pipelab-org/pipelock v3.8.0 on GitHub

Breaking Changes / Upgrade Notes

Metrics move off the agent-facing proxy port. /metrics and /stats are available only when metrics_listen names a dedicated listener. Omitted, null, or blank values expose neither route at startup. Managed containment rejects a reload that removes or blanks the setting. The existing listener stays bound, /metrics returns 403 until a valid reload clears the denial, and /stats keeps serving loopback clients. Restart to disable the listener. Update scraper targets and keep agents off the unauthenticated metrics listener with network controls. Changing the address requires restart. Upgrade guide. (#2044)
New container and chart releases use ghcr.io/pipelab-org. Update image repositories, registry policies and Helm OCI URLs when adopting this release. Releases through v3.7.1 retain their original registry addresses. v3.7.1 attestations use pipelab-org/pipelock; releases through v3.7.0 retain the luckyPipewrench/pipelock signing identity. Generated Compose and sidecar output also adopt the new image defaults. The Go module path and Homebrew tap stay unchanged. Verified installation. (#1911, #2020, #2062)
Expired temporary scanner exceptions lapse instead of preventing startup. A valid expired entry emits a startup or reload warning and ordinary scanning resumes for its scope. Malformed entries still reject configuration. Running scanners enforce expiry without waiting for reload; there's no separate clock-triggered warning. (#1942)
Non-finite floating-point settings are rejected. Replace NaN or infinity values with finite values inside the setting's supported range before upgrading. The configuration error names the affected field. (#2029)
The default URL ceiling increases to 8000 octets. Explicit limits still win, and presets with tighter limits retain them. Operators who require the previous ceiling should set fetch_proxy.monitoring.max_url_length explicitly. Longer URLs can carry more data per request; the other URL checks still apply. (#2052)
Generated audit configurations retain explicit tool-policy blocks and disable adaptive escalation. Ordinary findings remain warnings. Regenerated strict configurations also retain their bundled actions, taint policy and tool-chain detection. Review regenerated policy before replacing a custom configuration. (#1943, #1961)
Regenerated agent presets and the quickstart retain built-in and supplemental response patterns. The claude-code, cursor, generic-agent, and hostile-model presets give supplemental expressions Preset names. Review name-based alerts and suppressions when replacing older YAML; existing saved configurations keep their names until edited or replaced. Preset migration. (#2063, #2066)
Core findings remain visible in repository scans. git scan-diff, audit, and the GitHub Action apply the core DLP floor even with custom patterns or defaults disabled. Inline markers and rule suppressions can't silence core findings; path exclusions still exclude the entire path. Review synthetic fixtures and narrowly scoped exclusions before upgrading. Suppression guide. (#2064)
Codex MCP setup forwards environment variables by name. Export each required variable in Codex's runtime environment. Installation refuses missing values before changing server registrations and prints the required names without exposing values on command lines. (#1999)
Fleet receipt reports default to v2. The report binds authenticated recorder-run identities so a follower restart doesn't make its audit sequences conflict with earlier runs. Update consumers that assume v1 and keep the complete evidence and trusted keys. Verification contract. (#1949)
File-only MCP wrappers are reported as unconfirmed. discover, assessment and posture output no longer equate a wrapper found in a configuration file with proven runtime protection. Discovery exits nonzero for unconfirmed coverage. (#1967)
Managed containment units need reinstalling to adopt new unit definitions. After upgrading the binary, run contain install with the intended configuration, then contain verify and contain doctor. New forwarders report ready only after binding; unsupported service write paths are refused before activation. Keep evidence and persistent state in their supported locations. (#1930, #1944, #1946, #1998, #2000)
Guard and sandbox honor the kernel's cross-directory move restriction. Cross-directory renames and hard links are granted only when the kernel reports Landlock erratum 3 fixed. Otherwise they remain denied with EXDEV; Guard records the withheld permission. Older typed Guard proof readers can reject proofs carrying that new field. Guard limits. (#1978, #2015, #2058)
Evidence completeness requires a proven end. A valid open prefix reports VALID PREFIX, END UNPROVEN and exits 3. Audit packets, fleet reports, coverage certificates, AARP chains and dashboard trust views now distinguish that result from completed evidence. Update automation that treats signature validity as completeness; --allow-prefix deliberately accepts a supported prefix without proving its end. Single-receipt signature verification keeps its existing exit contract. Endpoint sequence pins use ASCII decimal digits across verifiers. Verification guide. (#2068)
Outbound decoding refuses incomplete inspection. Supported URL, body, header, WebSocket, MCP and A2A request paths refuse when their decoding depth or work bounds leave a new view uninspected. Inbound text retains its bounded partial-view policy. Large single-layer content remains inspectable within the transport's own limits; nested encodings can still exceed the recursive budget. This doesn't remove the documented encoding and reassembly limits. Decoding limits. (#2067, #2076)
Signed URL targets contain destinations, not request content. URL targets in receipts retain scheme, host and port while dropping userinfo, path, query and fragment. Audit output also removes query, fragment and userinfo, retaining paths only for supported path diagnostics. Update consumers that relied on receipt paths or queries; incomplete or invalid URL-shaped targets are redacted. (#2082, #2086)
The mode name doesn't disable enforcement. mode: audit with the default enforce: true still blocks ordinary URL findings. Use the audit preset for an observation trial, and review its independent core and transport refusals. Startup, configuration checks, status and dashboard output now reflect the effective setting. (#2080, #2089)
Provider credential relief requires a supported endpoint and carrier. Requests that previously relied on a broad provider-host allowance can now block. The built-in policy hash also changes; refresh pinned hashes when republishing fleet policy. Check the documented destination and header or query contract, including redirect handling; a provider-like hostname alone grants no relief. Credential audience reference. (#2072)
Unicode tag decoding adds receipt normalization views. DLP, cross-request matching and inbound injection scanning inspect text encoded as Unicode tag characters. Upgrade receipt verifiers before consuming the new views; older verifier releases reject receipts that use them. (#2118)
Release validation distinguishes retryable registry access failures from integrity failures. The verifier install gate exits 3 for a retryable registry access failure, whose cause can be local DNS or network setup, and 2 for a package contradiction or unclassified failure. receipt-load exits 4 for a setup failure before receipt evidence exists; uncertain or integrity failures still exit 1. Update scripts that classify these results. Every nonzero exit still blocks publication. (#2149)

