v0.4.0

Container image (linux/amd64, linux/arm64):

docker pull ghcr.io/dividehex/context-guard:0.4.0

Full Changelog: v0.3.2...v0.4.0

v0.3.2

Container image (linux/amd64, linux/arm64):

docker pull ghcr.io/dividehex/context-guard:0.3.2

What's Changed

• Publish a multi-arch image to GHCR on every release tag by @dividehex in #1

New Contributors

• @dividehex made their first contribution in #1

Full Changelog: v0.3.1...v0.3.2

Context Guard 0.3.1

Patch release. The explanation page's "Why this score" text printed "turn undefined onward": it read a field the explain endpoint stopped sending when the anomaly window moved from turns to prompts. It now reads the right field, says prompts, and states what a prompt is per source (one completion in Open WebUI, one user message in Claude Code and Codex, so a tool loop is one prompt). The README's abridged explain example used the old field name and is corrected. No scoring, API or filter behaviour changes; the filter file only carries the new version number.

Install

See the README quick start. Rebuild the container to pick up the page.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VdYfGyctRrEnkXWWKQEtsW

Context Guard 0.3.0

Feature release: Context Guard now watches Claude Code and Codex CLI sessions as well as Open WebUI chats, every score has an explanation page, and known-value drift was reworked against measured data. The 0.2.0 version was never tagged; these notes cover everything since 0.1.3. The Open WebUI filter file is updated (version 0.3.0): reinstall it to get the clickable status line.

Changes since 0.1.3

New sources

• Claude Code. A Stop/PostToolUse/SessionEnd hook ships the session transcript incrementally to POST /api/v1/ingest/claude-code; one API call is one turn, the anomaly window is counted in prompts so a tool loop is one prompt. A statusLine command shows the score in the status bar as a terminal hyperlink to the explanation page, refreshed on a timer so the just-scored turn appears without waiting for the next prompt. Verified against Claude Code 2.1.270.
• Codex CLI. A hook ships session rollouts to POST /api/v1/ingest/codex; one API response, closed by its usage record, is one turn. The Stop hook prints the score under the reply as a Codex system message with a link. Verified against Codex CLI 0.154.0.
• The hooks share one module (agent-hooks/context_guard_shipper.py) for state, shipping and score fetching; everything stays standard-library Python.

Explanation page

• GET /api/v1/conversations/{id}/explain is the document for a front end: the latest result, every reason with its title and explanation, every issue ever caught with whether it still counts, the score over turns, and the scoring parameters. GET /ui/conversations/{id} renders it as a self-contained page (no external assets).
• The Open WebUI status line is now collapsible: expanding it shows a link to that page (new valve explain_url, browser-reachable, {id} is the chat id). Claude Code and Codex lines link to it directly.
• GET /api/v1/signals lists the signal catalog with configured penalties.

Scoring

• Known-value drift learns facts in every recognised form but reads a reply as a claim only in explicit marker forms, and never from a sentence that hedges, conditions, suggests, negates or proposes a change, from a question, or from fenced code. Plain words anchor a value only when the conversation has named them (as an identifier or as the subject of a fact sentence). Many more fact shapes are recognised: sentence-final punctuation, quoted and colon markers ("port": 8080, Version: 1.94.1), numeric host:port, listen, N/tcp, compose mappings, prose and flag settings, version pins. Loopback addresses, network prefixes, declaration lines, file.ext:LINE and quoted times are not facts. Measured with the new extraction-recall harness: registry recall 69% → 88%, drift-eligible recall 26% → 65%, false positives on benign replies (suggestions, defaults, hypotheticals) 5%.
• Suspicious identifiers ignore a shortened form of a known name, a dotted attribute of one, and for plain names a hyphen/underscore swap; a suffix on a known name still counts.
• Context overflow errors from Claude Code and Codex are scored as overflows.

Tooling

• scripts/extraction_recall/ measures the extractor against planted facts: phrasing and tool-output templates, a model-paraphrased fixture with the planted tokens verified verbatim, a benign-reply tier, and a survey of real transcripts. It runs the pure functions through examples/extract.rs in seconds. CI runs its tests.
• Database migration 0002_prompts.sql adds the prompt counters and is applied automatically at startup.

