gate.cat v0.4.18

0.4.18 — PyPI listing landing (T5), CLI Solo nudge (T6), pack hint (T7). Deterministic, fail-closed action-veto for AI coding agents. pip install gate.cat · https://gate.cat

gate.cat 0.4.17 — one-time post-veto Team hint

After gate.cat blocks a genuinely dangerous command for the first time on a machine, it now prints a single stderr line pointing to Team plans (off-machine record of vetoes + teammate alerts): https://gate.cat/teams.html

• Once per machine, ever (flag in ~/.gatecat/.nudged); only on a REAL enforced veto (never on warns/faults/allows).
• Opt-out: GATECAT_NO_NUDGE=1 (also honors GATECAT_QUIET).
• Best-effort, out of the decision path: wrapped in try/except — it can never change a veto verdict or exit code.
• Honest copy: states the true limitation (this-machine-only), which is the real Cloud/Team value prop. No policy / recall / bypass changes.

Full suite: 1909 passed, 26 skipped.

gate.cat 0.4.16 — full launch

The first full gate.cat launch release: a free, local veto layer for AI coding agents, plus optional zero-knowledge Cloud evidence.

What ships

• 71 default policy walls and 73 presets across destructive shell, cloud, identity, database, billing and secret-handling actions.
• Secret-exfiltration hard block: catches secret/private-key material flowing into network or mail sinks while preserving public keys, templates and ordinary sends.
• Cloud lifecycle correctness: duplicate billing events mint one key; expired subscriptions revoke access; reactivation issues a replacement.
• Safer installers: PEP 668-friendly Linux and Windows setup without modifying system Python.
• Consistent launch surface: one pricing model and checkout map across the website, README and pricing reference.

Reproducible release gates

• 1863 passed, 27 skipped, 0 failed locally.
• CI green on Python 3.11, 3.12 and 3.13.
• 43/43 known danger classes neutralized; 0/13 benign twins false-blocked.
• Bypass suite: 178/178 claimed dangers caught, with one known gap and one benign false-block explicitly printed.
• Clean install verified from the public PyPI wheel.

Install safely

Download the installer first so you can inspect it before execution:

curl -fsSL https://gate.cat/install.sh -o /tmp/gatecat-install.sh
sh /tmp/gatecat-install.sh

Honest boundary

The gate is certain only about what it blocks. An unmatched action is unchecked, not verified safe. Local protection remains free forever; Cloud is optional.

Full changes: https://github.com/BGMLAI/gate.cat/blob/v0.4.16/CHANGELOG.md

0.4.11 — +10 coverage classes, 67 real gaps closed (28→38 policies)

An adversarial fan-out generated 444 concrete irreversible commands across 16 surfaces (AWS/GCP/Azure, Kubernetes, databases, streaming/queues, disk, secrets, registries, macOS, Windows, …) and replayed every one through the live 0.4.10 gate. 153 dangerous shapes passed. This release closes 67 of them with 10 new deny-list classes — core policies go from 28 to 38.

Added (all block-level, benign-twin validated)

