v0.12.0

Agent policy controls

This release adds stronger controls for running coding agents safely through Stashbase.

Added

• Deny specific agent commands with [commands].denied.
• Block agent reads and writes to protected filesystem paths with [filesystem].
• Support policy-only local agent profiles without secrets or credentials.
• Fail closed when filesystem enforcement is unavailable on the platform.
• Add structured policy-denial reporting where the proxy can observe the denial.
• Record directly observed command and filesystem denials in local audit logs.
• Improve path normalization and matching to avoid false positives.
• Add command-policy inspection and validation support.
• Update agent profile templates and documentation.

Example

[commands]
denied = ["ssh", "sudo", "docker"]

[filesystem]
deny_read = [".env", "~/.ssh"]
deny_write = [".git", "~/.ssh"]

Filesystem enforcement uses macOS Seatbelt or Linux systemd user-session
sandboxing. Some nested agent-tool errors may still appear as native operating
system errors when the agent consumes and re-emits them.

This release is version 0.12.0.