v2.38.0

2.38.0 (2026-10-24)

Bug Fixes

• apps: code review of fw#390 phases 1-5 (d599d61)
• apps: read manifests through one descriptor; Windows-safe tests (fw#390) (af0abe8)
• ci-check: agent-output-to-env counts a PR diff fetched in the job as reach (85f5451)
• ci-check: agent-output-to-env independent review fixes (0a0a84d)
• ci-check: agent-output-to-env review fixes (8930fc6)
• ci-check: bound block expansion in agent-output-to-env (6486bee)
• ci-check: read a heredoc body inside a command substitution as data (4909874)
• fw385: code-review findings on the jail view and the inline-code judge (c24c6a7), closes node9Firewall#385
• jail: an interpreter line and a program path are not file reads (c0ce9cb), closes node9Firewall#385
• shields: two project-jail regexes over the runtime cap (fw#390) (ec78bab)
• sync: resend the snapshot without newer fields on a 400 (fw#390) (6619540)

Features

• actions: general action checks on by default, one shield per app (fw#390 phase 1) (bc57959), closes node9Firewall#318
• apps: found apps in the device snapshot, workspace links at the gate (fw#390 phase 3) (14d50ca)
• apps: node9 finds the apps your agents use and protects them (fw#390 phase 2) (bb0cc25)
• apps: suggest the smallest change after repeated approvals (fw#390 phase 4) (874caa9)
• ci-check: a same-repository reusable workflow called by its full path is local (0cbce88)
• ci-check: CI-2.agent-output-to-env, agent text written to the job env (1fc4aa3)
• ci-check: cloud-signed-in CLI agents and pr-agent are agent steps (20f3edf)
• inline-exec: review inline code only when it does something dangerous (9b43c99), closes node9Firewall#385 node9Firewall#385
• package-check: weigh age and install scripts against the release before (37e35e2), closes node9Firewall#385 node9Firewall#385
• policy: a mandated pack rule follows the workspace's own value (fw#390 phase 4) (c8236b6)
• report: suggest the dashboard at the moment it helps, once (fw#390) (d8d75ca)
• shields: identity covers adding users to channels and sharing files (5c90ce5), closes node9Firewall#385
• shields: Square, Plaid, Okta and Auth0 app shields (fw#390 phase 5) (a7c443a)