> ## Documentation Index
> Fetch the complete documentation index at: https://docs.panguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> Release history and version updates for Panguard AI.

All notable changes to Panguard AI, organized by version.

<Info>
  For the complete changelog including patch notes, see the [GitHub releases
  page](https://github.com/panguard-ai/panguard/releases).
</Info>

***

## v1.8.7 (2026-07-12)

**Released: 2026-07-12** -- Current stable release. ATR v3.5.8 (747 rules), OWASP Agentic Top 10: 10/10 covered.

* **`pga up` dashboard handoff hardened**: the reboot-persistence launchd service now pins `HOME`, so the dashboard launch token, config, and logs always resolve to the directory the CLI reads -- no more false "Dashboard not available" when launchd's `HOME` differs from the install shell.
* **npm provenance**: published tarballs now carry signed build provenance.

***

## v1.8.6 (2026-07-12)

**Released: 2026-07-12** -- GA finalization: honest Community/Enterprise tier copy, a single fully-gated npm publisher, and README/docs reconciled to ATR v3.5.8 / 747 rules. No runtime/product code changed.

***

## v1.8.5 (2026-07-12)

**Released: 2026-07-12** -- ATR v3.5.8 (747 rules), OWASP Agentic Top 10: 10/10 covered.

### Highlights

* **747 ATR rules** across 10 threat categories (was 419 in v2.2.0), now with **detection lanes**: enforce (stable, confirm-gated rules) \~0.24% FP / hunt (all rules, default) \~9% FP, measured on a 65,000-sample benign corpus
* **17 platform support**: `panguard setup` auto-detects and configures Claude Code, Claude Desktop, Cursor, Hermes Agent, OpenClaw, Codex CLI, WorkBuddy, NemoClaw, ArkClaw, Windsurf, QClaw, Cline, VS Code Copilot, Zed, Gemini CLI, Continue, and Roo Code
* **Benchmarks** (Layer 1 deterministic, verified 2026-07-04): Garak 97.2% recall (650 samples), SKILL.md 100% recall / 97% precision / 0.2% FP (498 samples), PINT 63.6% recall / 99.7% precision (850 samples), HackAPrompt 69.6% recall vs 28.6% baseline / 100% precision (4,780 samples)
* **1.8.5**: honest Community/Enterprise tiering -- the compliance Evidence Pack is Enterprise-only (server-gated 403 on Community; SARIF export stays free); ATR-2026-00013 SSRF precision fix (bundled ATR floored to v3.5.8); `pga scan` runs the ATR skill scan by default in a project with a `./skills` dir; dashboard real-data + self-debuggable-token fixes

### Compliance tiers

Community is free and open source forever. Enterprise, Migrator Pro, and Sovereign tiers add signed, continuously re-scanned compliance evidence (Ed25519 issuer signatures, npm provenance) on top of the Community core.

***

## v1.8.3 (2026-07-10)

**Released: 2026-07-10** -- DNS-rebind SSRF pinning + monotonic retention-floor. ATR v3.5.7 (714 rules).

***

## v1.8.2 (2026-07-10)

**Released: 2026-07-10** -- Installed-footprint hardening

* Hardened installed footprint: key-leak, phone-home, MCP fail-open, and daemon-import fixes
* 43 security + UX findings remediated across 12 subsystems
* 6 non-blocking follow-ups (Layer C health, redaction, export scrub, host-OS copy, onboarding)

***

## v1.8.0 (2026-07-08) -- Community GA hardening

**Released: 2026-07-08**

* **PreToolUse hook false-positive root-cause fix** + advisory default -- eliminates false blocks on legitimate MCP tool calls
* **E2E sealed telemetry** + unknown-attack flywheel: opt-in, advisory-only upload that never blocks, with automatic rule updates on consent
* GA security-hardening pass across guard, installed footprint, and MCP proxy

***

## v1.7.0 (2026-06-21) -- GA hardening

**Released: 2026-06-21** -- Security-hardening release: guard hooks, installed-footprint, and IP-leak fixes.

***

## v1.6.0 (2026-06-15) -- GA

**Released: 2026-06-15**

* **Dual-path agent containment** closed-loop (MVP) + MCP proxy chokepoint
* **ATR 2.x -> 3.2.0** upgrade + 6-framework 100% compliance coverage
* **Community GA**: free-tier detection (651 rules at ship), security hardening, honest dashboard + site
* Opt-in advisory semantic layer (default engine remains 100% deterministic regex)