• CLOUD_STORAGE_WIPE — recursive/forced object-storage delete (aws s3 rm --recursive, gsutil/gcloud storage rm -r, rclone purge/delete, azcopy remove --recursive, mc rm --recursive). Disposable prefixes (tmp/cache/scratch/build) and additive sync still pass.
• STREAM_QUEUE_DESTROY — kafka-topics --delete, kafka-delete-records, consumer-offset reset --execute, sqs purge-queue, pubsub … delete, rabbitmqctl reset/delete_queue/purge_queue.
• WINDOWS_DESTROY — PowerShell Remove-Item -Recurse -Force, cmd rd /s, del /q /s, format X:, cipher /w:, reg delete /f, bcdedit /delete.
• MACOS_DISK_DESTROY — diskutil eraseDisk/deleteContainer/secureErase, tmutil deletelocalsnapshots, security delete-keychain, srm -rf.
• DB_DESTRUCTIVE_EXTRA — dropdb, mysqladmin drop, DROP TABLESPACE/USER/COLUMN/KEYSPACE, RESET MASTER, TRUNCATE, pg_ctl stop -m immediate.
• DATASTORE_FLUSH_EXTRA — etcdctl del --prefix, ES delete-by-query/index, nodetool clearsnapshot, mongosh … .drop()/.dropDatabase()/.deleteMany({}), redis scan-and-DEL. Filtered deleteMany({…}) still passes.
• DISK_DESTROY_EXTRA — sfdisk --delete, cryptsetup luksRemoveKey/luksErase/erase, fdisk/gdisk on a device, wipe -rf.
• K8S_DESTROY_EXTRA — kubectl delete -f/-k, drain, delete node, delete pvc --all (dry-run spared).
• REGISTRY_IMAGE_DELETE — crane/skopeo delete, oras manifest delete, aws ecr batch-delete-image/delete-repository, npm dist-tag rm.
• SECRET_STORE_DELETE_EXTRA — vault secrets disable / lease revoke -prefix / kv metadata delete / token revoke -mode=path, gcloud secrets delete.

Honest limits

Every new pattern is structure-keyed and benign-twin validated — 0 false-positives introduced (disposable cleanup, filtered deletes, additive sync, single-file deletes all still pass). Full suite: 1194 passed. The ~86 shapes still passing stay disclosed: obfuscation (runtime-assembled / env-indirection — the deny-list limit), paid-pack surfaces, and disposable-artifact cleanups the gate deliberately allows.

pip install -U gate-cat

0.4.10 — two disclosed gaps closed (outside multi-model review)

A user ran an independent multi-model gauntlet (GPT-4o + Grok + Gemini) against gate.cat before deploying it on their own infra. Of five findings, two were already fixed (the encoded-pipe forms are caught since 2026-07-05), two are by-design honest limits, and two were real — closed here.

Fixed

• Terraform/OpenTofu interactive-prompt bypass. A bare terraform destroy stops for a human, but an agent defeats that by piping the confirmation in (yes | terraform destroy, echo yes | terraform destroy). TERRAFORM_PROD now blocks any pipe INTO a terraform/tofu … destroy — verified end-to-end against real Terraform v1.9.8 (the managed file survives every automated destroy, dies only on the interactive human-confirmed form). Bare interactive destroy, plan, and destroy | tee still pass (low false-positive preserved).
• Proxy enforcement is now observable. GET /health returns action_veto: {mode, enforcing, policies} and startup logs the status loudly (WARNING when tool_veto=off), so a misconfigured passthrough proxy is detectable instead of looking healthy.

Notes

• KNOWN_GAP shrinks 2 → 1 (runtime-assembled binary name remains, disclosed). 1007 tests pass. pip install -U gate-cat.

0.4.9 — two live-caught fixes: RM_RF filename FP; block outranks warn

Fixed

• RM_RF no longer false-blocks filenames that look like flags. Caught live during the 0.4.8 release: rm /tmp/pypirc-fresh was vetoed because the old whole-line lookahead read -fre inside the filename as an -fr flag. Flags are now matched as tokens (rm "-rf" / still blocks) and the match stays inside one command segment (rm x && tar -rf a.tar y is no longer blamed on rm). All dangerous spellings stay caught: -rf, -fr, -Rf, -rfv, -vrf, -Rfi, split -r -f / -f -r.
• Block-level policy outranks warn-level in attribution, order-independent. Caught live productizing the policy packs: attribution was first-match-in-list-order, so the core generic net HTTP_API_DELETE_GENERIC (warn) silently downgraded a hard danger an operator pack's block rule also matched — GATECAT_EXTRA_POLICIES appends packs after the built-ins. Attribution is now two-pass (block first, then warn): a hard match is never degraded by list order; a warn-only match still warns.

