v0.16.0

What's Changed

• feat(agent): add agent session listing and revocation in #37
• fix(agent): enforce egress containment in #38
• feat(agent): add bulk agent session revocation in #39

Full Changelog: v0.15.0...v0.16.0

v0.15.0

This release improves the Stashbase agent workflow for interactive coding agents, macOS filesystem policies, and dependency-install checks.

Highlights

• Add optional dependency security hooks for Codex, Claude, and Cursor. Install, check, and remove hooks with stashbase agent hooks deps; hooks inspect supported package-install
  commands before they run. #36
• Preserve TTY streams and interactive stderr auditing for child processes launched through stashbase agent run. #34
• Allow Codex to edit normally when running under Stashbase macOS filesystem policies, while retaining the configured workspace boundaries and persistent Codex state. [#35](https://
  github.com//pull/35)

Included pull requests

• #34 — Preserve TTY streams for interactive children
• #35 — Allow Codex edits with macOS filesystem policies
• #36 — Add dependency security hooks

v0.14.1

Fixes

• Align HTTP MCP credential resolution with agent run.
• Resolve credentials by canonical binding source, not the child env alias.
• Keep MCP inspection deterministic: configured dotenv file or Stashbase source only.

PR #33

v0.14.0

HTTP MCP Server Support for Agent Profiles

Added support for configuring, inspecting, and enforcing HTTP MCP servers in agent profiles.

Agent profiles can now define named MCP servers with their endpoint, credential binding, authentication headers, and tool access policies.

Example configuration

[secrets.LINEAR_API_KEY]
env = "LINEAR_API_KEY"

[[secrets.LINEAR_API_KEY.rules]]
effect = "allow"
hosts = ["mcp.linear.app"]
methods = ["GET", "POST"]
paths = ["/mcp"]

[mcp_servers.linear]
url = "https://mcp.linear.app/mcp"
binding = "LINEAR_API_KEY"
allow_tools = ["search_issues", "get_issue"]

Custom authentication headers are also supported:

[mcp_servers.example]
url = "https://mcp.example.com/mcp"
binding = "SHARED_TOKEN"
header = "X-API-Key"
value_template = "{value}"

Tool access is denied by default. Use an explicit wildcard to allow all tools:

[mcp_servers.linear]
url = "https://mcp.linear.app/mcp"
allow_tools = ["*"]
deny_tools = ["delete_issue"]

Deny rules always take precedence over allow rules.

MCP commands

Inspect a configured MCP server and its available tools:

stashbase agent mcp tools \
  --profile linear \
  --server linear

Inspect a server through a remote Agent Proxy session:

stashbase agent mcp tools \
  --remote \
  --profile linear \
  --server linear

Interactively configure the tools allowed for a server:

stashbase agent mcp configure \
  --profile linear \
  --server linear

Check a tool against the configured policy without contacting the server:

stashbase agent mcp check \
  --profile linear \
  --server linear \
  --tool search_issues

Verify configured tool names against the server’s tools/list response:

stashbase agent mcp verify \
  --profile linear \
  --server linear

Security and enforcement

The Agent Proxy now:

• Supports named HTTP MCP servers in agent profiles.
• Filters denied tools from tools/list.
• Rejects unauthorized tools/call requests.
• Enforces MCP rules in both local and remote sessions.
• Separates MCP tool authorization from credential injection permissions.
• Supports remote binding resolution.
• Records MCP tool information in audit events.
• Supports paginated tools/list responses.
• Validates MCP server URLs, bindings, headers, and tool policies.
• Provides improved diagnostics and error handling.

MCP policies apply to HTTP-based transports, including Streamable HTTP. Stdio MCP servers are not covered because their JSON-RPC traffic does not pass through the HTTP proxy.

v0.13.0

Removed agent command-denial policies and the agent command inspection command.

Command restrictions were removed because application-level command wrappers cannot provide a reliable security boundary across all agents and elevated execution paths.

Retained protections

• Agent Proxy credential injection and HTTP policy enforcement
• Egress host restrictions
• Filesystem restrictions within the supported OS sandbox
• Agent profile validation, inspection, and audit logging

Future command restrictions may return with a containerized execution backend that provides a stronger, consistent boundary.

v0.12.1

This release improves Linux agent filesystem enforcement and runtime diagnostics.

