v1.5.0

What's Changed

• Hook sys.path bootstrap + claude plugin validate wiring by @AnthonyLedesma in #53
• Add cut-release dispatcher + plugins notify by @AnthonyLedesma in #54
• Notify plugins via GitHub App token instead of long-lived PAT by @AnthonyLedesma in #55
• Bump plugins cut-release-reusable SHA for auto-changelog by @AnthonyLedesma in #56
• Bump plugins cut-release-reusable SHA for changelog filter fixes by @AnthonyLedesma in #57
• Pass App credentials to cut-release reusable and bump SHA by @AnthonyLedesma in #58
• Use client-id for plugins dispatcher App auth by @AnthonyLedesma in #59
• ci: bump github/codeql-action from 4.35.4 to 4.35.5 by @dependabot[bot] in #60
• ci: bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 by @dependabot[bot] in #61
• ci: bump github/codeql-action from 4.35.5 to 4.36.0 by @dependabot[bot] in #63
• Reduce bash-matcher friction, add corpus harness by @AnthonyLedesma in #64
• Cut 1.5.0 release by @tracine-plugin-dispatcher[bot] in #65

New Contributors

• @tracine-plugin-dispatcher[bot] made their first contribution in #65

Full Changelog: v1.4.1...v1.5.0

v1.4.1

What's Changed

• v1.3.1: close gh api graphql mutation bypass + coverage backlog by @AnthonyLedesma in #43
• Swap CLAUDE_AUTONOMOUS for permission_mode + ops primitives by @AnthonyLedesma in #44
• Close positional force-push bypass; tighten lint hatches; coverage + dead-code sweep by @AnthonyLedesma in #47
• Add shadow and off modes for allowlist by @AnthonyLedesma in #48
• Close gh api fused-equals and git bare-flag positional bypasses by @AnthonyLedesma in #49
• ci: bump github/codeql-action from 4.35.3 to 4.35.4 by @dependabot[bot] in #46
• ci: bump actions/setup-node from 4.4.0 to 6.4.0 by @dependabot[bot] in #45
• Strip leading globals in aws_s3 and kubectl matchers for specific deny reasons by @AnthonyLedesma in #50
• Add PermissionRequest hook for prompt telemetry; surface in guard noisy by @AnthonyLedesma in #51
• Cut 1.4.1 release; sync release-smoke deps to audited [dev] extras by @AnthonyLedesma in #52

Full Changelog: v1.3.0...v1.4.1

v1.3.0

What's Changed

• Update wheel-smoke CI for new guard test JSON shape by @AnthonyLedesma in #41
• Close end-of-flags bypass on admin extractors + env-var docs by @AnthonyLedesma in #40
• v1.3.0: strict AWS allowlist + admin-CLI flag-level policy by @AnthonyLedesma in #42

Full Changelog: v1.2.0...v1.3.0

v1.2.0

What's Changed

• Add RELEASING.md by @AnthonyLedesma in #36
• Flip admin CLIs to default-deny (v1.1.1) by @AnthonyLedesma in #37
• guard test: accept multiple commands in one invocation by @AnthonyLedesma in #38
• Prep v1.2.0 by @AnthonyLedesma in #39

Full Changelog: v1.1.0...v1.2.0

v1.1.0

What's Changed

• v1.1: new matchers, bug fixes, CLI filter flags, doc-drift sweep by @AnthonyLedesma in #32
• ci: bump github/codeql-action from 4.35.2 to 4.35.3 by @dependabot[bot] in #31
• Hook registry + shlex commit-message tokenization by @AnthonyLedesma in #33
• Bump to 1.1.0; align docs with shipped behavior by @AnthonyLedesma in #34

