release: v2.2.0 — protect, hooks, watcher, sentinel (preview)

CHANGELOG.md

@@ -7,7 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.2.0] - 2026-07-30
+
+**One command turns coverage into enforcement — and the background check goes fleet-wide.** `g0 protect` installs g0's guardrails in one command across every surface: the MCP proxy, Claude Code hooks (the built-in Bash / file-write / WebFetch traffic no MCP proxy can see), and a resident watcher that keeps the machine covered as configs change — dry-run by default, full undo. The proxy learns TOFU tool-list pinning (the rug-pull vector), and `g0 check` now background-checks the components that *program* a Claude agent. And **`g0 sentinel`** *(preview)* extends the background check to entire fleets: pushed through the MDM you already run, every machine reports its AI footprint with evidence-based PII exposure, rolled into one org-wide report. Everything stays local-first — no raw PII ever leaves a machine, and nothing here requires an account.
+
+> **⚠️ Behavior changes — may affect scripts and CI.**
+> `g0 check` now content-scans the Claude estate (skills, plugins, subagents,
+> settings hooks, desktop extensions); critical findings cap the grade, so
+> machines and CI jobs that previously passed can now grade **F** and exit
+> **1**. Separately, the daemon's dead `--no-upload` flag and `upload` config
+> key were **removed** — `g0 daemon start --no-upload` now errors on the
+> unknown option (the flag was a verified no-op).
+
 ### Added
+- **`g0 sentinel` — fleet-deployed AI-footprint snapshots _(preview)_** — `g0 sentinel scan` writes an unattended machine snapshot of the endpoint's AI footprint (installed AI apps, coding agents + MCP configs, browser AI extensions across Chrome/Edge/Brave/Firefox with permission-risk scoring) and **evidence-based PII exposure** per tool — what it *can* reach × what *did* flow, reported as classes + counts + an evidence locator, **never raw values** — plus a per-tool governance verdict from a `guard0.policy.yaml` (allow / deny / monitor). `g0 sentinel collect` is a thin collector you host that MDM-run scripts POST snapshots to; `g0 sentinel report` rolls a directory of snapshots into one org-wide HTML report. Deploys through any MDM (Endpoint Central, Jamf, Intune, Kandji, …) — the binary never knows which one pushed it. Toward GA: resident-daemon deltas, snapshot signing, signed MSI / notarized PKG installers. See [docs/sentinel.md](docs/sentinel.md) and the [solution brief](docs/solutions/mdm-ai-footprint-governance.md) (#194).
 - **Resident watcher + `watch` protect surface** — `g0 protect --apply --surfaces watch` registers the daemon as a per-user autostart (launchd/systemd-user). The daemon now fs-watches MCP configs and the Claude estate, re-checks on change with once-only delta notifications (native OS notifications), alerts on hook-error-rate spikes, and — with `"enforce": true` — auto-quarantines known-malicious MCP servers and flagged-critical estate components into an undoable vault (`~/.g0/quarantine/estate/`). The daemon's dead `upload` config key and `--no-upload` flag were removed (verified never consumed; no behavior change).
 - **Claude supply-chain scanning in `g0 check`** — the components that *program* a Claude agent are now first-class scan targets: skills, plugins, subagents, settings-hook commands, and Claude Desktop extensions under `~/.claude` are enumerated and content-scanned (prompt-injection patterns, known-malicious infrastructure IOCs, shell-dropper heuristics like `curl | bash`). Critical findings cap the check grade, with flagged components listed in the report card. `g0 check` reports; the resident watcher's `enforce` mode (also in this release) can auto-quarantine flagged-critical components to an undoable vault.
 - **Proxy tool-list pinning (TOFU)** — `g0 proxy` pins each server's `tools/list` on first sight and surfaces drift (added/removed tools, changed descriptions — the rug-pull vector). `pinning: alert` (default) warns loudly; `pinning: deny` locks tool calls until `g0 proxy review-server <name> --approve`. Matching is semantic (sorted names + description hashes), so formatting changes never force re-approval. See [docs/runtime-proxy.md](docs/runtime-proxy.md).

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guard0/g0",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "Background check for AI agents — discover, assess, and test before you ship",
   "type": "module",
   "bin": {