Built together

2026-09-15 v1.7.3, Reliability & Update Restart

FIX RELIABILITY

A reliability release. Applying an update from the dashboard now restarts the service cleanly, the sidecar becomes ready in about a second instead of roughly thirty, the tamper-evident audit trail stays verifiable across upgrades, and an update can advance one platform without disturbing another. No detection or model changes, and a healthy install updates in place.

• Applying an update restarts the service cleanly. An earlier build could swap in the new version and then leave the background service stopped, so the dashboard sat on “reconnecting” until you restarted it by hand. Applying an update now shows a bounded “updating and restarting” state with a countdown, reloads on its own when the service comes back, and tells you exactly what to do if it does not. One-time note: if the dashboard shows reconnecting after you update from a version older than 1.7.3, run crawdad restart once. This is fixed permanently from 1.7.3 onward.
• Much faster startup. The sidecar now becomes ready in about a second instead of roughly thirty, so it is inspecting and protecting traffic almost immediately after a restart or an update. The heavier dashboard metrics finish loading a moment later in the background.
• The audit trail stays verifiable across upgrades. Crawdad keeps a tamper-evident record of every decision. That record, its signatures, and its device attestations now stay verifiable through a version upgrade, a device-key rotation, or a future change to the record format, so history signed under an older key is never orphaned and a genuine record is never misread as tampered. Existing records keep verifying with no migration.
• Per-platform updates. A release can now move one operating system forward while holding another, so macOS and Linux update without a held platform getting stuck retrying in a loop. macOS and Linux update in place to 1.7.3; there is no new Windows build in this release, and existing Windows installs keep working.

2026-09-15 v1.7.2, Core Experience

FEATURE FIX FEEDBACK

A release focused on the everyday experience: connecting an agent, understanding what Crawdad is doing, and staying out of your way. Connecting is now guided and one click, the dashboard tells the truth about which mode you are in and what it has caught, and a retrained detection model plus a false-positive fix stop benign coding prompts from being blocked. Detection coverage is unchanged; what improved is first-run accuracy, the honesty of the interface, and how easy it is to connect.

• Guided, one-click connect. The Connect screen now detects which AI tools you have installed and shows each one with the exact setup it needs, including the correct OpenAI /v1 base-URL suffix and NVIDIA, plus first-class support for the OpenAI Codex CLI (labeled correctly, with its own configuration recipe). With your consent it can make the change for you in one click after a clear two-step confirmation, instead of you editing shell configuration by hand.
• A dashboard that tells the truth. The mode pill now reads “record” or “block” from what Crawdad is actually doing, instead of turning green just because detection is on. Every screen draws its counts from one source so they agree, you can switch a device between monitor and enforce from the dashboard, the built-in self-test is clearly separated from real activity so a test never looks like a live detection, and the navigation is simplified into a primary set with the advanced tools grouped on their own.
• Fewer false positives, and no more agent lock-outs. We retrained the detection model so benign coding and meta prompts, for example asking about “instructions” or a “system prompt”, are no longer blocked, while real attacks are still caught. A single false positive can no longer cascade into locking an agent out of its own login, Allow-Once now genuinely suppresses the repeat block, and a new sensitivity control lets you tune how aggressively the model blocks while credential and data-exfiltration protection stays always on.
• Truthful connection status. Health is now checked with a real connection to the proxy port, so a busy but healthy sidecar is no longer reported as down.
• Documentation and website accuracy pass. A sweep of the docs and site to state the mechanism honestly (what records versus blocks, correct provider setup, source-available licensing) and to make key pages easier to find.

2026-09-03 v1.7.1, Auto-Update & Service Hotfix

FIX SECURITY

A hotfix for the macOS auto-update and service path. No behavior change for a healthy install; this repairs installs that could not start or self-update, and hardens the updater's restart across platforms.

• macOS launchd spawn failure fixed. A per-user service that had been poisoned by an earlier run as root, a root-owned /tmp/crawdad.log, could fail to start. The service now logs to a per-user path (~/Library/Logs/crawdad) instead of shared /tmp, and the installer stops any running sidecar and reclaims stale root-owned files before installing. Updating on macOS: a stuck or poisoned 1.7.0 install should take 1.7.1 with a fresh install (curl -fsSL https://getcrawdad.dev/install.sh | sh), which now self-heals; a healthy install updates in place.
• Service control targets the real installed shape. crawdad stop, restart, and uninstall, and the updater's own restart, now drive the actual installed service, the per-user agent or the system daemon, instead of assuming one shape, so those commands work on a normal install and the sidecar is no longer run as root.
• In-app update reliability. After applying an update the sidecar now restarts into the new binary correctly, the code-signature check no longer rejects a validly-signed standalone binary, and the privileged update helper writes its archived binaries owned by the user.