Full Changelog: v1.0.0...v1.1.0

v1.0.0

What's Changed

• ci: bump actions/checkout from 4.2.2 to 6.0.2 by @dependabot[bot] in #4
• deps: update pytest requirement from >=8 to >=9.0.3 by @dependabot[bot] in #1
• deps: update ruff requirement from >=0.6 to >=0.15.12 by @dependabot[bot] in #2
• ci: bump astral-sh/setup-uv from 3.2.4 to 8.1.0 by @dependabot[bot] in #5
• deps: update mypy requirement from >=1.11 to >=1.20.2 by @dependabot[bot] in #3
• Tighten credential, commit-validator, scope, and git -c matchers (Tier 1) by @AnthonyLedesma in #12
• Add guard migrate-log: one-shot rewrite of pre-v1 records to v1 by @AnthonyLedesma in #13
• Deny git -c core.hooksPath / core.attributesFile overrides regardless of value by @AnthonyLedesma in #14
• Snapshot first, capture concurrent tail in migrate-log by @AnthonyLedesma in #15
• Rename PyPI distribution to tracine-guard by @AnthonyLedesma in #16
• Cover pypy and filter/difftool/mergetool bypasses by @AnthonyLedesma in #17
• Polish CLI --version, epilogs, no-args exit code by @AnthonyLedesma in #18
• Harden public security posture by @AnthonyLedesma in #19
• Prep v1.0 release pipeline by @AnthonyLedesma in #21
• Lead with the audit log: copy rewrite by @AnthonyLedesma in #22
• Mark RC release tags as prerelease by @AnthonyLedesma in #24
• Use canonical TracineHQ casing in docs and manifests by @AnthonyLedesma in #25
• Run pytest suite against wheel-installed package in CI by @AnthonyLedesma in #26
• deps: update pytest-cov requirement from >=5 to >=7.1.0 by @dependabot[bot] in #6
• deps: update vulture requirement from >=2.13 to >=2.16 by @dependabot[bot] in #8
• ci: bump github/codeql-action from 3.35.3 to 4.35.2 by @dependabot[bot] in #9
• deps: update pre-commit requirement from >=3.7 to >=4.6.0 by @dependabot[bot] in #7
• v1.0 hardening: orchestration deny, allowlist, safe-IO, bypass closures by @AnthonyLedesma in #27
• Polish: force-push deny, CLI/build cleanup, test helpers, doc drift by @AnthonyLedesma in #28
• Release prep v1.0.0 by @AnthonyLedesma in #29
• 1.0 pre-tag hardening by @AnthonyLedesma in #30

New Contributors

• @dependabot[bot] made their first contribution in #4
• @AnthonyLedesma made their first contribution in #12

Full Changelog: https://github.com/TracineHQ/guard/commits/v1.0.0

v1.0.0rc2

What's Changed

• ci: bump actions/checkout from 4.2.2 to 6.0.2 by @dependabot[bot] in #4
• deps: update pytest requirement from >=8 to >=9.0.3 by @dependabot[bot] in #1
• deps: update ruff requirement from >=0.6 to >=0.15.12 by @dependabot[bot] in #2
• ci: bump astral-sh/setup-uv from 3.2.4 to 8.1.0 by @dependabot[bot] in #5
• deps: update mypy requirement from >=1.11 to >=1.20.2 by @dependabot[bot] in #3
• Tighten credential, commit-validator, scope, and git -c matchers (Tier 1) by @AnthonyLedesma in #12
• Add guard migrate-log: one-shot rewrite of pre-v1 records to v1 by @AnthonyLedesma in #13
• Deny git -c core.hooksPath / core.attributesFile overrides regardless of value by @AnthonyLedesma in #14
• Snapshot first, capture concurrent tail in migrate-log by @AnthonyLedesma in #15
• Rename PyPI distribution to tracine-guard by @AnthonyLedesma in #16
• Cover pypy and filter/difftool/mergetool bypasses by @AnthonyLedesma in #17
• Polish CLI --version, epilogs, no-args exit code by @AnthonyLedesma in #18
• Harden public security posture by @AnthonyLedesma in #19

New Contributors

• @dependabot[bot] made their first contribution in #4
• @AnthonyLedesma made their first contribution in #12

Full Changelog: https://github.com/TracineHQ/guard/commits/v1.0.0rc2