v0.3.29

What's Changed

• [ENG-3666] Add comment and explanation guidance for agents by @devlob in #163
• [feat] ENG-3684 - Carry the production marker to server-rendered builds by @mariojgt in #165

Full Changelog: v0.3.28...v0.3.29

v0.3.28

What's Changed

• Report detections the guard did not block, not only the ones it did by @patchstackdave in #156
• Fix an unresolved import, and declare the reporting capability by @patchstackdave in #157
• Say so at boot when a site UUID has no credential behind it by @patchstackdave in #158
• Say what a refused request means, instead of its status code by @patchstackdave in #159
• Stop a host's callback from breaking the guard that calls it by @patchstackdave in #160
• Disclose detection reporting, and stop claiming it does not exist by @patchstackdave in #161
• [feat] Add a command reference table to AGENT-INSTALL.md by @mariojgt in #162

Full Changelog: v0.3.27...v0.3.28

v0.3.27

What's Changed

• Read the host out of a URL for the internal_host match by @patchstackdave in #152
• [ENG-3568] Stop login hanging when an assistant runs it by @mariojgt in #155

Full Changelog: v0.3.26...v0.3.27

v0.3.26

What's Changed

• [ENG-3630] Say request-path shielding is applicable, and generate the demo maps by @patchstackdave in #151
• [ENG-3568] Document login for the agents that will run it by @mariojgt in #153
• [ENG-3568] Use one credential for Pulse ingest and block-logs by @mariojgt in #154

Full Changelog: v0.3.25...v0.3.26

v0.3.25

What's Changed

• [ENG-3568] Point login at the approval page, not the API root by @mariojgt in #150

Full Changelog: v0.3.24...v0.3.25

v0.3.24

What's Changed

• [ENG-3386] Signal Patchstack when the package is uninstalled from a project by @daniloradovic in #103
• chore(deps): bump postcss from 8.5.14 to 8.5.25 by @dependabot[bot] in #104
• fix(protect): egress redirect re-screening + redaction case-sensitivity + IPv6-ULA over-match by @patchstackdave in #105
• feat(protect): thread request into the response phase + cheap prefilter for response rules by @patchstackdave in #106
• feat(protect): default vendor-secret redaction + prefilter anchors + ReDoS test by @patchstackdave in #107
• fix(protect): don't buffer live streams (SSE) in response screening by @patchstackdave in #108
• feat(protect): off_origin match type for open-redirect detection by @patchstackdave in #109
• feat(protect): cors_reflected match type for CORS-misconfiguration detection by @patchstackdave in #110
• feat(protect): response header-mutation actions (set / remove / harden-cookie) by @patchstackdave in #111
• examples/protect: demo the static-rule delivery + remote-promotion chain via Pulse by @patchstackdave in #112
• egress: stop screening WebSocket egress (hostname-only check over-promised the control) by @patchstackdave in #113
• protect: input-handling robustness pass (canonicalization + edge cases) by @patchstackdave in #114
• protect: expose uploaded-file data (content/type) for rule-driven inspection by @patchstackdave in #115
• protect: keep the runtime edge-safe (load Node fs lazily) by @patchstackdave in #117
• protect: make fail-open observable; stop startup hanging on the rule API by @patchstackdave in #118
• protect: validate delivered rule bundles; bound patterns; harden the telemetry origin by @patchstackdave in #119
• map: build-time input-flow (attack-surface) map command by @patchstackdave in #116
• map: trace imported helpers; protect: ship a real edge build by @patchstackdave in #120
• protect: accept live rule updates atomically; reject rule_id-less whitelists by @patchstackdave in #121
• test: prove edge conditional-export resolution + verify with the real Workers bundler by @patchstackdave in #122
• map: match full input paths and bind flows to the exact sink call by @patchstackdave in #123
• map: runtime parameter coordinates, spans and fingerprints (schema v2) by @patchstackdave in #124
• map: adapter summaries — argument roles and narrow candidate families by @patchstackdave in #125
• map: report why an endpoint is unmodellable; make the coverage and sink schema honest by @patchstackdave in #126
• refactor: split src/map/extract.ts into cohesive modules (no behaviour change) by @patchstackdave in #127
• map: keep the request namespace through renamed destructuring by @patchstackdave in #128
• map: require an attributable receiver before a sink can auto-generate a rule by @patchstackdave in #129
• map: standing adversarial corpus category (+ fix a wrong pin it found) by @patchstackdave in #130
• map: input identity is (address space, path); confidence becomes a taxonomy (schema v3) by @patchstackdave in #131
• map: resolve a client imported from a local module to its dependency by @patchstackdave in #132
• docs: describe the map's confidence tiers accurately by @patchstackdave in #133
• [ENG-3564] map: upload the attack surface to Pulse behind an explicit --upload flag by @patchstackdave in #134
• [ENG-3567] protect: honour a per-rule dry-run, so a generated rule can detect while others block by @patchstackdave in #135
• map: inventory every imported package, and mark the ones we cannot model by @patchstackdave in #136
• map: one versioned capability contract instead of five copies by @patchstackdave in #137
• [ENG-3582] map: record which dependency APIs the app calls, separately from dataflow by @patchstackdave in #139
• Resolve request headers by presence rather than truthiness by @patchstackdave in #140
• Report unresolvable imports so completeness never certifies a blind spot by @patchstackdave in #141
• Name a dependency API only where the package supplies the name; reach the file that calls it by @patchstackdave in #142
• Make the ladder's non-vacuity control assert something, and emit its maps by @patchstackdave in #143
• Put the authored rule shapes in CI, where they cannot rot by @patchstackdave in #144
• Give the reachable rung both sides of the actionable boundary by @patchstackdave in #146
• Report the deployment artifacts a project declares by @patchstackdave in #147
• Classify whether the app has a server side, from positive signals only by @patchstackdave in #148
• [ENG-3568] Pulse ingest authentication — 2/3 connect bearer token by @mariojgt in #149

