v1.9.6

Rampart v1.9.6 is a security release. All users should upgrade.

Security fixes

• A repository's own rampart.yaml can no longer replace your policy. A hook runs in the directory the agent is working in, and it used to take its whole baseline policy from a rampart.yaml there. A cloned repository could ship a two-line file with default_action: allow and switch protection off. The baseline is now your explicit --config, otherwise the built-in standard profile; policies in ~/.rampart/policies/ are still added to it. A rampart.yaml in the working directory is layered on top as a project policy: it can add restrictions but can't relax the baseline.
• Empty hook input is refused instead of approved. An empty or whitespace-only read returned an explicit approval, which tells the host to skip its own permission prompt. Enforce mode now refuses it and records the decision, in every supported hook format. Monitor and audit modes still let the call through.
• Rule exclusions only excuse the command they match. A harmless excluded fragment, such as a substitution or nested command, could clear a destructive, self-protection or credential-read rule for the command beside it. A multi-file reader such as cat is now checked per file, so an excluded public key no longer covers a private key read alongside it.
• Here-documents no longer hide fetched execution. Download-and-execute analysis stopped at the first here-document. It now skips only the body, and treats the body as code when a shell or interpreter reads it.
• Multi-operand forms of protected commands are matched. chmod -R 777 with / among several operands, and multi-file reads of protected credential files, were only caught in their single-operand form.
• Built with Go 1.26.10, which fixes GO-2026-6809 in crypto/x509.

Behavior change: rampart.yaml in the working directory

If you relied on a ./rampart.yaml as your entire policy without passing --config, it is now layered on top of the standard profile instead of replacing it. You may see denials you didn't see before. To keep using that file as the baseline, pass its absolute path to the hook with --config. Setups that already pass --config are unaffected.

Upgrading

Follow the upgrade guide.

• Hooks load the standard profile built into the binary, so they get the new chmod rules as soon as the new binary is installed.
• The installed copies in ~/.rampart/policies/ are refreshed by rampart upgrade. After brew upgrade rampart or the Windows installer, run rampart upgrade --no-binary to refresh them. Profiles you have edited are preserved and are not updated.

See the changelog for full details.