2026-09-02 v1.7.0, Declared Intent & Observe-First

FEATURE SECURITY

Declared intent and an observe-first default. Monitor remains the default posture, and a stock device still inspects and records without installing any OS lock, so upgrading changes nothing until you opt in. What is new: the detection engine now leans observe-first on a fresh install to cut first-run false positives, and an operator can optionally attach an intent descriptor to a governed agent.

• Declared intent (intent descriptor). Opt-in and off by default. An operator can attach a descriptor that states what a governed agent is supposed to do, its expected tools, data, and effects. When a request on the proxy path drifts from that declared intent, Crawdad stops the drifting agent's action and records why, it does not kill the process and does not touch traffic the agent did not route through Crawdad. With no descriptor attached, behavior is unchanged, and the drift check runs in the shared tool-call path so it also covers streamed agents.
• Observe-first by default. A fresh, un-tuned install now favors observing and recording over blocking out of the box, removing a class of first-run false positives. Detection coverage is unchanged; what changed is how aggressively a brand-new device blocks before an operator sets a posture.
• Fleet: durable installs and dual-authorized telemetry. Devices and installs persist as durable records in the console, approvers are notified on pending actions, and any content-carrying telemetry requires an org policy plus an on-device consent record before an elevated field is emitted. The default stays metadata-only.
• Consent-gated installer. The installer asks for consent before it configures a session-scoped proxy and registers the device through the egress gate, with a prompt-free --silent path for MSP/RMM rollouts and crash reporting off unless explicitly enabled.
• Agents view redesigned as a roster. One card per agent with an honest one-line coverage state and a mechanism-appropriate switch, and a true protection headline (for example, “0 of 2 actively protected, 1 ready to protect, 1 needs Workspace”) in place of the old latching “Protected: N/N” tile.
• Claims and language honesty pass. Customer-facing copy states the mechanism rather than a label: raw content never leaves the machine by default, and detection and enforcement run fully on-device. Crawdad remains source-available under the Business Source License 1.1.

2026-08-24 v1.6.1, Auto-Updater Reliability

FIX SECURITY

Fixes the macOS in-app auto-update, which could fail after applying an update, and closes an authorization gap on two config endpoints. macOS installs on 1.6.0 or earlier should take this update with a fresh install (curl -fsSL https://getcrawdad.dev/install.sh | sh), not the in-app updater; the pre-1.6.1 updater is the component being fixed. From 1.6.1 onward, in-app updates place atomically and self-heal.

• Atomic-rename updates. The updater replaced the installed binary in place, which invalidated the macOS code signature at restart and could crash-loop the sidecar. It now writes the new binary to a sibling temp file, verifies it (SHA-256, Team-ID codesign pin, notarization assessment), and swaps it in by atomic rename, so the running signature stays valid. Proven on real macOS: the same binary that is killed when placed in-place runs cleanly when placed by atomic rename.
• Version store, rollback, and self-healing. Recent versions are archived; crawdad rollback restores the previous one, and a failed update rolls back automatically instead of crash-looping.
• User-controlled updates. crawdad update status / check / apply / skip / auto. Updates stage by default and apply on your action; automatic apply is off by default and a skipped version is never re-applied.
• Administrator gate on export config. The SIEM and red-team config writers now require the administrator role, matching the Splunk and OTLP export writers.

2026-08-21 v1.6.0, Runtime Governance & Enforce Mode

FEATURE SECURITY

An opt-in enforcement layer on top of detection. The default, Monitor, is unchanged from prior releases, a stock device is byte-for-byte unchanged, so upgrading changes nothing until you opt a device or a fleet into Enforce. Enforce binds a governed agent's egress to Crawdad at the operating-system level.

