release: v2.2.0 — protect, hooks, watcher, sentinel (preview)

[JBAhire]

What

Release prep for v2.2.0 (minor — all additive since v2.1.0):

• CHANGELOG: adds the missing g0 sentinel entry (headline feature of g0 sentinel — MDM-deployed AI footprint discovery, PII exposure & governance #194 — was absent from [Unreleased]), converts [Unreleased] → [2.2.0] - 2026-07-30 with a release intro, and adds the behavior-change warning box:
  • g0 check now content-scans the Claude estate; critical findings cap the grade → previously-passing machines/CI can newly grade F / exit 1
  • daemon --no-upload flag + upload config key removed (verified no-op; scripted invocations now error on unknown option)
• Version bump: package.json + package-lock.json → 2.2.0

The sentinel changelog entry deliberately claims only what ships (scan/collect/report, apps + coding agents/MCP + browser extensions, PII evidence, governance verdicts) and lists daemon deltas / signing / installers as "toward GA". Note: Outlook COM add-in discovery is not implemented yet despite appearing on the solution page's surface list — flagged as a fast-follow, not claimed here.

Release steps after merge

1. gh release create v2.2.0 with notes from the CHANGELOG section → triggers the OIDC npm publish (release.yml)
2. Verify npm view @guard0/g0 version → 2.2.0 (fallback: workflow_dispatch on release.yml)

🤖 Generated with Claude Code

[github-actions]

g0 security scan

Score 55/100 (F)

Severity	Count
Critical	6
High	48
Medium	9
Low	1

Findings

• CRITICAL /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:226 — Docker socket mounted into container — full container escape possible. Address AA-SC-130: Docker socket mounted into container — full container escape possible
• CRITICAL analyzers/pipeline-taint.ts:4 — Pipeline taint: shell exfiltration chain. Remove or sandbox shell commands that pipe sensitive data to network endpoints. Use structured APIs instead of shell pipes.
• CRITICAL .:0 — Cross-tool risk: fetch-then-exec. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• CRITICAL .:0 — Cross-tool risk: db-code-exec. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• CRITICAL .:0 — Cross-tool risk: write-then-exec. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• CRITICAL .:0 — Cross-tool risk: shell-network. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• HIGH analyzers/parsers/mcp.ts:102 — Shell execution tool detected. Remove shell execution tool or wrap it with strict input validation and allowlisting.
• HIGH analyzers/parsers/langchain.ts:52 — Shell execution tool detected. Remove shell execution tool or wrap it with strict input validation and allowlisting.
• HIGH analyzers/parsers/langchain.ts:54 — Database tool without input validation. Use parameterized queries and validate all input before database operations.
• HIGH analyzers/parsers/langchain.ts:53 — Code execution tool without sandboxing. Run code execution in a sandboxed environment (Docker, E2B, subprocess with restrictions).

