v1.17.0

Changelog

• 6688264 Merge pull request #228 from swarit-stepsecurity/swarit/chore/wt/changelog-1.17.0
• 1a0477e docs(changelog): correct the 1.17.0 section for what actually ships
• dc8cbdb Merge pull request #218 from raysubham/feat/agent-marketplace-plugins
• 31c6692 Merge branch 'main' into feat/agent-marketplace-plugins
• 012d4b5 Merge pull request #224 from swarit-stepsecurity/swarit/feat/wt/delta-run-config
• 7358439 Merge branch 'main' into swarit/feat/wt/delta-run-config
• 7e4a8ab Merge branch 'main' into feat/agent-marketplace-plugins
• 9fc8db8 Merge pull request #225 from swarit-stepsecurity/swarit/fix/wt/upload-url-retry
• 4a9bfdb Merge branch 'main' into swarit/fix/wt/upload-url-retry
• 0a985e6 Merge pull request #226 from raysubham/fix/tcc-protected-reads
• 0f6e749 fix(browserext): validate OS versions and bound live probes
• abe234f fix(browserext): skip protected browser reads on macOS 27
• b6d0d1f fix(telemetry): classify TLS alerts and proxy CONNECT rejections
• c3febaf fix(telemetry): classify non-error HTTP statuses and isolate the DNS test from proxies
• 6140ec5 feat(telemetry): tag upload failures with a stable cause code
• b730799 fix(telemetry): retry the upload-URL request
• 6adc278 fix(plugins): suppress uninstalled cache MCP servers
• 2b42e68 fix(plugins): preserve MCP findings when components are omitted
• 0e36ee2 docs(plugins): add 1.17 release notes
• e21bc2d Merge branch 'main' into feat/agent-marketplace-plugins
• 8da12c1 refactor(telemetry): remove local delta protocol overrides
• e5b8825 feat(telemetry): gate delta uploads on tenant run config
• ae20170 Merge pull request #223 from swarit-stepsecurity/swarit/fix/wt/delta-commit-on-ingest
• 545b5d9 fix(telemetry): only advance delta scan state when the backend accepted the upload
• 5839175 Merge pull request #220 from swarit-stepsecurity/swarit/chore/wt/up-ver-1.17.0
• adefc68 fix(plugins): resolve Claude linked payloads and root callables
• bb5e383 fix(plugins): correct scoped discovery and Codex metadata
• 01a210d chore(release): cover the ten PRs merged after the branch was cut
• 81346e2 Merge remote-tracking branch 'upstream/main' into swarit/chore/wt/up-ver-1.17.0
• 4db4d1d chore(release): update to 1.17.0
• 6a914b7 Merge pull request #219 from swarit-stepsecurity/swarit/fix/wt/windows-scheduled-popups
• 3c2e459 Merge main and preserve both changelog fix entries
• 37cc323 fix(plugins): preserve independent MCP suppliers and verified usage
• 6fa9c93 refactor(plugins): align agent plugins payload naming
• f19272c refactor(plugins): attach recorded usage to skill definitions
• c4294d0 Merge pull request #212 from swarit-stepsecurity/swarit/test/wt/delta-scan
• 26e6f62 Merge branch 'main' into swarit/test/wt/delta-scan
• 1c1a56a fix(plugins): preserve Windows plugin paths
• c28c27f Merge branch 'main' into feat/agent-marketplace-plugins
• 0a67ef1 Merge pull request #215 from swarit-stepsecurity/swarit/fix/wt/suspicious-file-perf
• 6d2f172 chore: leave version bump for release preparation
• c2eddd0 test(windows): run scheduler console regression tests natively
• d7e7028 fix(windows): suppress scheduled task registration probe consoles
• 93d7d2d fix(delta): preserve inventory for disabled and failed scans
• 439f62b fix(rules): reject symlink roots with trailing separators
• 0a58227 Merge branch 'main' into swarit/test/wt/delta-scan
• b3f57e1 Merge branch 'main' into swarit/fix/wt/suspicious-file-perf
