v1.3.0 — turn: which of these did I just do?

1.2 answered which of these findings matters. This release answers the question a developer actually asks, dozens of times an hour: which of these did I just do?

1.3.0

• owlwarden turn — scans the files this turn touched, scans the same files at the base commit, and diffs the two. Findings are introduced, carried, or fixed. Carried findings never fail a turn, at any threshold.
• turn --hook claude-code | cursor | generic — the verdict in a host's own hook shape. init now wires the Stop hook to turn --record instead of gate --since HEAD.
• turn --record — one JSON line per turn in .owlwarden/turns.jsonl, bounded at the last 200.
• owlwarden.turn in the SDK, held to fixtures/golden/turn.json by the same cross-language contract as the scan report.
• --help is 41 lines, down from 161. Four commands on the first screen: turn, scan, vet, init. owlwarden help --all still prints everything.

Security

• wasmtime floored at 36.0.14 for RUSTSEC-2026-0269 (filesystem sandbox escape). Plugins are opt-in and refused under --ci without --allow-plugins; it is floored anyway.

Install

npm i -g owlwarden@1.3.0
# or
npx owlwarden@1.3.0 scan

- uses: suthat/owlwarden/action@v1.3.0

npm packages are published by the Release workflow on this tag (with provenance), not from a laptop.

See CHANGELOG.md.

v1.2.0 — exposure, seal, runtime overlay

1.1 answered what is here. This release answers the three questions a person asks immediately afterwards: what changed, what is reachable, and how often are we wrong?

1.2.0

• exposure — third axis on every application finding (internet / authenticated / internal / unknown). Fails loud: no identified gate means internet
• owlwarden seal — .owlwarden/surface.lock, a committed record of the agent execution surface
• owlwarden effective — resolved agent configuration with provenance per key
• Runtime overlay — findings carry the runtime their file runs on; SvelteKit, TanStack Start, SolidStart, and Elysia take the matrix to sixteen
• owlwarden bench — harness and corpus discipline; the corpus is empty and the tooling says so
• runtime_scope: shadowed — a project key a higher tier overrides, reported rather than suppressed

Security

• Gate evidence is clamped at one choke point
• 49 adversarial tests across the seal, tier resolution, the exposure classifier, and the benchmark

Install

npm i -g owlwarden@1.2.0
# or
npx owlwarden@1.2.0 scan

- uses: suthat/owlwarden/action@v1.2.0

npm packages are published by the Release workflow on this tag (with provenance), not from a laptop.

See CHANGELOG.md.

v1.1.0 — agent workspace surface, deterministic gate

A second scan surface and a control that always runs.

owlwarden answered one question: is the web application in this repository written safely? This release adds the second: is the coding agent that works in it being told to do something hostile?

1.1.0

• Eleven agent-workspace rules — hooks, MCP, permissions, marketplace, hidden instructions, plus install-lifecycle-script
• owlwarden vet — scan a repo you did not write: agent rules only, offline, no plugins
• owlwarden gate --host <claude-code|cursor|generic> — hook entry point; fails closed before a command, open after an edit
• owlwarden verify --patch — re-scan a scratch copy; exit 0 only if the finding is gone and nothing new appeared
• --since / --staged / --paths and --format agent
• owlwarden init --claude-code | --cursor | --generic wires the gate into the host

Security

• init never writes a SessionStart hook, and MCP is a local binary — shapes the new rules would report
• Plugin trust roots no longer come from the plugin's own directory
• --since that cannot resolve now fails instead of widening the scan
• Action inputs cannot become CLI flags; the Action itself actually runs (1.0's NUL guard rejected every invocation)

Install

npm i -g owlwarden@1.1.0
# or
npx owlwarden@1.1.0 scan

- uses: suthat/owlwarden/action@v1.1.0

npm packages are published by the Release workflow on this tag (with provenance), not from a laptop.

See CHANGELOG.md.

v1.0.0 — plugin API freeze, init adoption kit, Markdown reports

Stable: plugin API frozen, first-run path that lands in CI and in an agent.

1.0.0

• owlwarden init — no flags writes the adoption kit: agent-rules, a GitHub Action workflow, and .cursor/mcp.json
• --format md — Markdown grouped by severity, for PR comments (stackable with other formats)
• Plugin schemaVersion: 1 is frozen; breaking plugin-API changes go through docs/rfc/
• Tutorials, CLI and plugin-API reference, upgrade guide, comparison, MCP registry descriptor

Security

• --format md flattens newlines in untrusted prose and lengthens snippet fences so a hostile tree cannot open a fake heading or break out of a code block in a PR comment

Install

npm i -g owlwarden@1.0.0
# or
npx owlwarden@1.0.0 scan

- uses: suthat/owlwarden/action@v1.0.0

npm packages are published by the Release workflow on this tag (with provenance), not from a laptop.

See CHANGELOG.md.

v0.5.0 — active CSRF, offline OSV, plugin trust, CI depth

Depth beyond CI, plus the CI surface that never shipped as its own npm tag (0.4).