Added

Nearby keywords for custom DLP patterns. Custom patterns can set keywords and keyword_window to require a nearby label in the original or decoded text. Built-in patterns reject these fields. Keyword gates reduce accidental matches but can miss deliberate leaks whose sender omits the label; checksum validators provide a stronger check where available. (#2112)
More encoded text reaches DLP and injection scanning. The shared decode graph supports decimal character codes, explicit octal and binary codes, quoted-printable escapes and mixed standard/URL-safe base64 within its existing budgets. Malformed escapes retain their original text. (#2114)
Long separator-split values receive text DLP inspection. Supported hex, base64, base64url, base32 and base32hex values beyond the short-token ceiling use screened decoded lanes with a separate shared 8 MiB allowance. Custom keyword gates still apply. Exhausting that allowance refuses outbound content; inbound content reports partial inspection through supported audit and receipt consumers. Decoding limits. (#2137)
Receipt-load restart, attribution and matrix controls. --restart-after verifies receipt continuity across a proxy restart, and --destinations per-request attributes destination-only receipts to individual planned requests. A fixed release matrix profile checks its planned cells. --ready-timeout and RECEIPT_LOAD_VERIFY_TIMEOUT let operators allow more time for startup and verification. (#1925, #2091, #2092, #2094, #2135)
Explicit prompt-injection wording policy. prompt_injection_detection lets operators retain, warn on, or turn off the supported regex wording checks independently of DLP and other security controls. Receipts and diagnostics identify the effective assessment, including content that wasn't assessed. The separate checker protocol is a library contract, with no runtime provider integration. (#1980, #1987, #2024, #2025)
Inspect oversized JSON without a host exception. Forward HTTP, intercepted HTTPS and reverse proxies can inspect a complete JSON response beyond the ordinary scan cap within the existing bounded scan and in-flight budgets. This is partial field and adjacent-pair inspection, and its evidence says so; it doesn't establish whole-document safety or earn adaptive recovery credit. Fetch, MCP, encoded responses and invalid or over-budget bodies retain their existing limits. Inspection boundary. (#2048)
Text inspection inside Office, OpenDocument and ZIP uploads. Request scanning inspects supported archive contents within documented extraction limits. An archive that can't be fully read is held with block action and enforcement enabled; warn or disabled enforcement can still deliver it. PDFs retain raw-byte inspection. Request body scanning. (#2032)
Service-aware configuration validation and synchronous reload. check --service evaluates supported systemd service inputs without printing environment values. pipelock reload returns the activation result; reload --status shows active policy identity and settings awaiting restart. A rejected reload keeps the active configuration, while uncertain activation denies traffic. (#1941, #1946)
Expiring per-host response scan ceilings. Operators can set reviewed limits for exact hosts already in size_exempt_domains, within existing memory budgets. No host gets a grant by default. (#1948)
MCP mirrored-header contracts across HTTP and the stdio bridge. Observed tool definitions bind x-mcp-header fields to Mcp-Param-* headers. Private discovery establishes unknown contracts before a call can proceed, and stdio-to-HTTP synthesizes the required bindings. Discovery retains the caller's credentials and doesn't approve or expose tools to the client. (#1983, #1985, #1997, #2004, #2007)
Session taint causes in operator diagnostics. Session inspection, explain and doctor distinguish wording findings from other hostile causes and show where MCP history is request-local or unavailable. Older uncategorized hostile history stays hostile. (#1977, #2001)
Explicit structured-identifier checksum validators. DLP patterns and rule bundles can select DEA and NPI validation; patterns without a selected validator retain their matching behavior. Validator changes participate in reload downgrade checks. (#2047)
