rust crates, five CPython >=3.10 abi3 wheels, and the dependency-free npm plugin are published as 0.2.8. Isolated cargo install --locked checks passed for guard-hook and agent-guard-cli; installed hook and Python-wheel decision-only tests passed. All five downloaded wheel hashes/contents were checked. npm's registry signature and provenance attestation verified with npm audit signatures; the statement binds this exact source commit, tag and release workflow.

The original GHSA-j64p-f672-v3jq correction retains its three-issue scope: the sed repair was incomplete in 0.2.6; upgrade affected components to 0.2.8. The Python package embeds the same validator/SDK implementation.

Remaining limits

The advisory hook is not an OS containment boundary. Windows ambient-handle inheritance and general shared-hard-link containment remain open. No new daemon/RPC service or general shell-security guarantee is introduced.

See CHANGELOG, broker-first plan, and self-pilot checklist.

Assets 2
Loading