vetto 0.2.9

What's Changed in 0.2.9

Added

• Transparent agent sandboxing: vetto enable <agent> creates priority PATH shims with multi-layered recursion barriers (VETTO_WRAPPED, VETTO_SANDBOXED, VETTO_SHIM_ACTIVE), allowing developers to launch agents normally (e.g. claude, codex) under kernel sandbox supervision without manual vetto run wrapping.
• Transparent agent unwrap: vetto disable <agent> safely removes the Vetto shim without affecting the host binary.
• Agent discovery and status: vetto enable without arguments lists detected and wrapped agents; vetto enable --status and vetto status display active agent wrappers and real binary paths.
• Collision safety: vetto enable refuses to overwrite non-Vetto binaries without --force.

Changed

• Reorganized CLI --help: prioritized primary workflows (enable, disable, allow, deny, doctor, tour, status, verify) and hid low-level/internal subcommands.
• Documentation: README Quick Start is now the 3-line workflow (install -> vetto enable claude -> run claude normally); direct vetto -- <command> execution documented under Advanced; notes on the PATH hook touching shell rc files; onboarding error hints lead with vetto enable; landing page hero updated to the enable workflow.

Full Changelog: v0.2.8...v0.2.9

vetto 0.2.8

Full Changelog: v0.2.7...v0.2.8

v0.2.6

Added

• Zero-config auto-detection (vetto without arguments): inspects workspace project markers and PATH executables to auto-detect the active AI agent, applies agent-tailored allowlists and secure defaults, and launches supervision.
• Interactive first-run wizard (vetto init --wizard): 3-step interactive setup generating a commented policy.toml tailored to project ecosystem (Rust, Node, Python, Go, Java, Ruby, PHP).
• Security presets (--preset paranoid|balanced|yolo): instant baseline security profiles with tailored network access and secret masking rules.
• Agent network allowlists: out-of-the-box domain allowlists for Claude, Codex, Gemini, Aider, OpenCode, Cursor, Copilot, and Cline.
• Actionable remediation hints on blocked attempts: TUI and events surface concrete policy modifications when file access or network requests are denied.
• Path permission inspection (vetto policy explain --why <path>): inspects path permissions (WRITABLE, READ_ONLY, DENIED, BLOCKED) and provides exact TOML remediation instructions (supports text and --json).
• Shadow mode (--shadow, RunConfig.shadow): evaluates policy boundaries in log-only mode ("would deny") during preflight verification.
• Diagnostic remediation (vetto doctor --fix): prints concrete fix commands and sysctl configurations for missing kernel primitives (Landlock LSM, unprivileged userns, seccomp, audit feed).
• External policy importer (vetto policy import --from claude|codex): parses Claude settings JSON or Codex config TOML and generates compatible policy.toml.
• 3-tier configuration hierarchy: ~/.vetto/config.toml (global defaults) -> ./policy.toml / .vetto/policy.toml (project policy) -> CLI flags (strictest wins).
• Shell completions and man pages (vetto completions <shell>, vetto man): native shell completions for Bash, Zsh, Fish, PowerShell, Elvish and man page generation via clap_mangen.
• vetto --version --json emitting machine-readable version, fast tier determination, and git commit hash.
• Stable deterministic exit codes mapped across all session termination paths and documented in docs/exit-codes.md.
• Global --quiet (-q) and --verbose (-v) logging flags across CLI commands.
• Optional system-level journal logging (system_log = true / --system-log) for Linux journald, Windows EventLog, and macOS logger.
• vetto shell-env command and PS1 prompt integration exporting session indicators (VETTO_SANDBOX=1).
• vetto status listing active supervised sessions and cleaning up stale process metadata.
• Official standalone curl installer scripts/install.sh with SHA256 checksum verification and docs/INSTALL.md.
• Automated session timeout computation (--timeout auto) via p95 duration history with 5-minute floor.
• Persistent workspace profiles (vetto profile save/list/rm) and direct execution (vetto <profile>).
• Latency and bottleneck diagnostic breakdown with actionable optimization hints (vetto why-slow <session>).
• Release CycloneDX SBOM generation script (scripts/gen-sbom.sh) and specification in docs/SBOM.md.
• Landlock ABI diagnostic feature hints in vetto doctor for kernels supporting newer LSM features.
• Conventional commit changelog generator scripts/gen-changelog.py for automated release notes.
• vetto policy show --effective for rendering resolved effective policy rules and resource ceilings.
• Release Train Workflow (.github/workflows/release-train.yml): automated CI release pipeline with dry-run on main push, manual dispatch release (bump patch/minor/major, channel stable/alpha), SLSA Level 3 provenance attestations (actions/attest-build-provenance), multi-target binary matrix compilation, npm packaging and publishing.
• Version Banner & Update Notification: Non-blocking async check against npm registry (https://registry.npmjs.org/@shledery/vetto/latest or @shledery/vetto/alpha) with 24-hour cache in ~/.vetto/cache/version.json and 2-second timeout. Displayed on session start and in vetto doctor.
• Self-Upgrade Subcommand (vetto upgrade): Self-update mechanism with automatic installation method detection (npm vs cargo vs binary) supporting --check, --dry-run, and --channel <stable|alpha>.
