Changelog

Releases

Beekeeper's first public release is v1.0.0. Every release is reproducibly built, cosign-signed (keyless, via GitHub Actions OIDC), and ships SLSA Level 3 provenance and a CycloneDX SBOM. The entries below carry copyable verification commands you can run yourself.

• v1.2.0: Catalog-sync visibility and alerting. The background catalog sync is now observable and alerts you when it acts. Adds a beekeeper catalogs status command, a rotating sync.log, a silent scheduled run on Windows, a desktop notification on a sync-hit quarantine, and a TUI quarantine card. Documents why the hourly job is a heartbeat, not the fetch rate (the configurable catalog_sync.interval defaults to 2h). No enforcement behavior changed.
• v1.1.2: Hook fail-close fix + self-catalog key rotation. Agent hooks now embed the absolute beekeeper binary path so a hook cannot silently fail open when beekeeper is off the PATH, and the embedded self-catalog signing key was rotated off a key whose private half lived in the test suite. No enforcement behavior changed.
• v1.1.1: First-run welcome + branded install. A small, polish-focused release. Bare beekeeper now greets you with a branded welcome banner, and the site ships branded install scripts (curl | sh and irm | iex) that download the signed binary with a progress bar and verify its checksum. No enforcement behavior changed.
• v1.1.0: Install Posture. Retires the package-manager nudge and replaces it with install posture: a default, tool-agnostic posture checked at the agent hook (release age, lifecycle scripts, and git or remote-URL dependencies, all warn by default and fail soft). Adds a read-only beekeeper posture view, scoped audited overrides with per-rule opt-up to block, and a Sentry install-observation rule (SENTRY-009).
• v1.0.0: First Stable Release. A fail-closed safety harness for autonomous coding agents: it evaluates every tool call against corroboration-based threat intelligence before it executes and blocks or quarantines threats across 17 agent harnesses. Includes sensitive-path enforcement, the package-manager nudge, editor-extension defense, cross-platform behavioral monitoring, an opt-in local prompt-injection sidecar, policy-as-code, and a validated release gate.