Native OAuth endpoint grants and a systemd credential source for the kill-switch token. Exact reviewed routes support native sign-in flows without a general content exemption. Configuration reference. (#2005, #2006)
Expiring exceptions for exact JSON requests. An enforcing request-policy block rule can exempt an operator-approved HTTPS URL, method and complete post-redaction JSON body digest until a timestamp. The exception is reusable until expiry or removal; other rules and independent controls still apply. Older binaries reject the new fields. Request policy. (#2081)
Explicit download redirect delegation. Operators can authorize narrow source routes to issue exact download URLs on listed HTTPS origins. Fetch and intercepted HTTPS can relieve supported entropy checks for the issued URL; DLP, destination policy and receipt requirements remain active. No delegation ships enabled, and opaque CONNECT tunnels receive no relief. Delegation contract. (#2084)
Per-check URL decision counters. pipelock_url_check_decisions_total records URL check outcomes across supported proxy paths with fixed labels. Counts describe scanner observations before transport enforcement and can overlap; they don't measure final upstream denials or body inspection. Metrics reference. (#2079)
Configurable WebSocket JSON field budget. websocket_proxy.cross_message_field_limit bounds JSON fields retained for cross-message scanning; incomplete inspection closes affected streams. A configured positive MCP response timeout also bounds A2A response and Agent Card scans in every MCP proxy mode. Displayed values escape terminal control characters. (#1929)
Visible containment viewer activity. Operator logs record control-lease requests, grants, release and expiry, plus connection-limit refusals. (#2017, #2018)

Changed

Required-receipt HTTP responses flush to the client before the synchronous outcome receipt write on supported fetch, forward, reverse, intercepted HTTPS, CONNECT error and WebSocket pre-upgrade paths. Scanned forward responses carry an exact Content-Length. Receipt contents and chain linkage remain unchanged; an outcome-write failure still marks the receipt group failed for later requests. (#2147)
Rule-bundle guidance distinguishes declared tiers from licensing and official status. Operator-trusted signers can declare tier labels, while only an officially signed pipelock-standard bundle replaces compiled standard patterns. Version monotonicity and expiry checks apply to format v2 bundles; an unchanged rules update reports its existing state without rechecking freshness. (#2106)
Installation and recovery guides clarify receipt verification commands and exit codes, published Python verifier support, multi-chain limits, MCP identity validation and supported rollback steps. Archive installation examples stop on failed verification, clone examples use the canonical repository URL, and Quick Start links directly to release downloads and integrity verification. Source-build upgrade requirements are explicit. (#1915, #1935, #1962, #1992)
Security and deployment guides clarify that leak detection retains selected environment and secret-file values in proxy memory, HTTPS content inspection requires TLS interception, and supported Linux containment can restrict direct egress when configured and verified. Syslog delivery is described as queued and best effort. (#2098)
Updated Go and verifier dependencies, including golang.org/x/net and the Rust verifier's Ed25519 library, while retaining the TypeScript verifier's compatible HTML decoder dependency. Verifier source versions and published package versions remain separate; use the installation matrix to select a published artifact. (#1916, #1956, #1971, #1976, #1995, #2011, #2027, #2070)
Reduced repeated response-scan work and reused decoded MCP response envelopes and card-scanning replacements. Existing scan and incomplete-inspection policies remain in force. (#1952, #2069, #2085)
Playground replay kits require verified evidence and include source-bound build records; live-drift checks identify mismatched deployments. Viewer builds require fresh browser-verifier output and support read-only source trees. Build provenance doesn't establish inspection of activity outside the mediated path. (#1912, #1920, #2037)

