main (edge build a5598d6)

Unverified branch build from a5598d6.
Binary asset sha256 (threat-detect-linux-amd64): sha256:113a69f3c5bc8e2532b03753210b3f7087744e2abd2f5478457c6897b93a3049
Binary asset sha256 (threat-detect-linux-arm64): sha256:c5da250f1c789742b5642fc5986053c1b16a0e2a80657ce592a215d77396d865
Binary asset sha256 (threat-detect-darwin-x64): sha256:a9bb4977e1563d35efc0e8d692203dc523d3a5f764c4453595222773ab596170
Binary asset sha256 (threat-detect-darwin-arm64): sha256:0ad3430a5acd52ae9afd57f9cf5f40a90f521033bdcb2dd1f66d0c4bcf26df49
The Latest release continues to track the most recently promoted version.

v0.4.12

Binary asset sha256 (threat-detect-linux-amd64): sha256:4ea7a7ae7d0faaad1097f22566bb78361d1a856bf189e809686ad28ab964da05
Binary asset sha256 (threat-detect-linux-arm64): sha256:36c31e59d70255239ac6552b88518dc0f5f1841a226b0d916353481c18c282fa
Binary asset sha256 (threat-detect-darwin-x64): sha256:b955441bc83a6a077997ff31aafdc60d047a774f132d47ee5b2d6026a58d06c1
Binary asset sha256 (threat-detect-darwin-arm64): sha256:c7ed5c5fca279b6cb6057ffa4aaf50dd383dece38739579cd4307d47e9aeef25

What's Changed

• fix(monitor): surface warn-mode detection failures after gh-aw #52400 by @davidslater in #880
• chore(workflows): bump standalone smoke locks to gh-aw v0.87.0 by @davidslater in #881
• chore(workflows): recompile detection-failure-monitor lock by @davidslater in #887
• chore(smoke): run make build in claude-standalone smoke instead of make test by @davidslater in #888
• fix(smokes): require strictly sequential steps in standalone smoke prompts by @davidslater in #889
• feat(workflows): add daily gh-aw detection statistics workflow by @davidslater in #890
• chore(workflows): bump claude smoke model to claude-sonnet-5 by @davidslater in #891
• fix(engine): grant Read tool and acceptEdits permission mode to Claude by @davidslater in #895
• fix(stats): follow artifact redirect so detection verdicts are actually fetched by @davidslater in #893
• fix(detection-stats): treat external as default and scope reported_reasons to it by @davidslater in #911
• chore(workflows): bump gh-aw to v0.86.2 and v0.87.1 by @davidslater in #915
• feat(workflows): add gh-aw threat-detection issue digest by @davidslater in #917
• feat(detector): add --engine-timeout and --max-turns kill switches for runaway models by @davidslater in #918

Full Changelog: v0.4.11...v0.4.12

v0.4.11

Binary asset sha256 (threat-detect-linux-amd64): sha256:9e637f34a417bb66cbdfd54dc303ae1128251da71d8c53071b47b12c243735d2
Binary asset sha256 (threat-detect-linux-arm64): sha256:06becf3ace098d482429c65e5a20c0390de355756d590f5c7a510b3120299f4a
Binary asset sha256 (threat-detect-darwin-x64): sha256:da632999dce209437e09ed24f98ed3aff4381f65fe8744457d76340015dc3650
Binary asset sha256 (threat-detect-darwin-arm64): sha256:8d8e55f2e785d0dac181274aa0de62005750509df03a38f6cdf6bc891afdf5fa

What's Changed

• chore(workflows): enable gh-aw-detection on monitor workflows by @davidslater in #878

Full Changelog: v0.4.10...v0.4.11

v0.4.10

Binary asset sha256 (threat-detect-linux-amd64): sha256:65c594ad8b811c1fe24902e83eee97eea1bf5767ffe28b7c3d7e3c9bd6489dfa
Binary asset sha256 (threat-detect-linux-arm64): sha256:4926813adb3cf376c72a7591c4b57dc62069b087606142ab4c61bf93f65e8eae
Binary asset sha256 (threat-detect-darwin-x64): sha256:cdeb300f335e933d86f5debe0775cce0ed78860dbf152edd9ea5bade0a02546b
Binary asset sha256 (threat-detect-darwin-arm64): sha256:37365c170f7dbf3d7f8021ee7c081ea8c6059624adf225a46cd95b92238c56cb

What's Changed

• fix(logs): close legacy workflow-command gaps and stop truncating reasons by @davidslater in #855

Full Changelog: v0.4.9...v0.4.10

v0.4.9

Binary asset sha256 (threat-detect-linux-amd64): sha256:e622c497cf37b4cabb2513224bb48f88d748dc793aae56b6d95a0688c07a7232
Binary asset sha256 (threat-detect-linux-arm64): sha256:3de7e79cb5ddaad4529669539a47265f115c7e0ef2929957a209f440352bc1c1
Binary asset sha256 (threat-detect-darwin-x64): sha256:c1f841688af02699d4770348470763297ce2e9c0f72245b7d2e58f2bb57a5b2f
Binary asset sha256 (threat-detect-darwin-arm64): sha256:ac2725ff73a8ca3a10214d54dac8d0a0c7720f075f1684488444aeecd76982b8