• Release Channels: Support for stable and alpha channels via npm dist-tags and user config (channel = "alpha" in ~/.vetto/config.toml).
• Compatibility Matrix: Comprehensive documentation (docs/compat.md) and generator script (scripts/gen-compat.py) mapping AI agents, platforms, and isolation tiers.
• Nightly E2E Agent Suite (.github/workflows/e2e-agents.yml): Nightly multi-agent (Claude Code, OpenAI Codex, Gemini) verification workflow across Linux and macOS runners with honest skip when API credentials are unset.
• Public Red-Team Security Reports (.github/workflows/redteam.yml, scripts/redteam-stub.sh, docs/redteam-latest.md): Automated adversarial attack evaluation and published badge report.
• Optional Privacy-Preserving Telemetry: Strictly opt-in (telemetry = false default) aggregate block category counters via ~/.vetto/config.toml with complete transparency in docs/telemetry.md.
• Interactive Tour Subcommand (vetto tour): 5-step guided onboarding scenario demonstrating doctor diagnostics, secret masking, shadow mode, policy tailoring, and boundary verification.
• Vulnerability Management & CVE Process: Response SLA (48h acknowledgment), RFC 9116 .well-known/security.txt, supported versions table in SECURITY.md, and disclosure workflow in docs/security/cve-process.md.
• SLSA Provenance Verification: Build provenance attestations and verification documentation in docs/security/slsa-provenance.md.
• Tier 2 Network Suite (Features 13–24):
  • Ecosystem network presets (net_presets = ["npm", "git", "pip", "huggingface"]) expanding common package registries and APIs.
  • Wildcard domain rules (*.example.com) strictly covering subdomains only without matching the base domain.
  • CIDR network rules (allow_cidr = ["10.0.0.0/8"]) validated against pinned IP addresses.
  • --net=ask interactive confirmation mode with session caching and fail-closed non-TTY fallback.
  • DNS resolution and egress connection logging with byte counts in JSONL events and session reports.
  • DoH/DoT blocking for top providers and DoT port 853 in allowlist/off modes.
  • Per-domain transfer quotas (net_quota = { "api.openai.com" = "100mb" }) with byte counting and connection teardown.
  • Landlock TCP port access control rules (net_ports = { allow_tcp_connect = [...], allow_tcp_bind = [...] }) on Landlock ABI 4+.
  • Upstream HTTP_PROXY and HTTPS_PROXY broker routing with NO_PROXY bypass without leaking variables to the sandboxed child.
  • Unix domain socket access policies (unix_sockets = { allow = [...] }).
  • Full IPv6 (AAAA) resolution and connection support with pinned address discipline.
  • Aggregated session network summary emitted in notices and report statistics.
• Tier 3 Files & Secrets Suite (Features 25–36):
  • Auto secret scan (vetto scan-secrets [path] command and auto_deny_secrets = true policy option) detecting and denying credential patterns at startup with bounded limits.
  • Out-of-process credential broker (secrets.proxy = [...]) injecting auth headers for allowlisted domains and stripping sensitive credentials from the child.
  • Built-in deny presets (deny_preset = ["ssh", "aws", "gcp", "kube", "docker", "gnupg", "git", "npm", "cargo", "claude", "codex"]).
  • Glob denial patterns (--deny-glob CLI flag and deny_glob = ["**/*.pem"]).
  • Read-only cache mounts (ro_mounts = ["~/.npm", "~/.cache/pip"]) mounted MS_RDONLY in mount namespace.
  • Diff reporting with in-memory baseline manifest and summary diff calculation at completion.
  • Git branch protection (git_guard = true) and hook/shim interception blocking destructive operations (git push --force*, git push --delete).
  • Snapshot and rollback (snapshot = true and vetto rollback <session>).
  • /proc and /sys masking and /tmp private tmpfs isolation (tmpfs_tmp = true).
  • Live session event watch mode (vetto watch <session-pid/log-path>).
  • Filesystem I/O metrics tracking bytes read/written and operation counts.
• Tier 4 Observability Suite (Features 37–48):
  • Live TUI dashboard event panel: --tui=full augmented with real-time categorized counters (files, network, blocked access, processes).
  • vetto events <session> subcommand for tailing and filtering JSONL session logs with --filter deny|net|files|exec, --follow streaming tail, and table/JSON formats.
  • OpenTelemetry session tracing behind optional telemetry feature flag: session root span (vetto.session) and span-events for security/observation telemetry with --otel-endpoint.
  • vetto audit subcommand and persistent session indexing to ~/.vetto/history.jsonl with --since, --agent, --limit, and substring search.
  • Desktop notifications on security violations via --notify / notify = true (Linux notify-send, macOS osascript, Windows PowerShell toast) via non-blocking subprocesses.
  • vetto digest subcommand for daily audit summaries (sessions, duration, blocked counts, top agents and policies).
  • vetto diff-sessions <id1> <id2> subcommand for comparing two session reports (metric deltas, new and resolved violations, network changes).
  • Standalone inline SVG category histogram in HTML audit reports visualizing event distribution across categories with zero external dependencies.
  • vetto replay <session> subcommand for chronological sandbox event playback with --speed multiplier.
• Tier 5 Linux Kernel Hardening Suite (Features 49–60):
  • Seccomp profile configuration (seccomp_profile = "agent-min") blocking exotic and legacy syscalls (personality, syslog, chroot, raw I/O, clock tampering, fanotify) for hardened agent containment.
  • ...