• f4f3b6e test(plugins): clarify comments and strengthen regression coverage
• 811e3d5 fix(plugins): separate plugin scan phase
• 02649b4 feat(plugins): inventory Claude Code and Codex plugins
• 38f5d9b Merge pull request #216 from raysubham/feat/insomnia-credential-inventory
• 4c48668 fix(credentials): preserve literal Insomnia secrets and align golden fixture
• af2645a fix(rules): preserve prefixed matches for non-clean roots
• 9d3a960 Merge branch 'main' into swarit/fix/wt/suspicious-file-perf
• 58898d6 Merge branch 'main' into swarit/test/wt/delta-scan
• ee644a6 fix(credentials): preserve Insomnia protection beyond count cap
• 51bb813 feat(credentials): inventory Insomnia account and provider stores
• 1d8bfaf fix(credentials): allow targeted Insomnia reads on macOS
• ae17946 refactor(detector): tighten Insomnia source comments
• d5fa696 feat(detector): inventory Insomnia request credentials
• d439309 Merge pull request #206 from swarit-stepsecurity/swarit/fix/wt/mcp-plugin-catalog
• 5d3dbeb Merge branch 'main' into swarit/fix/wt/mcp-plugin-catalog
• ccb5711 perf(rules): reduce malicious-file scan CPU and redundant filesystem work
• 0a33c0e Merge pull request #213 from swarit-stepsecurity/swarit/fix/wt/global-pkg-paths
• 6d5ff2f fix(node): dedupe global roots and keep emptied ones
• 192b006 feat(delta): enable the scan-state delta upload protocol by default
• 13727b8 Merge branch 'main' into swarit/test/wt/delta-scan
• 9aaa8dd fix(delta): keep upload provenance on projects that shipped only a ref
• fd30cf6 fix(delta): let an empty venv converge instead of re-uploading forever
• e46b090 Merge branch 'main' into swarit/fix/wt/global-pkg-paths
• dcebba2 Merge pull request #210 from raysubham/feat/credential-scanning-toggle
• 819a297 Merge branch 'main' into feat/credential-scanning-toggle
• 569bece Merge pull request #205 from raysubham/feature/ai-agent-detection
• a3c9cf2 fix(node): report the root that global packages were found in
• 3a89cd9 Merge branch 'main' into feature/ai-agent-detection
• 356b951 Merge pull request #202 from raysubham/feature/npm-settings-device-policy
• c4fb039 Merge branch 'main' into feature/npm-settings-device-policy
• 2a49998 Merge pull request #200 from raysubham/fix/node-global-roots-user-home
• 4d70cfe docs: name Kiro CLI and list the Kiro IDE in the coverage tables
• 819cd78 test(detector): canonicalize Windows junction fixture home
• aeab106 test(executor): canonicalize guarded file fixture paths
• ea3ebff fix(detector): guard linked skill filesystem access
• ac20be6 feat(detector): inventory Kiro IDE, Kiro CLI and Kiro skills
• 0fceb48 Merge branch 'main' into fix/node-global-roots-user-home
• 33af33c fix(node): scope developer home resolution to macOS
• e1f90fa fix(node): preserve explicit Linux home overrides
• f9a8414 fix(versionmeta): use exported IsVersionLike in linux.go
• 114ae9a Merge branch 'main' into feature/npm-settings-device-policy
• 7e43eef Merge branch 'main' into feature/ai-agent-detection
• 93854c8 fix(devicepolicy): reject normalized npm setting collisions
• 222070f fix(detector): fail closed on derived-path resolution errors and guard Muse payload
• 07c5e90 Merge branch 'main' into feat/credential-scanning-toggle
• 88451cf Merge branch 'main' into swarit/fix/wt/mcp-plugin-catalog
• b186726 Merge pull request #207 from swarit-stepsecurity/swarit/feat/procusage-profiling
• b7ea470 fix(devicepolicy): log enforcement failures at default level