• Enforce mode. Monitor inspects and blocks on detection but installs no OS lock. Enforce installs a persistent OS default-deny egress lock (pf on macOS, iptables on Linux) so a governed agent reaches only the Crawdad proxy path, all other egress, including UDP/QUIC, is denied by construction, and the lock persists across a sidecar kill. Windows applies the mandatory credential broker but has no OS egress lock. Proven on Linux against a live kernel (default-deny to-any, UDP/QUIC, kill -9 persistence, clean removal) and on macOS (pf floor).
• Maximum tier. An opt-in tier under Enforce that runs the agent inside a sealed VM (macOS/arm64, Apple Virtualization framework) whose only network interface routes through Crawdad, so containment holds at the packet level. Liveness-gated: it falls back to the Standard egress-lock floor if the VM capability is not installed (fail-closed, the configured tier is never silently dropped), and reports tier_configured vs tier_in_force.
• Per-tool cumulative risk. A per-(agent, tool) risk accumulator with decay, folded into the proxy at the tool-call boundary. Default Observe (records, never blocks unless an operator opts in), composing with the per-tool rules ladder and the session-risk budget.
• Break-glass recovery. crawdad enforce recover / release / reenforce / status for a persisted egress lock. recover restarts into a time-boxed bounded-Monitor posture (detection and audit on, lock off) that auto-reverts to Enforce at expiry; release is a last-resort offline release, refused while the sidecar is alive. Requires root plus the device-administrator token, the agent can never invoke it, and every use is written to the tamper-evident audit chain. Default window 60 minutes, hard maximum 240.
• fail_mode now defaults fail-closed. When the sidecar is alive but cannot inspect a request (an unparseable body), it now blocks with 422 rather than forwarding uninspected. Set fail_open for the legacy behavior; a missing, corrupt, or unrecognized value resolves to fail_closed. There is no "degraded" fail-open forward path.
• Administrator-gated enforcement. POST /api/v1/mode/enforcement is administrator-gated, part of a broader sidecar auth sweep that admin-gates the weaken-protection, erase, disable-audit, and touch-binaries handler class.

2026-08-19 v1.5.3, Pre-1.6 Hardening Rollup

SECURITY

• Egress hardening. All outbound HTTP, WebSocket, and syslog egress now routes through the shared air-gap gate, enforced in CI with per-path tests. SBOM regenerated; a Sentry-scrubber test added.
• License-email privacy. The activation email moved out of the request URL query string into the POST body (client and gateway; the gateway dual-reads body-first, then query-fallback for backward compatibility).
• Auto-update codesign pin. Auto-update tightened to the canonical Developer ID Application requirement with an intermediate-CA / Team-ID assertion, verified in both directions.

2026-07-31 v1.5.1, ONNX Init Resilience

RELIABILITY

• ML crash sentinel. Intermittent SIGABRT during ONNX Runtime graph optimization on Apple Silicon no longer kills the sidecar permanently. On crash: a sentinel file survives, next startup detects it, skips ML, and the sidecar starts healthy on L1 pattern detection. Retries ML after 120 seconds. After 3 consecutive SIGABRTs in an hour, ML pauses for up to 1 hour while L1 patterns stay active.
• Crash-loop guard. ML crashes now degrade gracefully instead of killing the sidecar. The crash-loop guard checks the sentinel before exit, so the sidecar always restarts into a working state.
• Honest status reporting. The health endpoint now accurately reports "retry paused for up to 1h (L1 patterns active)" when ML is sentinel-disabled, instead of the false "retrying in 120s" that appeared previously.

2026-07-30 v1.5.0, Multi-Platform Release

FEATURE

• Full platform coverage. Signed, notarized binaries for macOS ARM64 + x86_64, Linux x86_64 + ARM64, and Windows x86_64. SHA-256 verified against CI for every binary.
• Windows installer. install.ps1 one-liner for Windows, previously returned 522. Cloudflare Worker updated with the new route.
• Sealed arbiter. Hardware-attested ML inference on AWS Nitro Enclaves. KMS gates model-key release on attestation. The real 271 MB DeBERTa model runs inside the enclave, attack/benign discrimination verified end-to-end over public HTTPS.
• Auto-update path. Ed25519-signed manifest cutover, existing installs auto-update on next check. Signature verified locally before push and again against the live production endpoint.

2026-07-26 v1.4.0, Guardian UI & API Tier 1

FEATURE

• Guardian UI. The Workspace view replaced with a 4-layer state-driven guardian screen. Accordion-style item detail. Decisions move items between layers with a full audit trail and recently-decided list.
• API Tier 1. Moat scrub, OpenAPI spec, and developer documentation for the public API surface.
• Dashboard performance. r2d2 connection pool, database indexes, query consolidation, and pre-compute cache. Cold-start penalty eliminated, 9.5 seconds down to under 100 milliseconds (verified live).
• Email system. Durable subscriber list, welcome email with truthful copy, and one-click unsubscribe.