0.5.0

• csrf-cross-origin-post — canary cross-origin POST behind --allow-active (staging only)
• owlwarden osv update, --osv-db, fail-closed --osv --offline
• Plugin artifact.sha256, optional ed25519 .sig, trust roots, --require-signed-plugins
• Stackable --format (one scan, N renders)
• Incremental watch

Also in this publish (0.4.0, not separately tagged)

• --format sarif / --format junit
• GitHub Action at action/ — pin @v0.5.0
• Corpus depth, more Safe autofix, plugin inspect

Install

npm i -g owlwarden@0.5.0
# or
npx owlwarden@0.5.0 scan

- uses: suthat/owlwarden/action@v0.5.0

npm packages are published by the Release workflow on this tag (with provenance), not from a laptop.

See CHANGELOG.md.

v0.3.0 — OSV, Safe --fix, allow-active scaffold

[0.3.0] — 2026-08-10

Autofix (--fix), --allow-active scaffold, and opt-in Google OSV lookup.
Folded in the 0.2.1 docs/MCP polish so one publish updates npm homepage.

Added

• owlwarden scan --fix — applies Safe, single-line highlight
  replacements only. Never on Possible. Clean git tree by default
  (--allow-dirty to override). --dry-run and --fix-unsafe. Re-scans
  after writes. First Safe remediations: stack-trace-leak and weak-crypto
  (GuessableToken / Math.random()).
• --allow-active — with --target, permits state-changing HTTP methods.
  Rate-limited, request audit log (method/URL/status). No first-party active
  detector yet. MCP cannot set the flag.
• --osv — opt-in Google OSV QueryBatch for lockfile dependencies
  (ADR 0016). New rule
  known-vulnerable-dependency (A06 / CWE-1395). See
  docs/how-to/osv.md.
• AdvisoryClient port and Capabilities.advisory, distinct from target
  Transport scope.

Changed

• npm homepage → https://suthat.github.io/owlwarden/.
• Token narrative: save tokens with local baseline scans; spend frontier models
  on hard judgment (site, README, npm README, agent-integration).
• owlwarden mcp stderr ready banner / TTY how-to; stdout remains JSON-RPC-only.

Install: npm i -g owlwarden@0.3.0 or npx owlwarden@0.3.0

v0.2.0 — plugins, MCP, twelve frameworks

[0.2.0] — 2026-08-08

Plugins (source-only WASM), MCP for agents, and twelve Node frameworks. The
formal v0.2 bar from ROADMAP.md. Autofix and active checks stay
later work.

Added

• owlwarden-plugin-host — sandboxed WASM plugin host (ROADMAP v0.2),
  ships partial: source-only. A plugin is a .wasm module plus an
  owlwarden.plugin.json manifest, loaded with --plugin <path> (repeatable)
  and refused under --ci unless --allow-plugins is also passed. Every
  invocation runs in a fresh wasmtime store bounded by fuel, a 64 MiB
  StoreLimits memory cap, and a wall-clock deadline via epoch interruption;
  the only host function wired is emit_finding, and every claim it receives
  is re-validated against the plugin's own manifest before it becomes a
  finding. A manifest declaring network or active is refused at load
  time rather than silently downgraded — see
  ADR 0015. wasmtime is a new
  dependency, confined to this one crate with default features disabled
  (only cranelift/runtime/std); every other crate keeps
  #![forbid(unsafe_code)]. Floored at 36.0.13 — every earlier release has
  an open RUSTSEC advisory, several of them sandbox escapes.
• Sandbox-escape test suite (crates/plugin-host/tests/sandbox_escape.rs):
  fuel exhaustion, oversized memory.grow / table.grow, a finding flood, an
  undeclared rule id, an oversized why, and a benign positive control.
• Error code E_PLUGIN_INVALID for a plugin that could not be loaded.
• owlwarden mcp — stdio MCP server with scan_project, scan_file,
  explain_rule, and list_rules. Static and read-only; no --target, no
  file writes, paths sandboxed to the workspace root.
• owlwarden init --agent-rules — writes .owlwarden/agent-rules.md from
  the compiled catalogue.
• owlwarden plugin scaffold <name> — guest stub (plugin.wat) plus a
  valid owlwarden.plugin.json.
• Plugin-authoring schemas in @dointhai/owlwarden-sdk (pluginManifestSchema).
• Seven more Node frameworks with first-class profiles, remediation on every
  catalogue rule, and square fixture coverage: Hono, Koa, Hapi, Sails.js, Astro,
  Remix, and Gatsby. Supported set is now twelve stacks (12 rules × 12
  frameworks, locked in CI).
• Richer fixture corpus — each framework exercises two real-world shapes for
  ssrf (fetch + axios), open-redirect (redirect helper + Location
  header), and sensitive-data-logged (password + accessToken), plus tempting
  false-positive twins on every clean project.
• File-route mapping for Astro (src/pages/api), Remix flat routes, and
  Gatsby Functions (src/api).
• Request-origin recognition for Hono’s c context and Astro’s Astro.request.