Full suite: 1005 passed, 27 skipped. Bypass suite: 70/70 dangers, benign corpus grown by the filename-substring class.

0.4.8 — policy packs plug into the hook; 28 core defaults

Added

• GATECAT_EXTRA_POLICIES loader — operator policy packs now reach the hook and the proxy. Previously the Claude Code hook and the proxy hard-coded the built-in defaults, so an installed pack only worked through the SDK — never in the strongest enforcement point (the PreToolUse block that runs before the command executes). Set a comma-separated module list (GATECAT_EXTRA_POLICIES=gatecat_packs.fintech,mycompany.policies); each module's POLICIES list and every *_PACK attribute are folded in after the built-ins. Fail-closed: an unimportable module, a non-Policy object, or a named-but-empty module blocks the hook (exit 2, even in shadow mode) and refuses to start the proxy — a security tool must never run without a policy the operator believes is enforced. 19 tests incl. subprocess end-to-end.
• Coverage-audit promotion: 5 new core default policies (DOGFOOD_DEFAULTS 23 → 28). The 2026-07-09 audit of 448 real destructive commands found three universal + catastrophic classes passing the default gate (non-delete verb shapes): IAM_PRIVILEGE_ESCALATION (block) + IAM_IDENTITY_TAMPER (warn), BACKUP_DESTROY (block — restic/borg forget/prune, zfs destroy, cloud snapshot delete), HTTP_API_IDENTITY_DNS_DESTROY (block — curl -X DELETE to identity/DNS/registrar APIs) + HTTP_API_DELETE_GENERIC (warn). Bypass suite 65/65 → 70/70; benign twins verified passing.
• gate.cat report [YYYY-MM] — free local monthly report (Markdown, counts-only, nothing leaves the machine).
• gatecat/cloud_reporter.py — optional cloud client: OFF unless GATECAT_CLOUD_API_KEY is set, hash-by-default, never in the gate's execution path.

Full suite: 1001 passed, 27 skipped. Wheel verified in a clean venv (hook e2e from the installed package).

0.4.7 — positioning fix: the veto is model-agnostic

"Built for cheap/local model agents" was inaccurate. The action-veto is deterministic and model-agnostic — it inspects the tool call at the boundary, so it protects any agent the same way, and the flagship integration is a Claude Code hook (a frontier model). Reframed the description, GitHub About, README, and llms.txt to "for any tool-using agent, from a Claude Code hook to local LLMs". The 7-30B strength is real but belongs to the uncertainty signal (a secondary feature) — now scoped there, not applied to the whole product. No code change. FACTS F9 → 0.4.7.

0.4.6 — cache-path entry points honor the zero-dep-core contract

A plain pip install gate-cat gives a zero-dependency veto. This release makes the cache-side tools degrade as gracefully as the core already promised.

• gatecat-cli no longer crashes with a raw ModuleNotFoundError: numpy — it prints install gate-cat[cache] and exits cleanly. Bonus: gatecat-cli audit (which runs against your endpoint, not the cache) now works without the cache stack.
• from gatecat import CachedOpenAI / CachedAnthropic without the deps now name the right extra (missing numpy → [cache], missing openai → [openai]), not a raw traceback.
• +6 regression tests. The veto path was already clean and is unchanged.

FACTS F9 → 0.4.6.

0.4.5 — the hook gets a home on the landing page

The Claude Code hook is the #1 pitch (enforcement outside the model's control flow), but the landing README only mentioned it. This release gives it a copy-paste home.

• README 'The hook — the strongest mode' section — the ready-to-paste .claude/settings.json PreToolUse block, right after Install, with a working first-run test.
• Dashboard empty-state fixed — was pointing pip install users at examples/ (not shipped in the wheel); now names the actionable steps and links the README hook section.
• README proxy: 20 → 21 deny policies (FACTS F10).

All doc claims verified this session against the live hook subprocess, proxy /health, CLI dashboard (empty + populated + why), and both demo casts. Tests 907/27/0.