vetto 0.2.5

What's Changed

• hardening/v0.3: verify battery, session timeout, limits, policy tools, windows secrets by @shleder in #14
• macOS: profile-shape bisect toward read isolation (v0.2.5 line) by @shleder in #15

Full Changelog: v0.2.4...v0.2.5

vetto 0.2.4

What's Changed

• feat(action): add 1-second precompiled native binary downloads by @shleder in #12
• feat(nextgen): implement 50 next-gen capabilities (MCP, Net L7, Watchdog, WASM, Governance) by @shleder in #13

Full Changelog: v0.2.3...v0.2.4

vetto 0.2.3

Full Changelog: v0.2.2...v0.2.3

vetto 0.2.2

Full Changelog: v0.2.1...v0.2.2

vetto 0.2.1

What's Changed

• feat(rescue): ordinal regression diagnostics by @shleder in #6
• fix(rescue): harden against panic, allocation abort, silent flag ignore by @shleder in #7
• fix(rescue): harden claude reads, streaming discovery, honest index errors by @shleder in #11

Full Changelog: v0.2.0...v0.2.1

vetto 0.2.0

What's Changed

• release: Vetto 0.2.0-alpha.1 universal rescue by @shleder in #1
• fix: restore Codex rescue feedback diagnostics by @shleder in #2
• feat(rescue): bounded index-first Codex discovery by @shleder in #3
• security(rescue): centralize safe read-only source opening by @shleder in #4
• rescue: bounded end-to-end workflow, verified SQLite snapshots, public JSON contract by @boo651218-pixel in #5

New Contributors

• @shleder made their first contribution in #1
• @boo651218-pixel made their first contribution in #5

Full Changelog: v0.1.0...v0.2.0

vetto 0.2.0-alpha.2

Full Changelog: v0.2.0-alpha.1...v0.2.0-alpha.2