Changed

• DetectorMeta.title / .category / .description are now
  Cow<'static, str> (were &'static str), so a WasmDetector built from a
  parsed plugin manifest can own its strings. No change to the JSON wire
  shape or to first-party rules, which still write string literals.
• README and npm package text rewritten in plain language: what it does, that
  it stays local, which frameworks it knows, and what v0.2 actually ships
  (plugins source-only, MCP read-only). States that local scans cover baseline
  checks without burning LLM tokens, and that deeper AI security review still
  belongs on high-impact work.
• Plugin hardening after whitebox review: O_NOFOLLOW + bounded reads for
  manifest/WASM load; StoreLimits on tables; plugin rule ids must be
  namespaced under the plugin id; source-only plugins cannot declare
  confirmed; why capped; MCP JSON-RPC lines capped; init /
  plugin scaffold use symlink-safe writes under the working directory; napi
  re-checks --ci + --allow-plugins.
• Fixture matrix tightened: every clean twin ships *tempting* and
  *safe-redirect* files; multi-fire rules are locked to named source shapes
  (fetch/axios, redirect/Location, …); the TypeScript e2e path asserts
  SHARED_FIRES counts on all twelve frameworks, not only Next.js.
• Cookie detection: nested setters (ctx.cookies.set), Hapi isHttpOnly /
  isSecure / isSameSite, and dropped false cookie matches on
  c.header / res.setHeader / bare serialize.
• Stack-trace rule recognises Koa-style ctx.body = … assignments.
• secureHeaders counts as header middleware for Hono.

Fixed

• cargo deny CI gate: allow CDLA-Permissive-2.0 for webpki-roots (Mozilla
  CA data via rustls/reqwest), and give the dynamic-engine dev-dep on
  owlwarden-transport a workspace version so it is not a path-only wildcard.

Security

• Prompt-injection hardening for MCP / agents / plugins. MCP tool results
  are wrapped in an OWLWARDEN_TOOL_RESULT trust-boundary envelope; free text
  is stripped of control/invisible characters and common chat role markers.
  Plugin why is sanitised at emit time; init --agent-rules tells agents to
  treat findings as evidence, not instructions.

v0.1.0

Passive dynamic engine and correlation. Confirmed is reachable for the first time, without opening active (state-changing) checks.

npx owlwarden@0.1.0 scan
npx owlwarden@0.1.0 scan --target http://127.0.0.1:3000/

Highlights

• --target / --scope — passive GET/HEAD/OPTIONS probes; CLI-only, never from project config
• Correlation raises agreeing security-headers-missing findings to confirmed, or clears a static gap when the live response already sets the headers
• Square fixture matrix — every catalogue rule × all five frameworks (12 × 5), with CLI live e2e
• napi scan is async so a live probe cannot deadlock the Node event loop

Distribution

Prebuilt binaries for macOS (x64, arm64), Linux (x64/arm64 glibc, x64 musl), and Windows (x64, arm64). Every package is published from CI with npm provenance.

Full notes in CHANGELOG.md.

v0.0.2

Static slice of the trust-and-noise work planned for v0.1: suppressions, baseline, three gap-closing rules, and watch. Still no network — the dynamic engine that makes Confirmed reachable remains later.

npx owlwarden@0.0.2 scan

Highlights

• Inline suppressions with a mandatory reason (// owlwarden-disable-next-line <rule> -- <reason>)
• Baseline mode (--baseline / --write-baseline) to report only new findings
• Three rules closing static-reachable OWASP gaps: unpinned-dependency, ci-unpinned-action, sensitive-data-logged
• owlwarden watch — re-scan on change, static only
• Security hardening for hostile scan targets (config opt-in, CI flags, symlink-safe writes, bounded reads)

Distribution

Prebuilt binaries for macOS (x64, arm64), Linux (x64/arm64 glibc, x64 musl), and Windows (x64, arm64). Every package is published from CI with npm provenance.

Full notes in CHANGELOG.md.

v0.0.1

First release. A static engine, a rule set, and honest reporting about what it
does and does not reach.

npx owlwarden scan

Nine rules across six OWASP Top 10 (2021) categories, with first-class
support for Next.js, Nuxt, NestJS, Express, and Fastify. Every finding
carries the fix inline, for the framework you actually use.

Run owlwarden coverage to see which categories the rules reach and which they
do not — computed from the rules compiled into the binary you installed, not
maintained by hand. "No findings" and "did not look" are different answers.

Safety

Passive only. The engine reads source and sends no requests, so it cannot change
the state of anything. There is no telemetry of any kind — not off by default,
absent.

Distribution

Prebuilt binaries for macOS (x64, arm64), Linux (x64/arm64 glibc, x64 musl), and
Windows (x64, arm64). Nothing is compiled or downloaded at install time. Every
package is published from CI with npm provenance.

Full notes in CHANGELOG.md.