Fixed

Report secret candidate files that pipelock audit couldn't inspect because of size or read failures. In-limit files retain secret and entropy scanning after arbitrarily long lines. (#2096)
Generate a Docker Compose healthcheck with the required CMD form, and keep the framework guides and examples consistent with it. (#2097)
Choose a canary destination accepted by the configured strict allowlist during init and sidecar setup. The pipelock test entropy sample now exceeds every shipped threshold, avoiding false self-test failures without changing policy. (#2099)
Accept read-only GitHub Actions results downloads from every storage account GitHub currently publishes. Supported downloads remain adaptive-neutral; lookalike hosts and unsupported SAS carriers or request shapes retain DLP checks. (#2101)
Drain receipt-producing HTTP handlers and background reverse-proxy SSE scans before sealing a run. Shutdown closes CONNECT and WebSocket connections and waits for their outcome receipts within the grace period. Idle connections that never delivered a request no longer prevent sealing; unfinished work leaves the run unsealed and returns an error. (#2103, #2109, #2113, #2127)
Require a signature verified during the current load before granting official rule-bundle status or reserved bundle names. Unsigned bundles with signer data in their lock file reject as an integrity error; ordinary unsigned bundles remain supported. (#2107)
Apply MCP resource URI and protected-path checks to supported URL-reader and filesystem interpretations as well as submitted text. Reject failed resource-host mapping, and check every file-tool value for symlink and hard-link aliases of protected files, including values containing whitespace. (#2110, #2131, #2143)
Inspect inbound WebSocket and SSE payloads joined directly across message boundaries as well as with a separating space, retaining the existing tail and reconstruction limits. (#2119)
Decode joined subdomain labels before URL DLP checks using the registrable-domain boundary from the Public Suffix List. Existing hostname checks and literal-IP handling remain in place. (#2121)
Keep shipped destructive-command rules from matching look-alike shell words or fully quoted search and print text in supported read-only scripts. Real destructive invocations and uninspectable commands retain their policy; the shell hook extends literal-text relief to file-delete and recursive-permission rules. (#2134, #2146)
Recognize the exact sourced Claude Code sign-in, profile, settings, policy and telemetry credential endpoints. Refresh and revocation accept credentials only in their designated JSON field; unsupported destinations and carriers still block. Credential endpoint contract. (#2138)
Let Codex CLI and Grok CLI sign-in access tokens reach their own vendor APIs. On traffic Pipelock inspects (HTTPS needs TLS interception), the token passes only as the whole Authorization bearer at that vendor's API host and path, and only when its issuer and client claims name that vendor. Pipelock doesn't verify the token's signature, so a forged token carrying those claims can still reach that vendor's API. A JWT with other claims sent to these hosts still blocks, and a custom pattern that reuses the built-in JWT pattern's name doesn't receive the allowance. (#2159, #2170)
Keep receipt-load dashboard snapshots outside the recorder directory, fail integrity on structured audit-gap diagnostics, and recognize the proxy's actual rule-bundle messages. Failed-run summaries include measured HTTP status counts; reports distinguish receipt failure causes and include redacted transport-error samples and counts by kind. (#2037, #2090, #2104, #2129, #2139, #2141)
Bound network waits in configuration examples, example verifiers and the verifier install gate. The SIEM example fails when webhook events can't be read. (#1928)
Preserve response findings across Browser Shield rewrites, keep inspection spans correct through length-changing normalization, and remove invisible characters introduced by compatibility folding. (#1913, #2019, #2034)
Scan typed JSON card values, preserve neighboring inspectable values around large numbers, and reject ambiguous typed field bindings. Card-shaped sequences made only from separate numeric values warn; string-containing and single-value findings retain their configured policy. (#1921, #1926, #1929, #1982, #2031)
Inspect supported recoverable known-secret representations and URL fragments, retain structured scan findings, and close affected streams when inspection can't complete. (#1929, #2028)
Cover the multipart bytes delivered to raw-body receivers, including framing-adjacent text and part headers, and refuse ambiguous transfer encodings. (#2046)
Keep warning observations score-neutral, credit only assessed-clean traffic, expire residual adaptive scores, and return uniform refusals during adaptive block_all while retaining detailed operator evidence. (#1965, #2030, #2038)
