v0.9.1

Changelog

• 0733a71 harden: scratch-dir for active probes, capped log lines, git-rev argument-injection guard
• 8b61eb9 release: 0.9.1 - self-audit hardening (scratch-dir probes, capped log lines, git-rev guard)

Full Changelog: v0.9.0...v0.9.1

v0.9.0

Changelog

• 31f31a7 feat(agentenv): counterfactual simulation, data-flow queries, finding explanations, path-breaking controls
• 2d62073 feat(aspexmcp): simulate_change, explain_path and data_flow tools
• 4ed33c1 feat(cli): simulate, explain flows and finding ids, environment-aware inspect, repro/replay, corpus import
• e8dfeb5 feat(repro): safe reproduction bundles, analysis-only replay, corpus import
• 145cb35 feat(tighten): simulate every recommendation's security impact
• f60af58 feat: explorer with trust boundaries, data flow and persistence; demo environment; issue templates
• 2659f8f fix(report): strip OSC escape sequences from untrusted content; terminal-safety tests
• b16cc72 release: 0.9.0 - security debugger for AI agents (simulate, data flow, reproduction, explorer)

Full Changelog: v0.8.1...v0.9.0

v0.8.1

Changelog

• 672a8b5 release: 0.8.1 - Homebrew cask only

Full Changelog: v0.8.0...v0.8.1

v0.8.0

Changelog

• dcaf269 feat(agentenv): deterministic security queries for explain
• 6ea318a feat(agentenv): normalized agent environment model with fingerprints and blast radius
• 04c03a1 feat(aspexmcp): expose Aspex to agents as a read-only MCP server
• cfd4e69 feat(cli): explain, tighten, bom, mcp, explore commands
• 2ded905 feat(corpus): environment scenarios with tool-agnostic truth, aspex-scan corpus test
• 1106051 feat(explore): local session explorer dataset and loopback-only server
• 98b2f0e feat(tighten): least-privilege recommendations from configured vs observed use
• 2663d52 feat: aspex lock / verify / diff - change security for agent environments
• 373d681 feat: blast radius in the scan report, environment history, drift in watch mode
• d78eebd feat: evidence on every finding, event-based watch, Cursor/Windsurf rules, CycloneDX BOM, Homebrew cask
• a685612 fix: Windows path handling in skills and tighten; POSIX-only e2e fixtures skip on Windows
• 9eca5a3 release: 0.8.0 - local security debugger for AI agents

Full Changelog: v0.7.1...v0.8.0

v0.7.1

Changelog

• a8e0790 release: 0.7.1 - bring npm to parity via trusted publisher (no code change from 0.7.0)

Full Changelog: v0.7.0...v0.7.1

v0.7.0

Changelog

• 83a0fdb feat(attackpath): evidence-backed capability compositions in every scan
• 6da4003 feat(scan): plaintext-aware secrets, writable agent-state rule, hook discovery (P1)
• d720179 feat(trace): session boundaries and OBSERVED/INFERRED/POSSIBLE evidence (P0)
• 1a9cda7 refactor(rules): declarative catalog - add a rule in YAML, no Go (P2)
• a3dde69 release: 0.7.0 - version bump and changelog
• 0546e49 release: npm via Trusted Publishing; npx aspex in README and docs

Full Changelog: v0.6.1...v0.7.0

v0.6.1

Changelog

• 1ac6f2d feat(npm): publish aspex package; remove Onyx references from tool output and docs
• 4f5038a fix(actions): pass --fail-on to the binaries; scan action writes and uploads SARIF
• b2a1ab9 fix(attack): --categories help lists categories that have probes; mirror corrected docs
• ef49cc8 fix(launcher): never exit the menu when a tool returns non-zero; release 0.6.1
• 12c1dee fix(npm): un-ignore npm/aspex/bin shims swallowed by the blanket bin/ rule
• 99a7e47 fix(release): make version vars injectable; sync Homebrew formula text with the tap

Full Changelog: v0.6.0...v0.6.1

v0.6.0 - see what your AI agents actually did

The release that turns Aspex from "a scanner with a trace tool" into "see what
your agents actually did, then scan what they could do."