***

## v1.5.6 (2026-05-12)

**Released: 2026-05-12** -- Released alongside ATR v2.2.0 (419 rules)

### Highlights

* **ATR v2.2.0** with 419 rules (was 71 in v2.0.x) covering 10 threat categories
* **Microsoft AGT integration**: PR #1277 merged 2026-04-26, weekly auto-sync workflow with 287 rules in production
* **Cisco AI Defense integration**: PR #99 merged 2026-04-22, full 344-rule library in `skill-scanner` production
* **MISP integration**: galaxy PR #1207 + taxonomies PR #323 -- global threat intel sharing layer
* **OWASP A-S-R-H**: PR #74 merged 2026-05-11 with contributor-status greeting
* **Microsoft Copilot SWE Agent loop**: AGT issue #1981 (2026-05-11) -- Copilot writes regression tests against ATR detection
* **12 MCP tools** (was 11), 18-package monorepo, 23 CLI commands
* **Benchmarks**: Garak 97.1% recall, SKILL.md 100% recall (97% precision, 0.2% FP), PINT 62.5% recall (99.6% precision)
* **Wild scan**: 67,799 AI agent skills audited across ClawHub/OpenClaw/Skills.sh; 1,096 confirmed malicious
* **Migrator Community** on npm: `@panguard-ai/migrator-community@0.1.0` (MIT, Sigma/YARA -> ATR conversion)

***

## v1.4.2

**Released: 2026-03-27** -- ClawHub Ecosystem Scan, Telemetry, CI Hardening

### ClawHub Full Ecosystem Scan

* **36,394 skills crawled** from ClawHub registries (npm, GitHub, awesome-lists)
* **9,676 packages with content** analyzed by ATR + Skill Auditor (L1 + L2 AST)
* **182 CRITICAL / 1,124 HIGH / 1,016 MEDIUM / 7,354 LOW** findings
* Results synced to Threat Cloud: 165 threats + 968 whitelist entries
* Full scan data: `data/clawhub-scan/scan-full.json` (23MB)

### Telemetry Infrastructure

* Opt-in anonymous telemetry for scan and guard usage
* Scan DRY refactor -- shared scan logic across CLI, MCP, and web scanner

### CI Hardening

* 21 ESLint errors resolved
* Audit steps now use `--timeout` and `--no-cloud` flags for deterministic CI

***

## v1.4.1

**Released: 2026-03-26** -- Critical npm Publish Fix

### npm Package Fix

* **Fixed `workspace:*` references in published packages** -- all previous npm versions were broken because pnpm `workspace:*` protocol was not resolved during publish. Every `@panguard-ai/*` dependency now uses exact version numbers.
* Verified: `npm install -g @panguard-ai/panguard` now works correctly

***

## v1.4.0

**Released: 2026-03-25** -- 16 Platforms, OWASP 10/10, 419 ATR Rules

### 16 AI Platform Support

* **Doubled platform coverage** from 8 to 16 platforms
* New platforms: NemoClaw, ArkClaw, Cline, VS Code Copilot, Zed, Gemini CLI, Continue, Roo Code
* 119 platform sandbox tests passing
* `panguard setup` auto-detects and configures all 16 platforms

### ATR v0.4.0

* **419 ATR rules** (up from 61), covering 10 new attack categories
* New rules: eval injection, shell escape, dynamic import, credential theft, OAuth token abuse, env var harvesting, A2A message validation, agent identity spoofing, approval fatigue, social engineering via agent
* PINT benchmark: 62.5% recall, 99.6% precision
* **OWASP Agentic Top 10: 10/10 full coverage** (77 total rule mappings)

### Threat Cloud Live Metrics

* `/api/metrics` endpoint for real-time scan counts across all sources (bulk, CLI, web)
* Website stats now pull live data from Threat Cloud with static fallback
* Badge API: `GET /api/badge/:author/:skill` for "ATR Scanned" badges

***

## v1.3.3

**Released: 2026-03-25** -- Scan Accuracy, `pga` Shortcut, Onboarding UX

### Scan Accuracy

* **False positives dramatically reduced.** Normal skills (weather, github, slack, notion) no longer flagged as MEDIUM/HIGH. Permission checks now strip code blocks and negation sections before pattern matching.
* **New stealth attack detection.** `<IMPORTANT>` block attacks and silent data exfiltration instructions are now caught as CRITICAL.
* **Context-aware scoring.** Known CLI tools (curl, git, wget) and API integrations get proper risk reduction. Credential check distinguishes theft from legitimate handling.
* **13 injection patterns** (up from 11), with two-pass matching that automatically downgrades tool poisoning patterns found only in code block examples.

### `pga` Shortcut

* **`pga` command** -- three characters to invoke Panguard from anywhere. Works exactly like `panguard`.
* **`pga up`** -- start protection + dashboard in one command. Replaces `panguard guard start --dashboard`.
* **First-run auto-detection** -- run `pga` for the first time and setup wizard starts automatically.

### Onboarding UX

* **Guard welcome guide** -- first time Guard starts, shows all commands and what Guard does.
* **"What's new" on upgrade** -- after updating, first CLI run shows changelog highlights.
* **Clean audit output** -- no more JSON log lines in non-verbose mode.

