v1.1.0
Policy configuration is now externalized and overridable without forking the binary.
Policy config
- Policy tables moved from
main.gointo embeddedconfig/policy.json, loaded at init via a hand-rolled JSON parser inpolicy.go(~6 µs/process, no measurable e2e regression). ACG_POLICY_CONFIGis an overlay (union + disable via-prefix / clear via[]), not a full replacement.- Default
config/policy.jsonis self-protected from agent edits outside this repo (protected_paths+ cwd gate).
Docs & tooling
- README policy section rewritten: hard allow/deny vs macOS
osascriptinstall confirmation; Go 1.27 requirement. policy_bench_test.gomicro-benchmarks on the productionloadMergedPolicyConfigpath; notes indocs/config-extraction-experiments.md.
Install / upgrade
go run ./cmd/installOr download agent-command-guard-1.1.0.tgz and run bun package/dist/install-cli.js.
Full changelog: v1.0.0...v1.1.0