v3.2.0

What's Changed

• feat: cloud audit logs as a second witness, cloud destruction rules and guardrails by @efij in #67
• feat: delta runs, signed and proven rounds, one honest progress bar, gentle by default by @efij in #68
• feat(serve): Cmd/Ctrl+K command palette by @efij in #69
• release: v3.2.0 by @efij in #70

Full Changelog: v3.1.2...v3.2.0

v3.1.2

What's Changed

• feat(serve): findings newest first — v3.1.2 by @efij in #66

Full Changelog: v3.1.1...v3.1.2

v3.1.1

What's Changed

• fix(detect): precision pass from a real case — v3.1.1 by @efij in #65

Full Changelog: v3.1.0...v3.1.1

v3.1.0

What's Changed

• docs(site): v3.0.0 on the landing page by @efij in #60
• fix(install): Windows one-liner works in Command Prompt too by @efij in #61
• fix(serve): Cmd/Ctrl+K works on every keyboard layout by @efij in #62
• feat(serve): apply, preview and undo mitigations from the Protect tab by @efij in #63
• release: v3.1.0 by @efij in #64

Full Changelog: v3.0.0...v3.1.0

v3.0.0

What's Changed

• docs: move site URLs to agentdfir.com by @efij in #54
• docs(site): scroll-driven motion, agent logo marquee, plain evidence labels by @efij in #55
• docs: point site URLs back to efij.github.io/AgentDFIR by @efij in #56
• fix(install.ps1): start agentdfir run from the installer, not from the pasted tail by @efij in #57
• docs: v2.7 sweep — roadmap, Protect view, llms.txt, sitemap, docs grid, changelog by @efij in #58
• v3.0.0 — incident-driven detection: hunt, scan-repo, decoder, journal by @efij in #59

Full Changelog: v2.7.0...v3.0.0

v2.7.0

What's Changed

• docs(site): editorial redesign with real explorer screenshots by @efij in #51
• docs(site): security-tool redesign — dark, sticky nav, motion by @efij in #52
• feat: agentdfir mitigate, export/open a case, Protect tab — v2.7.0 by @efij in #53

Full Changelog: v2.6.0...v2.7.0

v2.6.0

What's Changed

• ci(release): guard the Chocolatey jobs with !cancelled() for chocolatey-only dispatches by @efij in #49
• feat(serve): plain-language explorer — story diagrams, accounts, MCP timeline — v2.6.0 by @efij in #50

Full Changelog: v2.5.2...v2.6.0

v2.5.2

What's Changed

• ci(release): publish to Chocolatey, package source in efij/chocolatey-agentdfir by @efij in #47
• fix(detect): twelve false-positive classes behind half the CRITICAL/HIGH findings — v2.5.2 by @efij in #48

Full Changelog: v2.5.1...v2.5.2

v2.5.1

What's Changed

• perf(analysis): read each artifact once, anchor the secret scan, index provenance writes, scan in parallel — v2.5.1 by @efij in #45

Full Changelog: v2.5.0...v2.5.1

v2.5.0

What's Changed

• feat: Claude Cowork product, Codex desktop app + SQLite thread store, explorer confidence/date UI — v2.5.0 by @efij in #44

Full Changelog: v2.4.3...v2.5.0