55 more findings

• HIGH analyzers/parsers/langchain.ts:53 — Code execution tool without sandbox. Run code execution tools in a sandboxed environment (Docker, E2B, etc.).
• HIGH analyzers/rules/code-execution.ts:265 — Code execution tool without sandboxing. Run code execution in a sandboxed environment (Docker, E2B, subprocess with restrictions).
• HIGH analyzers/rules/code-execution.ts:265 — Code execution tool without sandbox. Run code execution tools in a sandboxed environment (Docker, E2B, etc.).
• HIGH testing/payloads/openclaw-attacks.ts:66 — OpenAI API key detected in source code. Move secrets to environment variables or a secret manager. Never commit secrets to source code.
• HIGH analyzers/rules/code-execution.ts:163 — new Function() constructor used. Remove new Function() usage. Use safe alternatives.
• HIGH analyzers/rules/code-execution.ts:440 — child_process.exec() usage detected. Use child_process.execFile() or child_process.spawn() instead of exec/execSync to avoid shell injection.
• HIGH analyzers/parsers/langchain.ts:177 — LLM output executed as code. Never pass LLM output to exec() or eval(). Use a sandboxed code interpreter or safe parsing instead.
• HIGH analyzers/parsers/mcp.ts:145 — LLM output executed as code. Never pass LLM output to exec() or eval(). Use a sandboxed code interpreter or safe parsing instead.
• HIGH analyzers/rules/code-execution.ts:804 — Unsandboxed Docker socket access. Avoid mounting the Docker socket directly. Use a restricted Docker API proxy or rootless Docker.
• HIGH analyzers/rules/code-execution.ts:167 — Function() constructor with dynamic input. Avoid new Function() with dynamic input. Use safe alternatives or a sandboxed environment.
• HIGH analyzers/rules/code-execution.ts:980 — Template engine SSTI risk. Never pass user input directly into template strings. Use render_template() with named templates instead.
• HIGH analyzers/rules/code-execution.ts:1840 — ptrace/debugging syscall detected. Block ptrace and debugging syscalls via seccomp profiles. Set Yama ptrace_scope to restricted.
• HIGH /home/runner/work/g0/g0/src/endpoint/mdm-detect.ts:85 — LLM-generated code execution. Sandbox code execution or use allowlisted operations only
• HIGH /home/runner/work/g0/g0/src/endpoint/agentic-browser-scanner.ts:61 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:10 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/mdm-detect.ts:56 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/openclaw-config-hardener.ts:105 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/openclaw-config-hardener.ts:105 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/process-detector.ts:75 — Direct code/command execution — exec, os.system, child_process, Runtime.exec. Address AA-CE-063: Direct code/command execution — exec, os.system, child_process, Runtime.exec
• HIGH /home/runner/work/g0/g0/src/endpoint/scoring.ts:222 — All environment variables dumped — credential exposure. Address AA-DL-109: All environment variables dumped — credential exposure
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:41 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:63 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:80 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:97 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:114 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:131 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:146 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:161 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/host-hardening.ts:179 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• HIGH /home/runner/work/g0/g0/src/endpoint/auditd-rules.ts:55 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:63 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:70 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:570 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:637 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:210 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:369 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:513 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:544 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH /home/runner/work/g0/g0/src/endpoint/tetragon-rules.ts:545 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• HIGH analyzers/parsers/langchain.ts:666 — System prompt has no scope boundaries. Add explicit role definition, allowed actions, and behavioral boundaries to the system prompt.
• HIGH analyzers/rules/tool-safety.ts:1074 — Pipeline taint: shell exfiltration chain. Remove or sandbox shell commands that pipe sensitive data to network endpoints. Use structured APIs instead of shell pipes.
• HIGH endpoint/tetragon-rules.ts:372 — Pipeline taint: shell exfiltration chain. Remove or sandbox shell commands that pipe sensitive data to network endpoints. Use structured APIs instead of shell pipes.
• HIGH .:0 — Cross-tool risk: read-then-exfil. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• HIGH .:0 — Cross-tool risk: db-exfil. Limit tool capabilities for agent "AgentExecutor". Apply least-privilege: separate data-access tools from network/execution tools.
• MEDIUM /home/runner/work/g0/g0/src/endpoint/mdm-detect.ts:128 — Agent accesses kernel interfaces. Address AA-RA-047: Agent accesses kernel interfaces
• MEDIUM /home/runner/work/g0/g0/src/endpoint/egress-monitor.ts:734 — Tool has Docker API access — container escape risk. Address AA-TS-128: Tool has Docker API access — container escape risk
• MEDIUM analyzers/parsers/langchain.ts:55 — Filesystem tool without path validation. Validate and sanitize file paths. Use allowlists for permitted directories.
• MEDIUM enforcement/edm.ts:23 — API key in URL query parameter. Pass API keys in HTTP headers (Authorization, X-API-Key) instead of URL query parameters.
• MEDIUM testing/judge/llm-prompts.ts:69 — API key in URL query parameter. Pass API keys in HTTP headers (Authorization, X-API-Key) instead of URL query parameters.
• MEDIUM /home/runner/work/g0/g0/src/endpoint/sensitive-paths.ts:60 — Untrusted input flows to file path operation — path traversal risk. Address AA-CE-052: Untrusted input flows to file path operation — path traversal risk
• MEDIUM /home/runner/work/g0/g0/src/endpoint/scoring.ts:222 — Agent accesses environment variables. Address AA-RA-043: Agent accesses environment variables
• MEDIUM /home/runner/work/g0/g0/src/endpoint/agent-config-scanner.ts:257 — Tool has email sending capability — phishing and data exfiltration risk. Address AA-TS-105: Tool has email sending capability — phishing and data exfiltration risk
• MEDIUM analyzers/parsers/langchain.ts:56 — Tool has unrestricted network access. Address AA-TS-062: Tool has unrestricted network access
• LOW analyzers/parsers/langchain.ts:204 — Agent has no system prompt — vulnerable to unbounded behavior. Address AA-GI-073: Agent has no system prompt — vulnerable to unbounded behavior
• INFO analyzers/parsers/langchain.ts:204 — Agent has no error handler configured. Address AA-CF-064: Agent has no error handler configured

Gate: PASSED ✅

— See findings across every repo in your org → https://guard0.ai/signup?utm_source=github&utm_medium=pr_comment&utm_campaign=g0_action