• 4cb6007 fix(rungate): keep the non-200 error snippet at 64 KiB
• b579ce3 fix(rungate): read wsl_directive only with a usable scan_directive
• b493e18 refactor(rungate): resolve credential setting per invocation
• a66d15a Merge branch 'main' into feat/credential-scanning-toggle
• 616b64b feat(rungate): honour tenant credential-scanning setting
• 61fc1cb docs(procusage): correct stale log-level and ReadMemStats comments
• bfc887d fix(devicepolicy): preserve npm MDM metadata compatibility
• 27821b5 test(procusage): benchmark the instrumentation overhead
• 24f9ca4 Merge branch 'main' into fix/node-global-roots-user-home
• 6e95902 test(procusage): pin the history file's disk footprint
• 2acdb9e fix(procusage): report CPU as a share of the machine, not of wall time
• 40de4e7 fix(procusage): log resource usage at info, inside the captured payload
• 5889831 feat(procusage): profile CPU and memory cost of every run
• 38dfa6a Merge pull request #193 from swarit-stepsecurity/swarit/fix/wt/177
• 19b9ff9 Merge branch 'main' into swarit/fix/wt/177
• 4e7cbff Merge pull request #196 from swarit-stepsecurity/swarit/fix/wt/pop-ups-ubuntu
• 9dee989 Merge branch 'main' into swarit/fix/wt/pop-ups-ubuntu
• 679fa3b Merge branch 'main' into swarit/fix/wt/177
• f5ddac6 Merge branch 'main' into swarit/fix/wt/mcp-plugin-catalog
• f3e7a81 Merge pull request #198 from swarit-stepsecurity/swarit/feat/wt/wsl-v1
• fb18788 Merge branch 'main' into swarit/feat/wt/wsl-v1
• 5bfd058 fix(wsl): teach every MSI build about the Linux component
• e0082c3 fix(detector): stop counting plugin catalog templates as MCP servers
• dbc5df2 Merge branch 'main' into fix/node-global-roots-user-home
• 1a07c86 fix(detector): guard derived Muse and Hermes paths and tighten mise and muse-bin identity
• 7288652 Merge remote-tracking branch 'upstream/main' into feature/ai-agent-detection
• 81561e2 feat(detector): detect Grok Build, Kimi Code, Muse Code, Hermes Agent, Oh My Pi
• a2724e7 Merge pull request #203 from raysubham/fix/rule-scan-filename-prefilter
• daf7226 feat(devicepolicy): support settings-only npm policies
• f58dd4a perf(rules): pre-filter walk by fixed glob filename
• d6184b6 Revert "fix(devicepolicy): authenticate npm tarball downloads"
• 6ca6eb9 fix(devicepolicy): authenticate npm tarball downloads
• e483af0 fix(devicepolicy): retain rendered npm policy for reports
• e1981e6 fix(devicepolicy): report npm settings evidence
• 0ef1dc3 chore: drop CHANGELOG.md edit to resolve conflict with main
• f39def8 feat(wsl): ship the Linux agent in the MSI for WSL scanning
• 8700257 fix(tcc): honor explicit network-volume walk roots for their descendants
• 624c63e feat(wsl): gate a distro scan under its own device identity
• e941d4d fix(wsl): keep a triggered distro scan from being reaped with the agent
• 4329a0d feat(devicepolicy): support managed npm settings
• 479d0e7 Merge pull request #199 from raysubham/feature/go-package-device-policy
• 1e82303 fix(devicepolicy): ignore absent Go sibling file
• ff97b11 test(devicepolicy): align Windows netrc lifecycle
• 27f25ec fix(devicepolicy): isolate Windows netrc ownership
• 702f37b fix(devicepolicy): report marker-owned Go MDM drift
• 0f1bb34 feat(wsl): trigger a scan inside each running WSL distribution
• 6381325 fix(node): resolve global roots from developer home
• cd67b3f test(devicepolicy): align Windows shared netrc lifecycle
• caf3e77 fix(devicepolicy): prefer underscore netrc on Windows