Full Changelog: v0.3.23...v0.3.24

v0.3.23

What's Changed

• Report blocks via existing connector /api/logs/log by @mariojgt in #102

Full Changelog: v0.3.22...v0.3.23

v0.3.22

What's Changed

• [feat] ENG-3311 - Clarify uninstall status after site removal by @daniloradovic in #100
• [NO-Ticket] paywall ability widget by @mariojgt in #101

New Contributors

• @daniloradovic made their first contribution in #100

Full Changelog: v0.3.21...v0.3.22

v0.3.21

What's Changed

• refactor(protect): rules/ folder (source · store · refresh) + refresh loop, push, tiered store by @patchstackdave in #99

Full Changelog: v0.3.20...v0.3.21

v0.3.20

What's Changed

• feat(protect): DNS-rebinding resistance for egress (Node http path) by @patchstackdave in #89
• feat(protect): broaden Express body-parser recognition by @patchstackdave in #90
• test(protect): per-vuln-class rule corpus + rename example-rule test by @patchstackdave in #91
• feat(protect): structural (path-scoped) response redaction + per-rule size-cap override by @patchstackdave in #92
• fix(protect): robustness & hardening across the guards, egress, rule loading, and installer by @patchstackdave in #93
• feat(protect): encode action, route/method scope, cross-origin match, streaming body cap by @patchstackdave in #94
• feat: include runtime protection in setup by @ejntaylor in #95
• feat(protect): live rule refresh for long-lived sandbox runtimes by @ejntaylor in #96
• feat(protect): fetch DNS screen, response streaming cap, node multipart, lossless big-int masking, Nuxt by @patchstackdave in #97
• feat(protect): re-post the manifest on the sandbox refresh tick by @ejntaylor in #98

Full Changelog: v0.3.18...v0.3.20