***

## v0.8.0

**Released: 2026-03-13** -- Dashboard, AI Platform Integration, and Skill Auditor

### Built-in Dashboard

* Local web dashboard at `http://127.0.0.1:9100` with `panguard guard start --dashboard`
* 7 pages: Overview, Skills & Trust, AI Setup, Rules, Threat Cloud, Threats, Guide
* Real-time WebSocket push for status, events, and rule counts
* Token-based authentication with auto-open browser
* Dark theme with sage green accent, English and Traditional Chinese

### AI Platform Auto-Setup

* `panguard setup` auto-detects and configures 16 AI platforms in one command
* **OpenClaw**: native Skill integration at `~/.openclaw/skills/panguard/SKILL.md`
* **QClaw**: MCP server registration in `~/.qclaw/mcp.json`
* Claude Code, Cursor, Codex CLI, Claude Desktop, Windsurf, WorkBuddy via MCP
* Platform-specific config injection with zero manual editing

### Skill Auditor as Default Entry Point

* 8-check pre-install security gate for AI skills
* Detects prompt injection, tool poisoning, secrets, and unsafe dependencies
* Skill whitelist: approved skills are auto-trusted, drift triggers revoke
* Integrated into Guard dashboard (Skills & Trust page)

### Rule Distribution

* 419 ATR detection rules shipped with install
* Auto-sync from Threat Cloud every hour

### Threat Cloud LLM Review

* Claude Sonnet 4 API integration for automated rule review
* Community voting pipeline for submitted threat intelligence
* Seed pipeline with 11 threat intel sources

### One-Line Install Flow

* `curl -fsSL https://get.panguard.ai | bash` triggers interactive setup
* Auto-runs `panguard setup` to configure AI platforms
* Auto-starts Guard with dashboard on completion
* Browser opens automatically with authenticated dashboard session

***

## v0.7.0

**Released: 2025-02-25** -- Rule Engine Enhancements and osquery Integration

### Rule Engine Enhancements

* Aggregation expression support: `1 of them`, `all of them`, `1 of sel*`, `all of filter*`
* New matching modifiers: `|cidr` (IP range matching), `|gt`/`|gte`/`|lt`/`|lte` (numeric comparisons)
* New encoding modifiers: `|base64`, `|base64offset`, `|utf8`, `|wide`
* Parenthesized group conditions: `(sel_a OR sel_b) AND NOT filter`

### osquery Integration

* New `OsqueryProvider` for SQL-based system state queries
* Support for process, port, user, network interface, and kernel module queries
* Automatic fallback to shell commands when osquery is not installed

***

## v0.6.0

**Released: 2025-02-25** -- Branded CLI, Security Score, and Achievement System

### Branded CLI

* New CLI rendering module with 24-bit ANSI color matching brand palette
* Sage Green (#8B9A8E) primary color theme
* Progress bars, tables, status panels, and Shield ASCII art
* Zero external dependencies (no chalk, ora, or ink)

### Security Score Engine

* 8-factor weighted scoring (0-100)
* A through F grade mapping
* Trend tracking: improving, declining, or stable

### Achievement System

* 12 achievement badges with automatic unlock and notifications

***

## v0.5.0

**Released: 2025-02-25** -- Auto-Response and Threat Intelligence Feeds

### Auto-Response Engine

* IP blocking (macOS pfctl / Linux iptables / Windows netsh)
* File quarantine with SHA-256 tracking
* Process termination
* Confidence-based actions: {'>'}90% automatic, 70-90% confirmation required, {'<'}70% notification only

### Threat Intelligence Feed Management

* 5 feeds: ThreatFox, URLhaus, Feodo Tracker, GreyNoise, AbuseIPDB
* Automatic updates with local caching

***

## v0.4.0

**Released: 2025-02-24** -- Chat Notifications, Trap Honeypots, and Compliance Reports

### Panguard Chat

* 5 notification channels: LINE, Telegram, Slack, Email, Webhook
* 3 user role formats: developer, boss, it\_admin
* Bilingual alert templates (English / Traditional Chinese)

### Panguard Trap

* 8 honeypot service types: SSH, HTTP, FTP, SMB, MySQL, RDP, Telnet, Redis
* Attacker profiling with skill level classification and intent analysis

### Panguard Report

* Taiwan Cyber Security Act (10 controls), ISO 27001 (12 controls), SOC 2 (10 controls)
* JSON and PDF output formats

***

## v0.3.0

**Released: 2025-02-24** -- Guard AI Engine and Investigation

### Panguard Guard

* 5 AI agent pipeline: Detect, Analyze, Respond, Report, Investigation
* 7-day learning period with automatic switch to protection mode
* 42 ATR rules, Dashboard WebSocket server
* System service installation (macOS / Linux / Windows)

### Threat Cloud

* RESTful API server with SQLite backend
* IoC submission, query, and batch query
* API key authentication

***

## v0.2.0

**Released: 2025-02-23** -- Scan Engine and PDF Reports

### Panguard Scan

* System environment reconnaissance, password policy audit
* Port scanning with dangerous port detection
* SSL certificate validation, scheduled task audit, shared folder security checks
* Risk scoring 0-100 (A through F grades)
* PDF report generation

***

## v0.1.0

**Released: 2025-02-23** -- Core Foundation

### @panguard-ai/core

* TypeScript monorepo architecture
* Internationalization support (English + Traditional Chinese)
* ATR rule engine, system reconnaissance engine
* 4 monitors: Log, Network, Process, File
* 3 adapters: Windows Defender, Wazuh, Syslog
* AES-256-GCM encryption

### Infrastructure

* pnpm workspace monorepo
* Vitest testing framework
* ESLint with eslint-plugin-security
* GitHub Actions CI/CD