# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [0.2.0] - 2026-03-27

### Added

- **security-bootstrap** hook — injects `SECURITY.md` safety rules into agent bootstrap context via `agent:bootstrap` event, providing defense-in-depth safety guidelines
- **secret-redactor** hook — scans outbound messages for leaked secrets (12+ patterns) and `[SECURITY_FLAG]` markers from bootstrap-injected rules
- **startup-checker** tests — 6 unit tests covering config validation
- **security-bootstrap** tests — 5 unit tests covering injection logic
- **secret-redactor** tests — 8 unit tests covering secret detection and flag monitoring
- Competitive landscape section in README (Knostic, ClawReins, OpenGuardrails, APort, NemoClaw)
- Architecture diagram in README showing defense-in-depth layers
- Known limitations and roadmap sections

### Fixed

- **startup-checker config paths** — switched from flat paths (`cfg.authMode`) to correct deep paths (`cfg.gateway.auth.mode`, `cfg.agents.defaults.sandbox.mode`, etc.) with safe `get()` helper using optional chaining
- **Data URI false positives** — replaced catch-all `data:image` regex with smart multi-factor assessment: valid image header check, MIME type filtering, and 500KB size threshold. Valid small PNG/JPEG/GIF/WebP images are no longer flagged
- **Empty catch blocks** — all hook handlers now log errors via `console.error` with hook name prefix and write error events to audit log
- **Startup checker checks** — expanded from 5 to 7 checks (added rate limiting, internal hooks, exec approval)

### Changed

- Test suite expanded from 68 to 90 test cases across 6 suites
- audit-logger now also subscribes to `agent:bootstrap` events
- README updated with v0.2 features, architecture diagram, competitive analysis, and known limitations

## [0.1.0] - 2026-03-27

### Added

- **secrets-scanner** hook — 21 regex patterns detecting API keys, tokens, and credentials (OpenAI, Anthropic, GitHub, AWS, Google, Stripe, Slack, Telegram, Discord, Vercel, npm, Twilio, SendGrid, Heroku, JWT, private keys)
- **prompt-injection-detector** hook — 9 injection patterns + 3 unicode attack patterns detecting direct prompt injection, jailbreak attempts, hidden instruction markers, and invisible text attacks
- **exfiltration-detector** hook — 5 patterns detecting covert data exfiltration via markdown images, suspicious links, reference-style beacons, data URIs, and base64-encoded URL paths (EchoLeak CVE-2025-32711)
- **audit-logger** hook — structured JSONL audit logging with 10MB auto-rotation
- **startup-checker** hook — 5-point security configuration audit with scored report
- Comprehensive test suite (68 test cases)
- English and Chinese README