luckyPipewrench · Nov 9, 2026 · Nov 9, 2026
@@ -7,7 +7,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [3.8.0] - 2026-11-08
+## [3.8.0] - 2026-11-09
 
 ### Breaking Changes / Upgrade Notes
 
@@ -76,15 +76,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Decode joined subdomain labels before URL DLP checks using the registrable-domain boundary from the Public Suffix List. Existing hostname checks and literal-IP handling remain in place. ([#2121](https://github.com/pipelab-org/pipelock/pull/2121))
 - Keep shipped destructive-command rules from matching look-alike shell words or fully quoted search and print text in supported read-only scripts. Real destructive invocations and uninspectable commands retain their policy; the shell hook extends literal-text relief to file-delete and recursive-permission rules. ([#2134](https://github.com/pipelab-org/pipelock/pull/2134), [#2146](https://github.com/pipelab-org/pipelock/pull/2146))
 - Recognize the exact sourced Claude Code sign-in, profile, settings, policy and telemetry credential endpoints. Refresh and revocation accept credentials only in their designated JSON field; unsupported destinations and carriers still block. [Credential endpoint contract](docs/security/claude-code-credentials.md). ([#2138](https://github.com/pipelab-org/pipelock/pull/2138))
-- Let Codex CLI and Grok CLI sign-in access tokens reach their own vendor APIs. On traffic Pipelock inspects (HTTPS needs TLS interception), the token passes only as the whole Authorization bearer at that vendor's API host and path, and only when its issuer and client claims name that vendor. Pipelock doesn't verify the token's signature, so a forged token carrying those claims can still reach that vendor's API. A JWT with other claims sent to these hosts still blocks. ([#2159](https://github.com/pipelab-org/pipelock/pull/2159))
+- Let Codex CLI and Grok CLI sign-in access tokens reach their own vendor APIs. On traffic Pipelock inspects (HTTPS needs TLS interception), the token passes only as the whole Authorization bearer at that vendor's API host and path, and only when its issuer and client claims name that vendor. Pipelock doesn't verify the token's signature, so a forged token carrying those claims can still reach that vendor's API. A JWT with other claims sent to these hosts still blocks, and a custom pattern that reuses the built-in JWT pattern's name doesn't receive the allowance. ([#2159](https://github.com/pipelab-org/pipelock/pull/2159), [#2170](https://github.com/pipelab-org/pipelock/pull/2170))
 - Keep receipt-load dashboard snapshots outside the recorder directory, fail integrity on structured audit-gap diagnostics, and recognize the proxy's actual rule-bundle messages. Failed-run summaries include measured HTTP status counts; reports distinguish receipt failure causes and include redacted transport-error samples and counts by kind. ([#2037](https://github.com/pipelab-org/pipelock/pull/2037), [#2090](https://github.com/pipelab-org/pipelock/pull/2090), [#2104](https://github.com/pipelab-org/pipelock/pull/2104), [#2129](https://github.com/pipelab-org/pipelock/pull/2129), [#2139](https://github.com/pipelab-org/pipelock/pull/2139), [#2141](https://github.com/pipelab-org/pipelock/pull/2141))
 - Bound network waits in configuration examples, example verifiers and the verifier install gate. The SIEM example fails when webhook events can't be read. ([#1928](https://github.com/pipelab-org/pipelock/pull/1928))
 - Preserve response findings across Browser Shield rewrites, keep inspection spans correct through length-changing normalization, and remove invisible characters introduced by compatibility folding. ([#1913](https://github.com/pipelab-org/pipelock/pull/1913), [#2019](https://github.com/pipelab-org/pipelock/pull/2019), [#2034](https://github.com/pipelab-org/pipelock/pull/2034))
 - Scan typed JSON card values, preserve neighboring inspectable values around large numbers, and reject ambiguous typed field bindings. Card-shaped sequences made only from separate numeric values warn; string-containing and single-value findings retain their configured policy. ([#1921](https://github.com/pipelab-org/pipelock/pull/1921), [#1926](https://github.com/pipelab-org/pipelock/pull/1926), [#1929](https://github.com/pipelab-org/pipelock/pull/1929), [#1982](https://github.com/pipelab-org/pipelock/pull/1982), [#2031](https://github.com/pipelab-org/pipelock/pull/2031))