Install

See the README quick start. Verified against LiteLLM v1.94.1 and Open WebUI v0.11.3, Claude Code 2.1.270, and Codex CLI 0.154.0. With compose, create the bind-mount directory first and make it writable for uid 10001.

git clone https://github.com/dividehex/context-guard
cd context-guard
docker build -t context-guard . && docker run -d --name context-guard --restart unless-stopped -p 127.0.0.1:7432:7432 -v context-guard-data:/data context-guard

🤖 Generated with Claude Code

https://claude.ai/code/session_01VdYfGyctRrEnkXWWKQEtsW

Context Guard 0.1.3

Patch release from a code review for bugs and security issues. Scoring changes in one place: known-value drift is narrower (fewer false positives). The API and the Open WebUI filter's behaviour are otherwise unchanged; the filter file is updated (version 0.1.3), reinstall it to pick up the URL-encoding fix.

Changes since 0.1.2

Security and privacy

• Anomaly details are redacted before they are stored, served or logged: NAME=value with a secret-looking name and common API-key, GitHub, Slack, AWS, Google, JWT and bearer-token shapes become [redacted]. The README already promised this; nothing implemented it, so a drift on a pasted key quoted the key in the log and the API.
• ENV=value pairs whose name looks like a key, token or password are never learned as facts, so an assistant showing OPENAI_API_KEY=your-key-here is no longer scored as drift.
• The Open WebUI filter percent-encodes the chat and message ids it puts in URLs.

Correctness

• Known-value drift only fires for attribute kinds (IP, port, env var, version, setting). A different path, URL, hostname or container name is a different thing, not a contradiction; near-duplicates of those remain the suspicious-identifier signal's job. Previously one ordinary reply mentioning a second path could cost 15 points per new path, URL or host.
• Background tasks (title, tags, follow-ups) no longer relabel a conversation's model when Open WebUI runs them on a different model.
• CONTEXT_GUARD_RETENTION_DAYS=0 is rejected at startup; it used to purge every conversation, active ones included, every hour.
• The SQLite path is opened verbatim, so paths with ?, #, % or spaces work.
• The retention cutoff uses the same timestamp format as stored rows.
• A request_tags field that is null or not a list is ignored instead of dropping the payload.
• On SIGTERM the ingest worker drains the batches it holds (up to five seconds) so a turn is not cut off between writes.

Dependencies and CI

• prometheus is built without its unused protobuf feature, removing protobuf 2.x (RUSTSEC-2024-0437) from the build.
• CI runs cargo audit. RUSTSEC-2023-0071 (rsa) is ignored in .cargo/audit.toml with the reasoning: the crate is in the lockfile through sqlx's optional MySQL driver and is never compiled here.

Install

See the README quick install. Verified against LiteLLM v1.94.1 and Open WebUI v0.11.3.

git clone https://github.com/dividehex/context-guard
docker compose up -d --build context-guard

🤖 Generated with Claude Code

https://claude.ai/code/session_011EwPexDswd2AMNtqs8wg1Y

Context Guard 0.1.2

Patch release. No scoring or API behaviour changes; the binary and the Open WebUI filter are functionally identical to 0.1.1.

Changes since 0.1.1

• Tests: back-pressure, retention, real-binary startup and healthcheck, concurrency, and randomized scoring invariants (risk == min(Σ penalties, 100) on every result).
• CI: GitHub Actions runs rustfmt, clippy with -D warnings, the Rust and filter test suites, and a Docker build-and-smoke-test on every push; actions/checkout@v5 and actions/setup-python@v6.
• README: screenshot of the status lines in Open WebUI.
• CLAUDE.md: a briefing for coding agents (invariants, data flow, how to add a signal).
• Repository is now public.

Install

See the README quick install. Verified against LiteLLM v1.94.1 and Open WebUI v0.11.3.

git clone https://github.com/dividehex/context-guard
docker compose up -d --build context-guard

🤖 Generated with Claude Code

https://claude.ai/code/session_01LUdZmZBVzsuR9gG9SDciiP