Skip to content

v0.20.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Jun 20:33
· 14 commits to main since this release
v0.20.4
8086e4d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's new since v0.20.3

A bug-fix roll-up resolving six independent issues across the FUSE, ptrace/shim, seccomp, and cgroup layers, plus a documentation catch-up for the now-implemented PostgreSQL access control. Built from the same commit validated by v0.20.4-rc1.

Fixes

  • Per-path soft_delete now works under FUSE — a decision: soft_delete file rule routes rm/rmdir to the trash even when the global sandbox.fuse.audit.mode is left at its default, matching the behavior the ptrace layer already had. Previously such a rule was silently ignored and the file was hard-deleted, leaving agentsh trash list empty (#417, #422).
  • Correct classification of O_CREAT without O_EXCL — open-or-create on an existing file (the shell > redirection pattern) is now classified as write, not create, so the intended file rule matches (#418, #421).
  • Session binding in hybrid attach_mode=pid + shim_install=auto — the session now binds to the already-traced shell instead of failing to attach (#416, #420).
  • unixwrap diagnostics no longer corrupt the wrapped command's stderr — diagnostic output is routed off the wrapped command's stderr stream (#415, #419).
  • errno socket_rules survive unix_sockets.enabled: true — the catch-all AF_UNIX socket() notify no longer shadows conditional errno socket_rules / blocked_families; the socket(2) notify is now scoped to AF_UNIX (#412).
  • Graceful degradation for unenforceable per-command cgroup limits — limits the host can't enforce now warn and continue instead of failing the command (#411, #414).

Operator-visible behavior changes

  • A per-path decision: soft_delete file rule now diverts destructive operations to the trash under FUSE regardless of the global sandbox.fuse.audit.mode (which still governs non-matching paths and defaults to monitor).
  • Unknown keys under sandbox.fuse now emit a startup warning — a mistyped sandbox.fuse.session.mode is flagged instead of silently dropped (soft-delete uses sandbox.fuse.audit.mode / sandbox.fuse.audit.trash_path).
  • O_CREAT without O_EXCL over an existing file is classified as write rather than create; review any file rules that distinguish the two operations.
  • errno-based socket_rules / blocked_families are now enforced even when unix_sockets.enabled: true.

Docs

  • Database access control spec updated to v0.9 — PostgreSQL Phase 1 + Phase 2 marked implemented (catalog-backed object resolution and safe runtime redirect for read-only relation replacement); current runtime scope is Postgres-family (#423).
  • New Windows WSL2 setup guide for running Claude Code under agentsh.
  • New CVE mitigation demos — CIFSwitch, Fragnesia, DirtyDecrypt (#413).

Validation

Built from the same commit as v0.20.4-rc1 and passed the full release matrix (goreleaser, alpine-build, docker-test including FUSE-enabled Ubuntu, signed macOS app, Homebrew cask, checksums). The rc1 prerelease is retained.

Full changelog: v0.20.3...v0.20.4

Assets 16
Loading