Highlights

• Added bubblewrap as a fallback filesystem-enforcement backend when systemd-run --user is unavailable.
• Preserved systemd-run --user as the preferred Linux backend.
• Added fail-closed behavior when neither backend is available or usable.
• Improved filesystem backend reporting in:
  • agent validate
  • agent doctor
  • agent explain
• Preserved existing deny_read and deny_write semantics.
• Fixed Linux systemd probing and CI compatibility.
• Added and improved backend-selection and bubblewrap mapping tests.
• Updated Linux filesystem-enforcement documentation.

Linux backend order

systemd-run --user → bubblewrap → fail closed

Bubblewrap requires a working installation and usable unprivileged user/mount namespaces. Network sandboxing with --sandbox continues to require a working systemd user session.

Existing file descriptors and data already loaded into process memory remain outside filesystem enforcement.

v0.12.0

Agent policy controls

This release adds stronger controls for running coding agents safely through Stashbase.

Added

• Deny specific agent commands with [commands].denied.
• Block agent reads and writes to protected filesystem paths with [filesystem].
• Support policy-only local agent profiles without secrets or credentials.
• Fail closed when filesystem enforcement is unavailable on the platform.
• Add structured policy-denial reporting where the proxy can observe the denial.
• Record directly observed command and filesystem denials in local audit logs.
• Improve path normalization and matching to avoid false positives.
• Add command-policy inspection and validation support.
• Update agent profile templates and documentation.

Example

[commands]
denied = ["ssh", "sudo", "docker"]

[filesystem]
deny_read = [".env", "~/.ssh"]
deny_write = [".git", "~/.ssh"]

Filesystem enforcement uses macOS Seatbelt or Linux systemd user-session
sandboxing. Some nested agent-tool errors may still appear as native operating
system errors when the agent consumes and re-emits them.

This release is version 0.12.0.

v0.11.0

Remote Agent profiles now support Personal Credentials: account-owned credentials that remain private and are resolved only by Agent Proxy sessions.

Highlights

• Add [personal_credentials.*] bindings for Remote Agent sessions.
• Support profiles containing secrets, Personal Credentials, or both.
• Personal Credential-only profiles do not require a project, environment, or local file.
• Generate identical Agent Proxy placeholders and MCP authorization headers for secret and Personal Credential bindings.
• Improve binding validation, policy output, and profile summaries.
• Reject local runs that include Personal Credential bindings with a clear validation error.

Configuration update

Project and environment identifiers now belong under [secrets]:

[secrets]
project = "project"
environment = "environment"

[secrets.GITHUB_TOKEN]

Use Personal Credentials for account-owned Remote Agent credentials:

[personal_credentials.LINEAR_API_KEY]

[[personal_credentials.LINEAR_API_KEY.rules]]
effect = "allow"
hosts = ["mcp.linear.app"]
methods = ["GET", "POST"]
paths = ["/mcp"]

Personal Credentials work only with stashbase agent run --remote. The CLI never fetches, prints, exports, or stores their raw values.

v0.10.0

This release adds credential profiles for working with multiple Stashbase API keys and workspaces from one CLI installation.

Highlights

• Add named credential profiles via stashbase config profile
• Store each profile’s API key securely in the system keychain/secure store
• Select a profile with STASHBASE_PROFILE
• Configure a default profile for normal local use
• Show the resolved profile in stashbase whoami
• Clearly indicate when STASHBASE_API_KEY or --api-key overrides the profile credential
• Add masked API key output with stashbase config api-key print
• Preserve the existing single-workspace workflow through the implicit default profile

Example

stashbase config profile add acme --workspace acme
STASHBASE_PROFILE=acme stashbase whoami

Existing users do not need to change anything: the CLI continues using the default profile automatically.

v0.9.1

v0.9.1

Fixes agent-profile secret environment bindings for local agent runs.

env is now honored as the environment variable exposed to the child agent:

[secrets.GITHUB_TOKEN]
env = "GH_TOKEN"

This makes the GITHUB_TOKEN secret available to the agent as $GH_TOKEN. The source variable ($GITHUB_TOKEN) is removed from the child environment to prevent it from bypassing the configured binding.

Includes regression coverage and updated agent-profile documentation.