v0.3.18

What's Changed

• fix: support JavaScript Express guards by @ejntaylor in #87

Full Changelog: v0.3.17...v0.3.18

v0.3.17

What's Changed

• feat(protect): opt-in route-level WAF (env) + protect --demo sample rules by @patchstackdave in #77
• feat(protect): generic block message + branded HTML "Access Denied" page by @patchstackdave in #78
• feat(protect): hardening — body cap, header screening, multipart, node egress, SQL-error suppression by @patchstackdave in #79
• feat(protect): hardening follow-ups (partial-scan, IPv6 egress, Set-Cookie redaction, WebSocket, verbose-error breadth) by @patchstackdave in #80
• refactor(protect): stack-adapter architecture for the protect scaffolder by @patchstackdave in #81
• feat(protect): generic scaffold + wiring plan + protect --check (infra-free agent loop) by @patchstackdave in #82
• feat(protect): Next.js, SvelteKit, Astro, Fastify, Express adapters by @patchstackdave in #83
• chore: drop internal PR/item-number references from comments by @patchstackdave in #84
• feat(protect): template typecheck + NestJS adapter + rule-sync hardening by @patchstackdave in #85
• fix: bake site UUID into generated guards by @ejntaylor in #86

Full Changelog: v0.3.16...v0.3.17

v0.3.16

What's Changed

• fix(protect): type-safe scaffolded guard.ts (strict TanStack build) by @patchstackdave in #75
• Add bounded setup command for agent onboarding by @ejntaylor in #74

Full Changelog: v0.3.15...v0.3.16

v0.3.15

What's Changed

• feat(protect): per-site Pulse rules client (fetch rules by site UUID) by @devlob in #62

Full Changelog: v0.3.14...v0.3.15

v0.3.14

What's Changed

• feat(protect): scaffold response screening + first scaffolder tests by @patchstackdave in #70
• [feat] field-test: cover the "npm view is code execution" Lovable refusal by @mariojgt in #71
• [feat] surface remaining setup steps after scan + consistent guide labels by @mariojgt in #72

Full Changelog: v0.3.12...v0.3.14

v0.3.13

Per-site Pulse WAF rules: the guard fetches this site's rules by site UUID from GET /monitor/pulse/rules/<uuid> (in-memory TTL cache + last-known-good disk cache, fail-open), with source precedence siteUuid → token → bundled. bakeSiteUuid validates UUID format before baking.

Cut from PR #62 (pulse-per-site-rules-connect, main merged in — supersets v0.3.12; not yet merged to main). Validates the saas #999 per-site rules endpoint end-to-end.

v0.3.12

What's Changed

• feat(protect): comprehensive demo/test rule gallery + pack-safety guard by @patchstackdave in #66
• [feat] remove llms.txt provenance citation; add lovable-supplychain field-test persona by @mariojgt in #69

Full Changelog: v0.3.11...v0.3.12

v0.3.11

What's Changed

• feat(protect): opt-in response screening for node/express + Supabase guard by @patchstackdave in #64
• Remove install.txt references; add Uninstalling section to AGENT-INSTALL.md by @ejntaylor in #68

Full Changelog: v0.3.10...v0.3.11

v0.3.10

What's Changed

• Add real-platform personas and a personas × models field-test matrix by @ejntaylor in #60
• docs(protect): end-to-end demo + seed demo rules (public CVE) by @patchstackdave in #61
• Harden install prompt against read-then-apply refusals (bolt.diy report) by @ejntaylor in #63
• Verify-first install prompt + hostinger persona and two-turn confirm mode by @ejntaylor in #67

Full Changelog: v0.3.9...v0.3.10

v0.3.9

What's Changed

• feat(protect): rule-driven Tier-3 (response redaction + egress SSRF) + array-param fix by @patchstackdave in #57
• test(protect): port engine unit suite + restructure tests/protect/ by @patchstackdave in #58
• [feat] 49 - automate disclosure widget installation by @mariojgt in #59

New Contributors

• @patchstackdave made their first contribution in #57

Full Changelog: v0.3.8...v0.3.9