Preserve tool-policy decisions through command handoffs and stricter interpretations of unproven executable names. Match supported abbreviated Git options and refuse uninspectable Git subcommands. Bounded alternative word readings add matches for supported shell expansions and preserve incomplete-check refusals; text policy retains its documented shell-resolution limits. (#2008, #2035, #2040, #2042, #2065, #2171)
Judge persistence, shell-profile and credential-file write rules by where a file-write tool writes, so a note whose text mentions a protected path is no longer blocked. target, destination and dest count as destinations, and dd output operands, including relative dotfile names, are checked in the built-in policy and every preset. (#2171)
Restrict server-issued ID allowances to supported caller identities and recorded send history, recognize colon-addressed paths, accept registry upload URLs issued in Location headers, and recognize supported punctuation inside exact origin-issued URI segment identifiers. (#1960, #1981, #2002, #2074)
Reduce path-entropy false positives for package versions and default Rollup asset hashes; exact suppression URLs retain their full destination match. Explicit HTTP path exclusions remain scheme-scoped. (#1927, #1957, #1958, #2010, #2026)
Preserve managed containment socket and service state across install, upgrade and rollback; reconcile nftables and doorways from one plan; restore display runtime directories after reboot; and report repair advice using the observed proxy port. (#1930, #1944, #1945, #1954, #1996, #2016)
Accept the managed unit's own supported systemd credentials directory while retaining runtime-mask verification limits. Recheck pinned local-service file contents on every verification, keep sandbox launch and signal handling on one OS thread, and retire threads changed by a failed restriction attempt. (#2014, #2015, #2021, #2036, #2058)
Replace running Windows executables through recoverable rename steps, serialize update and rollback, and preserve recovery files when restoration is incomplete. An interrupted replacement can require the documented manual recovery. (#1939)
Keep active session enforcement when the session store is full, preserve watcher and license lifecycle state, and emit exactly one blocked event per MCP refusal. Bridge cancellation and failures settle pending requests and retain the correct refusal reason. (#1933, #1969, #2003, #2043)
Require signed receipt-group configuration, retain deferred shards across restart, anchor confirmed prefixes during live writes, and deliver final follower audit batches at shutdown. Required missing seals refuse success; completeness analysis resolves an unambiguous per-run chain. AARP chains verify trust and genesis; packet counts come from verified receipts, and certificate windows are checked against complete recorded sessions. (#1932, #1984, #1986, #1988, #1993, #2039, #2068)
Give Kubernetes proxies a private writable home without relaxing the read-only root filesystem, preserve operator state-home overrides, and retain separate storage requirements for evidence and follower persistence. (#1975)
Normalize intercepted empty HTTP/2 requests, record actual response delivery outcomes, and refuse incomplete ranged or not-modified responses on the documented proxy paths. (#1937, #2023)
Read supported Python dependency tables with a TOML parser and apply strict installed-rule integrity policy to hooks and mcp scan. (#1963, #1974)
Carry a generated request ID and explain event command on ordinary HTTP block responses. Adaptive lockout responses retain their fixed, detector-neutral format. (#1931, #2038)
Distinguish body parsing failures from credential findings and incomplete scans in diagnostics and signed labels, and check the supplied WebSocket URL's byte length before handshake normalization. Refusal behavior and independent redaction checks remain in place. (#2056)
Preserve core findings through repository-scan suppression and redact every detected secret on an added line in each diff finding, including overlapping matches. (#2064)
Preserve later enforced credential findings after warn-only encoded matches, and keep credential-solicitation wording detection active outside supported topic phrases. (#1934)
Find valid wallet-import private keys beside invalid or overlapping candidates in traffic and repository scans. Include Api-Key in the default sensitive-header set. (#2072)
Inspect credentials in URL userinfo and decode recovered nested-URL percent escapes. Restrict provider credential relief to its supported destination and carrier, and show audience-mismatch diagnostics across request scans. (#1959, #2072, #2078)
Explain intentional MCP scanning disables without treating a legacy boolean alone as an effective disable. (#1940)
Report embedded release-keyring availability in version and update diagnostics so source builds explain why signed self-update is unavailable. (#1990)

Finding Pipelock useful? Star the repository: https://github.com/pipelab-org/pipelock