 - Inspect supported recoverable known-secret representations and URL fragments, retain structured scan findings, and close affected streams when inspection can't complete. ([#1929](https://github.com/pipelab-org/pipelock/pull/1929), [#2028](https://github.com/pipelab-org/pipelock/pull/2028))
 - Cover the multipart bytes delivered to raw-body receivers, including framing-adjacent text and part headers, and refuse ambiguous transfer encodings. ([#2046](https://github.com/pipelab-org/pipelock/pull/2046))
 - Keep warning observations score-neutral, credit only assessed-clean traffic, expire residual adaptive scores, and return uniform refusals during adaptive `block_all` while retaining detailed operator evidence. ([#1965](https://github.com/pipelab-org/pipelock/pull/1965), [#2030](https://github.com/pipelab-org/pipelock/pull/2030), [#2038](https://github.com/pipelab-org/pipelock/pull/2038))
-- Preserve tool-policy decisions through command handoffs and stricter interpretations of unproven executable names. Match supported abbreviated Git options and refuse uninspectable Git subcommands. Bounded alternative word readings add matches for supported shell expansions and preserve incomplete-check refusals; text policy retains its documented shell-resolution limits. ([#2008](https://github.com/pipelab-org/pipelock/pull/2008), [#2035](https://github.com/pipelab-org/pipelock/pull/2035), [#2040](https://github.com/pipelab-org/pipelock/pull/2040), [#2042](https://github.com/pipelab-org/pipelock/pull/2042), [#2065](https://github.com/pipelab-org/pipelock/pull/2065))
+- Preserve tool-policy decisions through command handoffs and stricter interpretations of unproven executable names. Match supported abbreviated Git options and refuse uninspectable Git subcommands. Bounded alternative word readings add matches for supported shell expansions and preserve incomplete-check refusals; text policy retains its documented shell-resolution limits. ([#2008](https://github.com/pipelab-org/pipelock/pull/2008), [#2035](https://github.com/pipelab-org/pipelock/pull/2035), [#2040](https://github.com/pipelab-org/pipelock/pull/2040), [#2042](https://github.com/pipelab-org/pipelock/pull/2042), [#2065](https://github.com/pipelab-org/pipelock/pull/2065), [#2171](https://github.com/pipelab-org/pipelock/pull/2171))
+- Judge persistence, shell-profile and credential-file write rules by where a file-write tool writes, so a note whose text mentions a protected path is no longer blocked. `target`, `destination` and `dest` count as destinations, and `dd` output operands, including relative dotfile names, are checked in the built-in policy and every preset. ([#2171](https://github.com/pipelab-org/pipelock/pull/2171))
 - Restrict server-issued ID allowances to supported caller identities and recorded send history, recognize colon-addressed paths, accept registry upload URLs issued in Location headers, and recognize supported punctuation inside exact origin-issued URI segment identifiers. ([#1960](https://github.com/pipelab-org/pipelock/pull/1960), [#1981](https://github.com/pipelab-org/pipelock/pull/1981), [#2002](https://github.com/pipelab-org/pipelock/pull/2002), [#2074](https://github.com/pipelab-org/pipelock/pull/2074))
 - Reduce path-entropy false positives for package versions and default Rollup asset hashes; exact suppression URLs retain their full destination match. Explicit HTTP path exclusions remain scheme-scoped. ([#1927](https://github.com/pipelab-org/pipelock/pull/1927), [#1957](https://github.com/pipelab-org/pipelock/pull/1957), [#1958](https://github.com/pipelab-org/pipelock/pull/1958), [#2010](https://github.com/pipelab-org/pipelock/pull/2010), [#2026](https://github.com/pipelab-org/pipelock/pull/2026))
 - Preserve managed containment socket and service state across install, upgrade and rollback; reconcile nftables and doorways from one plan; restore display runtime directories after reboot; and report repair advice using the observed proxy port. ([#1930](https://github.com/pipelab-org/pipelock/pull/1930), [#1944](https://github.com/pipelab-org/pipelock/pull/1944), [#1945](https://github.com/pipelab-org/pipelock/pull/1945), [#1954](https://github.com/pipelab-org/pipelock/pull/1954), [#1996](https://github.com/pipelab-org/pipelock/pull/1996), [#2016](https://github.com/pipelab-org/pipelock/pull/2016))