What's Changed

• fix(workflows): recompile standard locks with gh-aw v0.86.2 by @davidslater in #849
• fix(engine): frame forwarded engine output so it cannot forge diagnostics by @davidslater in #851
• feat(detector): require forensic, locatable reasons for detections by @davidslater in #852
• feat(detector): split reasons out of the published detection result by @davidslater in #854

Full Changelog: v0.4.8...v0.4.9

v0.4.8

Binary asset sha256 (threat-detect-linux-amd64): sha256:d848faf68acd4e200e0d1b55fe0429de8d2666aadf81a76c26aa19d7da73c80f
Binary asset sha256 (threat-detect-linux-arm64): sha256:11f31efdba81fe70cd2380142d0490ea820ffeaa8907cfa6fcc4eb6b51a54268
Binary asset sha256 (threat-detect-darwin-x64): sha256:db338cdbbcbd4107eb4b82bb8b17aa11ce825f56c1c724431cd1d5bc04fff751
Binary asset sha256 (threat-detect-darwin-arm64): sha256:c54dcf818707c2af2f38a9f5c3b452cb676c0124517ebde7fd7deffded00bdc2

What's Changed

• fix(detector): handle host-removed gh-aw framework <system> preamble by @davidslater in #829
• fix(smoke): replace unsatisfiable web-fetch check with curl egress check by @davidslater in #830
• fix(detector): harden host-removal marker and match host preamble grammar by @davidslater in #831
• fix(detector): bound and sanitize the open-text reasons in detection_result.json by @davidslater in #803
• chore(workflows): recompile standalone smokes with gh-aw v0.86.2 by @davidslater in #832

Full Changelog: v0.4.7...v0.4.8

v0.4.7

Binary asset sha256 (threat-detect-linux-amd64): sha256:7c83e20a6319e773d29ea8579f216f15079691647fe39fda16b10d6c19664b28
Binary asset sha256 (threat-detect-linux-arm64): sha256:a7c30069686dc348773d76a8567be6b2e14828005c93c2928b14230689fedf42
Binary asset sha256 (threat-detect-darwin-x64): sha256:ab0c217848c47ae779d7b744022cd4a1c51af78f46856ed5ea16cf887c9c898a
Binary asset sha256 (threat-detect-darwin-arm64): sha256:af4a1d3952f974e611bcbaf97192c23f4f5895279ded7cdde29fccb8a6207d64

What's Changed

• chore(workflows): regenerate locks for gh-aw v0.85.4/v0.86.1 and detector v0.4.6 by @davidslater in #797
• fix(cli): accept and ignore deprecated --step-summary flag by @davidslater in #804

Full Changelog: v0.4.6...v0.4.7

v0.4.6

Binary asset sha256 (threat-detect-linux-amd64): sha256:04f9be64f229baef9b4d6d37f5f6e46209c182c7b16f5b4c2118ada06815be5b
Binary asset sha256 (threat-detect-linux-arm64): sha256:e1b41e1e86902d7a4e59b4641f008a81414cdf8f8f9b0f36c5034de681b60e2a
Binary asset sha256 (threat-detect-darwin-x64): sha256:7edfcd76bbccd89fc9e122277fa18d1546ce801cb04bc97b01c709d766b7d775
Binary asset sha256 (threat-detect-darwin-arm64): sha256:f7a7530ce310ba37d43071d9e8ac64aff862f94c686c4133dd291e9f12747afa

What's Changed

• refactor(logging): remove the --log-file JSONL run log by @davidslater in #795

Full Changelog: v0.4.5...v0.4.6

v0.4.5

Binary asset sha256 (threat-detect-linux-amd64): sha256:48ca3dd59a152f6f1a8338932ce79ef37540701658d11bed625cd68bf48cac28
Binary asset sha256 (threat-detect-linux-arm64): sha256:19aca777f9bcc15899e29a70fe48d7c2c71d5f90d3f1abfb39e8b0ab399dbe3c
Binary asset sha256 (threat-detect-darwin-x64): sha256:ca9d7260aab1ccba768c16a305b9cf24f91e090d238a3cb92e433703894f74d5
Binary asset sha256 (threat-detect-darwin-arm64): sha256:2f11ace7200635b320f667826a2dff2c395a809417535e58489ec129719e3d61

What's Changed

• fix(smoke): stop Claude smoke from exhausting its turn budget by @davidslater in #788
• fix(smoke): pin Codex detection model instead of the detection alias by @davidslater in #791
• fix(report): accept space-separated boolean flag values by @davidslater in #793
• refactor(detect): remove step summary output from the detection job by @davidslater in #792

Full Changelog: v0.4.4...v0.4.5

v0.4.4

Binary asset sha256 (threat-detect-linux-amd64): sha256:893826f595339e3b82ddd6a943352156e3a29360553885797649c9fd222f95d3
Binary asset sha256 (threat-detect-linux-arm64): sha256:b6df039a4b7f8f0a0f8390eea802b2a5899c8f358c723f3307374c203939c1c7
Binary asset sha256 (threat-detect-darwin-x64): sha256:e16003f743620770940f6faaf42998ad945d3d37e5266fbc3b8aedae5c210147
Binary asset sha256 (threat-detect-darwin-arm64): sha256:a1ec5d0a09c03a55a1d02093f878e784bbd1f20d5f00ff35a1c51d8a3ba5d499

What's Changed

• chore(workflows): bump smoke latest detector to v0.4.3 by @davidslater in #771
• test(cmd): make step-summary warning test hermetic by @davidslater in #776

Full Changelog: v0.4.3...v0.4.4