ApprovalLens 0.7.3

ApprovalLens 0.7.3 — readable reviews and scrollable confirmations

All detailed confirmations now share a scrollable layout with a separate action bar, including rule suggestions, Apply rules and hosted-review setup. Native approval reviews and action details organize request information, evidence, model findings and uncertainties into readable sections instead of raw JSON. Closing a pending approval review still denies the request; approval validation is unchanged.

The judge guide now includes the complete installation-to-hosted-review sequence, rule suggestions, explicit policy activation and a sample native tool request.

ApprovalLens 0.7.2

ApprovalLens 0.7.2 — scrollable rule-suggestion preview

The suggest-rules confirmation opens the file list in a scrollable panel with the confirm button kept on screen.

ApprovalLens 0.7.2

UI bug fix

Full Changelog: v0.7.1...0.7.2

ApprovalLens 0.7.1

ApprovalLens 0.7.1 — automatic project inventory

Rule suggestions now inventory the project automatically without a file picker. Hidden, generated, symlinked and likely sensitive paths are excluded. The preview shows exactly what will be sent; contents are never uploaded. Up to 800 paths and 30 KB of inventory are supported; oversized scans fail explicitly instead of silently truncating. Suggested permissions remain minimal and unapplied.

The website documents every extension command and includes an accessible SVG state diagram with approval, denial, review failure and state-change branches.

ApprovalLens 0.7.0

ApprovalLens 0.7.0 — suggested project rules

Nemotron suggests minimal read/write grants from selected paths and task intent. The extension previews outgoing metadata and opens a validated, unapplied policy draft. Existing restrictions are retained; explicit application is required.

Adds a public architecture page and removes recording directions from the judge guide. Explicit owner-configured uncapped testing removes the aggregate ceiling for authenticated calls; anonymous inference remains unavailable.

Single local workspace on macOS/Linux. Native interception and shell coverage remain bounded.

ApprovalLens 0.6.0

ApprovalLens 0.6.0 — shell inspection and sensitive-data checks

• Opt-in structured shell inspection: literal quoting, pipelines, command lists and bounded read-only adapters for cat, head, tail, wc, grep -F and pwd. Every branch and input file must pass policy; unresolved operations stay blocked.
• Sensitive-data checks on supported native reads and outgoing MCP/Nebius review evidence. Repository blocked terms complement known credential patterns. Matched values are not echoed in diagnostics.
• Product-focused website, separate setup/verification and judge pages, and consolidated guidance.
• Bundled installation remains one extension plus explicit workspace enablement. No separate terminal service is required.

279 functional tests pass. macOS/Linux, single local workspace. Arbitrary scripts, network shell commands, redirections and unsupported host tools remain outside allowed coverage. Detection is not a sandbox or zero-egress guarantee. Hosted AI remains a credentialed, quota-limited pilot.

ApprovalLens 0.5.0

ApprovalLens 0.5.0 — bundled workspace setup

Install the extension and run ApprovalLens: Enable for this workspace. It bundles and starts the local companion, creates an editable rules file and merges project hooks/MCP configuration without replacing other integrations. No separate Node installation, source checkout or npm install is needed for this flow.

Rules are applied explicitly to a trusted snapshot outside the repository. Agent edits cannot silently relax active rules. The new commands support editing/applying rules, connecting hosted review, checking setup and disabling the workspace guard.

The private MCP evidence-review tool accepts bounded client-observed evidence, omits raw write bodies and returns validated Nemotron findings. The local guard remains authoritative and waits for explicit human approval. Access tokens live in editor SecretStorage; hosted inference remains a limited pilot, not unlimited public access.

macOS/Linux, single trusted local folder only. Native coverage remains limited to supported hook-delivered Read/whole-file Write/Delete operations. Shell and other unsupported hooked operations are denied; search may bypass Cursor hook coverage. There is no separate classifier model, OS sandbox or universal interception claim. Disable the workspace integration before uninstalling the extension.

ApprovalLens 0.4.1

ApprovalLens 0.4.1 is a focused release extraction with shared core logic, hosted advisory MCP, native Cursor guard and extension.

The VSIX is the presentation component. Native interception also requires the local companion and project hooks; see the native setup guide. Hosted MCP does not intercept local tools and the public sample is rules-only unless LIVE credentials and durable spending admission are configured.

This release preserves explicit unknown results, protected-field checks, one-time human review and fail-closed native behavior. macOS/Linux and Node 24 are required for the companion. See README and SECURITY.md for coverage limits. The package is a preview, not a sandbox or universal prompt-injection defense.

0.4.1 improves marketplace setup/privacy documentation and makes extension packaging follow the manifest version. Review logic is unchanged from the 0.4.0 extraction.

ApprovalLens 0.4.0

ApprovalLens 0.4.0 is a focused release extraction with shared core logic, hosted advisory MCP, native Cursor guard and extension.

The VSIX is the presentation component. Native interception also requires the local companion and project hooks; see the native setup guide. Hosted MCP does not intercept local tools and the public sample is rules-only unless LIVE credentials and durable spending admission are configured.

This release preserves explicit unknown results, protected-field checks, one-time human review and fail-closed native behavior. macOS/Linux and Node 24 are required for the companion. See README and SECURITY.md for coverage limits. The package is a preview, not a sandbox or universal prompt-injection defense.