v0.0.75

What's Changed

• Fold same-shaped literal deny paths into alternation regexes in the macOS profile by @dylan-conway in #508
• Release v0.0.75 by @dylan-conway in #509

Full Changelog: v0.0.74...v0.0.75

v0.0.74

What's Changed

• feat(proxy): JVM agent so Java tools honor the sandbox proxy + credential by @shawnm-anthropic in #481
• feat(windows): deny non-interactive logon types to the sandbox group by @ig-ant in #473
• fix(windows): satisfy new clippy lints on current stable by @shawnm-anthropic in #497
• Release v0.0.74 by @shawnm-anthropic in #496

Full Changelog: v0.0.73...v0.0.74

v0.0.73

What's Changed

• refactor(windows): per-user session DB, machine-wide install store by @ig-ant in #467
• Release v0.0.73 by @ig-ant in #472

Full Changelog: v0.0.72...v0.0.73

v0.0.72

What's Changed

• fix(windows): preserve SE_DACL_PROTECTED across acl grant/revoke by @ig-ant in #459
• feat(windows): install-time write-deny stamps on world-writable system dirs by @ig-ant in #460
• fix(proxy): close CONNECT clients that abandon a slow permission decision by @ig-ant in #461
• ci: harden smoke-kill's Start-Tree wait against slow runners by @ig-ant in #464
• test: keep ssh ProxyCommand helper alive until ssh closes it by @ant-kurt in #466
• fix(macos): keep glob denyRead entries denied inside allowRead regions by @ant-kurt in #465
• fix(proxy): route and dial the canonical host, not the client's spelling by @MarshallOfSound in #470
• Release v0.0.72 by @MarshallOfSound in #471

Full Changelog: v0.0.71...v0.0.72

v0.0.71

What's Changed

• feat: per-exec commandLabel for violation attribution; sanitize decoded proxy command by @shawnm-anthropic in #443
• fix: strip trailing slashes from non-glob spellings at the normalizePathForSandbox chokepoint by @ronleizrowice-ant in #444
• feat: commandId + commandText for attribution; sanitize violation lines at ingestion by @shawnm-anthropic in #445
• Compact the generated macOS sandbox profile (~6-10x smaller) by @dylan-conway in #448
• fix(network): bracket-aware IPv6 literals in allowed/denied domain entries by @shawnm-anthropic in #449
• feat(socks): legible refusals for unauthenticatable clients; in-band SSH deny reasons by @shawnm-anthropic in #454
• Release v0.0.71 by @shawnm-anthropic in #455

Full Changelog: v0.0.70...v0.0.71

v0.0.70

What's Changed

• fix(seccomp): start the sandbox when the helper binary is execute-only by @ant-kurt in #438
• fix(proxy): honor ignoreViolations and redact query strings on proxy deny lines by @shawnm-anthropic in #441
• Bump 0.0.70 by @shawnm-anthropic in #442

Full Changelog: v0.0.69...v0.0.70

v0.0.69

What's Changed

• fix(linux): skip creation stubs for absent deny paths under a read-only denied directory by @ronleizrowice-ant in #435
• feat(network): per-entry deniedDomainReasons for model-facing deny reasons by @shawnm-anthropic in #437
• Bump 0.0.69 by @shawnm-anthropic in #440

New Contributors

• @ronleizrowice-ant made their first contribution in #435

Full Changelog: v0.0.68...v0.0.69

v0.0.68

What's Changed

• feat(network): optional ":port" suffix on allowed/denied domains by @MarshallOfSound in #426
• proxy: survive client aborts and keep abort semantics end-to-end by @sa3eed3ed in #423
• feat(proxy): record proxy denials in SandboxViolationStore by @shawnm-anthropic in #436
• Bump 0.0.68 by @MarshallOfSound in #439

New Contributors

• @sa3eed3ed made their first contribution in #423

Full Changelog: v0.0.67...v0.0.68

v0.0.67

Windows

• git.safeDirectories config — safe.directory without write grants; fixes dubious-ownership on subdirectory launches (also emits on macOS/Linux) (#403)
• Deny targets that don't exist yet are materialized as placeholders and stamped, closing the create-past-a-deny hole; trailing / marks directory targets (#404)
• Kill-chain hardening: broker error paths always reap the runner; CI smoke rows pin the no-survivors invariant (#405)
• Persistent MITM CA: ca.json under the protected state dir, atomic writes, notBefore/notAfter validation, auto-load at initialize(), generateCa/validateCaPair exports (#406)
• Breaking: windows.srtWin.path is required — no implicit vendored-exe fallback; pass the exported VENDORED_SRT_WIN_EXE to use the packaged binary. Fact-only argv-too-long message (#413)
• Typed WindowsSandboxError codes with .subcommand, single-spawn srt-win status --json + checkWindowsSandboxStatus() (#414)
• Typed mapped_drive_cwd error (exit 16) for network-drive working directories; the broker never stats UNC literals (#415)
• Async dependency/status/install APIs (checkDependenciesAsync — additive, sync API unchanged); install/uninstall timeout default 120s; windowsHide on sync spawns (#395)

v0.0.66

What's Changed

• Add maskClaims for claim-level masking inside decoded JWTs by @elhajjj in #373
• Add decode:"jwt" for env vars holding JWTs by @elhajjj in #374
• Add maskClaims for env vars holding JWTs by @elhajjj in #376
• Add decode option for encoded credential formats, starting with JWT by @elhajjj in #362
• fix(linux): force --unshare-user + --cap-drop ALL in secure bwrap branch (H1 #3845682) by @seanyeoh-ant in #390
• Substitute masked credentials in request bodies at the TLS-terminating proxy by @elhajjj in #399
• Advertise the HTTP CONNECT proxy in GRPC_PROXY instead of socks5h by @shawnm-anthropic in #409
• Release v0.0.66 by @shawnm-anthropic in #410

New Contributors

• @seanyeoh-ant made their first contribution in #390

Full Changelog: v0.0.65...v0.0.66