• a894f29 fix(devicepolicy): align DMG Go env CRLF marker
• b8cc5af fix(devicepolicy): recognize MDM Go env CRLF marker
• 52052b4 fix(devicepolicy): align Windows Go netrc handling
• d8210d8 test(devicepolicy): align Windows netrc coexistence
• 744a377 fix(devicepolicy): preserve Windows netrc coexistence
• 57329f4 fix(devicepolicy): correct Windows Go registry files
• a451578 feat(wsl): identify a scan running inside a WSL distro
• d8e6a9b test(devicepolicy): align Go env test naming
• 6dc59c2 fix(devicepolicy): preserve Go env formatting on Windows
• c13da42 fix(devicepolicy): rename shared registry credential markers
• bd738e4 feat(devicepolicy): add Go package configuration policy
• f759915 Merge branch 'main' into swarit/feat/wt/wsl-v1
• 3df0beb docs(wsl): drop the internal branch reference from the feature gate comment
• 21e6078 feat(wsl): carry a tenant-wide wsl_directive out of the run-config check-in
• a14373c feat(wsl): report the distro GUID and default uid, gate the running probe
• 3891892 Merge pull request #197 from raysubham/feature/python-package-device-policy
• bdfd3f2 style(devicepolicy): fix NewWriter doc comment
• 5f11b70 test(devicepolicy): secure generated pip fixtures on Windows
• e6f9399 fix(secureuserfile): verify mapped Windows ACL rights
• 1eeb074 fix(devicepolicy): harden package config enforcement
• ce08dd5 test(devicepolicy): cover misplaced netrc ownership records
• 38f9828 fix(devicepolicy): reject nested netrc ownership records
• f7003a7 Revert "chore: bump version to 1.17.0"
• ca9c54b chore: bump version to 1.17.0
• bc98519 fix(devicepolicy): make netrc ownership uv-compatible
• 1c8a81d fix(devicepolicy): report npm evaluated policy hash
• 3549114 fix(devicepolicy): normalize PyPI ownership markers
• a6e3ff8 fix(devicepolicy): set Windows secure file owners
• 0570937 test(devicepolicy): normalize Windows test ownership
• c3d2281 fix(devicepolicy): isolate Python client failures
• f68f515 fix(devicepolicy): preserve secure file trust boundaries
• 7319dc4 test(devicepolicy): keep platform helpers local
• 3f89e91 docs: remove unrelated formatting changes
• d1111ca test(devicepolicy): consolidate Python policy coverage
• 57047c4 fix(devicepolicy): restore removed relative-symlink targets
• b2685f7 refactor(devicepolicy): isolate secure user files from npm
• 65422ad refactor(devicepolicy): simplify package policy dispatch
• 18cb395 test(devicepolicy): remove standalone Python index server
• c14ee48 feat(wsl): detect host-side WSL presence and active use
• d0ebe6d refactor(devicepolicy): remove offline Python policy mode
• 797490d fix: reopen Windows security handles safely
• f7b225d feat: add PyPI package configuration device policy
• 3a56452 fix(execguard): return the refusal reason instead of assuming Gatekeeper
• 610fc56 Merge branch 'main' into swarit/fix/wt/pop-ups-ubuntu
• 6ea19df Merge pull request #85 from swarit-stepsecurity/swarit/fix/issue-83
• e30f263 Merge branch 'main' into swarit/fix/issue-83
• 671575d fix(detector): stop launching desktop apps for version probes on linux
• 3de651e feat(execguard): refuse electron app entry points on linux
• efa8826 feat(versionmeta): add dpkg, snap and appimage static sources
• fc7f73e test(tcc): lock in that default runs behave exactly as before the toggle
• 0acb912 feat(tcc): give MDM fleets a way to answer the network-volume prompt
• f8cbf15 Merge branch 'main' into swarit/fix/issue-83
• 420f78a fix(readme): update download instructions