v0.21.2

0.21.2 (2026-07-15)

Fixed

• rag_guard.py: decode URL-encoded document content — including double-encoding, up to 3 levels — and re-scan each decoded variant before running injection-detection patterns, mirroring the npm v4.32.3 fix. Previously a URL-encoded payload bypassed detection entirely. (#1, companion to nkratk/llm-trust-guard#1)
• agent_skill_guard.py: loosened the "fake-compliance data exfiltration" and "response appending directive" SCH patterns — they previously required a specific word order/literal word and missed reordered or reworded variants ("X mandates: route ...", "include in all outputs: ..."). The broadened "fake-compliance" pattern also now requires an explicit "all responses/data/output(s)" object AND an actual destination (to/at <address>) after the action verb — two earlier drafts were progressively found, in review, to false-positive on benign compliance/audit prose (first on qualifier+verb alone, then on verb+destination with no bulk object). Both caught before merge. Same regex source and fix as npm v4.32.3. (#2, companion to nkratk/llm-trust-guard#2)

Note: code_execution_guard.py was not changed in this release. Its native AST-based _ast_escape_findings() correctly blocks real Python object-introspection gadget chains (__subclasses__, __globals__, __mro__, etc.) and served as the reference for fixing the npm port's true-negative gap (npm #3). However, it has its own, separate over-blocking bug — a single standalone dunder attribute access (e.g. bare cls.__subclasses__()) is flagged as if it were a chain, with no proximity/co-occurrence check at all. Filed as #4; not fixed in this release.