v2.8.0

[2.8.0] - 2026-10-10

Added

• The Vaara MCP server and vaara-mcp-proxy record the client that connects to them over stdio. On initialize they walk the process table above themselves, past launchers such as npx, uvx and sh, to the first agent Vaara has an adapter for, and keep the client's own clientInfo beside it. One agent_seen record goes to the agents trail that vaara scan --watch writes, as governed, reachable or ungoverned, so the macOS app notifies when an agent Vaara does not govern connects. When only clientInfo names the client, the record says so. The record is written once per process, off the request path, and a session that ends straight after initialize waits up to three seconds for it. VAARA_BEACON=0 turns it off. Over HTTP nothing is recorded, since there is no parent process to read.
• Authority decay (vaara.authority). A session's room to act shrinks as its risk adds up, and a person's approval restores it. Each session starts with a budget of 3.0. An allowed call spends the part of its risk score above 0.3, so routine calls cost nothing, and an escalated or denied call spends its whole score. Spent budget comes back by half every hour. When an allowed call would leave less than 1.0, it is escalated to a person instead, with the reason on the record, and a person approving an escalation in the session refills the budget. Decay only turns an allow into an escalate and never loosens a decision. It runs after the replay of prior approvals, so a cached approval does not undo it. The budget is not stored anywhere: it is replayed from the session's own records on the trail (decisions, risk scores, human resolutions and their timestamps), so the per-call hook sees the same budget a long-running proxy does, and a reviewer can recompute from the chain why a call was escalated. Calls without a session_id are not decayed. VAARA_AUTHORITY_BUDGET sets the budget, and 0 or off turns it off; InterceptionPipeline(authority=...) takes an AuthorityPolicy. The policy file has no setting for it yet.

Fixed

• A heredoc body is matched again when the same command changes what its reader runs. cat() { bash; }; cat <<EOF ran the body as shell while the Bash rules skipped it as file content. A function or alias named cat, tee, python or node, an assignment to PATH, BASH_ENV or ENV, or enable now keeps every body matched.