Added

• aspex with no arguments now shows a 30-day snapshot first: tool calls your
  agents made, how many went to servers no scan has checked, how many tripped a
  detection rule, and the static score of every configured server. Then the menu.
• aspex share: the same headlines as a privacy-safe Markdown card (counts and
  score only, no server names, paths, or commands). aspex snapshot prints the
  panel alone for scripts and CI logs.
• aspex-scan --with-trace: joins static findings with observed activity from
  aspex-trace logs, ranks servers by risk x use, and lists servers agents call
  that appear in no scanned config. Log names are matched by normalized token
  (plugin_slack_slack matches slack).
• .aspex.yaml policy (aspex-scan init): accept a risk with a required reason
  and optional expiry; override or disable any rule's severity; set a default
  fail_on. Applied before scoring and before the gate. Expired ignores warn.
• Finding baseline: --save-baseline / --baseline so only new findings fail
  the gate on an estate with existing findings.
• Claude Code discovery: ~/.claude.json (user and per-project scopes), project
  .mcp.json, and installed plugin .mcp.json files. Previously Claude Code
  servers were not discovered at all.
• Detection corpus (testdata/corpus/): known-malicious fixtures that must fire
  named rules and popular benign servers that must stay below a stated
  severity. Both run in CI.
• Parallel server inspection (-j/--concurrency, default 8). A 7-server scan on
  the maintainer's machine went from 20.2s to 7.0s.
• aspex-scan doctor subcommand; aspex-doctor remains as an alias.
• JSON output gains policy, suppressed, baselined, and activity fields.
• End-to-end tests (cmd/aspex-scan/e2e_test.go, internal/snapshot) drive the
  real command tree against a fixture home with configs and agent logs; CI now
  also runs gofmt, staticcheck, and deadcode. Four unreachable functions removed.

Fixed

• --fail-on was ignored whenever --json or --sarif was also passed: the
  command returned after writing output and never reached the exit-code check.
  Any CI job using machine-readable output could not fail. Found by the new
  end-to-end tests. Both output modes now apply the gate.
• AT015 (cross-server data chain) fired on every outbound call after any other
  server had done any read, with no time bound and no dedupe, and treated
  reading a web page as a data read. Thirty days of logs on the maintainer's
  machine produced 103 findings that were two browser servers taking turns.
  Now: one finding per reader->sender pair, 10-minute window, web-content
  reads excluded. Same logs: 2 findings.
• MCP020 matched repl as a substring and flagged the official Slack server's
  slack_reply_to_thread as CRITICAL code execution. Now token-bounded.
• MCP001 whitelisted U+200B entirely (a trivial bypass). A lone zero-width
  space is still tolerated; three or more, or one splitting a word, is flagged.
• MCP001 had no pattern for "ignore all previous instructions". Added.
• MCP010 and doctor flagged OAuth-authenticated remote servers as having no
  auth. ServerEntry.OAuth now records an oauth block.
• aspex-scan fix can now remove project-scoped servers nested in
  ~/.claude.json, not just report them removed.
• Docs: --fail-on takes a severity, not a score; Claude Code config paths were
  wrong; aspex-trace reads logs, it does not intercept sessions.

Full Changelog: v0.5.5...v0.6.0

v0.5.5

Changelog

• d63e476 feat: v0.5.5 — score delta, fix plan, explain, fix env, --share, --report, first-run UX

Full Changelog: v0.5.4...v0.5.5

v0.5.4

Changelog

• 4935b44 fix: v0.5.4 — npm runtime, HTTP severity, doctor false positives, config-secrets dedup, metadata injection

Full Changelog: v0.5.3...v0.5.4