2026-07-25 v1.3.0, Workspace

FEATURE

• Workspace VPN surface. Persistent ON/OFF VPN control with Touch ID approval and dashboard UI. Agents run inside a hypervisor-isolated workspace with no network path except through Crawdad, the architectural closure for agents that ignore the proxy.
• Guest projection. Writable filesystem projection so guest writes are visible on the host. Manifest-based file classification with --session flag and exit hints.
• Guest assets. Built, uploaded to R2, manifest SHAs embedded, resumable fetch.
• Biometric helper. Hardware-gated approval via the biometric helper binary, packaged in release.sh and install.sh.

2026-07-25 v1.2.0, Air-Gap, Clarity Mode & Threat Intelligence

FEATURE SECURITY

Air-gap egress enforcement

• crawdad-egress crate. Dedicated egress chokepoint, all sidecar egress converted to the EgressClient with 100% coverage. Build-time lint guard prevents new uncontrolled egress paths.
• Full egress coverage. Non-completions paths (storage, uploads, arbitrary POST) are now inspected, previously only completions were checked. Destination policy evaluated at headers before body read. Cumulative volume escalation closes the small-chunk loophole.

Clarity Mode

• Protected Models view. 3-state badges showing protection status per model. crawdad run launcher for one-click protect with environment proven.
• Protect/bypass backend. GUI graceful-restart mechanism. Unified ClarityBadge. Agents-view protect/pause buttons with Overview coverage upgrade.
• Fleet-permission gating. Clarity protect/bypass/pause actions gated by fleet permissions.

Enterprise ingestion

• ICAP server. Opt-in config model with integrity-checked proxy-mode skeleton. ICAP server reuses the existing detection engine. Fleet console management UI for enterprise ingestion.

Threat intelligence

• Threat telemetry pipeline. Relay aggregator to console sync bridge. Governed telemetry-depth policy with dual-auth mechanics.
• Threat dashboard & reports. Visual security intelligence with zero-knowledge-enforced exports.

Security & auth

• Passkey + TOTP. Settings/Security page for managing passkeys and TOTP from inside the app.
• Auth perimeter. Legacy /api/* routes closed. RBAC role tokens enabled.
• Dual-auth bypass fix. Device-target and push_policy now require second operator.
• Defense-in-depth. Splunk/OTLP red-team tests, gateway Sentry scrubber, consent-gate parity.

Release tooling

• Ed25519 manifest signing. crawdad-sign tool with keygen, sign, verify, pubkey subcommands. Volume safety checks and key material zeroization.
• Installer hardening. 6 dangerous || true instances replaced with real error messages.

2026-07-07 v1.0.0, Shipping Release

FEATURE

• Crawdad 1.0. Version unified across all 21 workspace crates. Full fleet loop verified end-to-end on the real deployed stack.
• Console-driven enrollment. Operators mint single-use enrollment tokens from the console. Sidecars redeem tokens with a CSR, receive a signed certificate and root CA, and pin the CA fingerprint on first use (TOFU). Wrong fingerprint aborts enrollment and stores nothing.
• One-command fleet bootstrap. ./init-fleet.sh stands up the full fleet stack from zero: step-ca, PKI extraction, relay TLS cert, image build, service start, admin + enrollment + operator initialization. Idempotent, safe to re-run.
• Fleet Console deployable. docker-compose.fleet.yml deploys the complete fleet stack (step-ca + relay + console). Console command → relay → sidecar verified with chain + signature + replay + target + hard-floor checks.
• Guided first-run. The console dashboard detects a fresh deployment and shows a setup guide with the correct bootstrap commands.
• Self-protection. Auth-gated override endpoint. Filesystem rules wired into decide_tool_call. Tamper attempts recorded in the hash chain at risk 100.

2026-06-01 v0.12.0, Graduated Trust

FEEDBACK FEATURE

Early testing showed Crawdad was too aggressive out of the box, blocking tool calls for benign dev work. This release introduces a graduated approach: real attacks still block immediately, but ambiguous actions are observed instead of blocked.

• Two-tier default policy. High-confidence attacks (prompt injection, credential exfiltration, destructive commands) block by default. Ambiguous tool calls (language runtimes, network tools) are observed, passed through, recorded, and surfaced without interrupting work.
• Observe mode. A new disposition between Allow and Ask. Observed events pass through the proxy unchanged but appear in the Activity feed for review.
• Activity feed. Dashboard view showing a chronological stream of observed and blocked events with color-coded badges.
• Promote-to-block. One-click "Block this" on any observed event writes a deny rule and reloads the policy engine instantly.
• Session summaries. Per-session breakdown of observed, blocked, and "worth a look" events.
• ML sensitivity presets. Strict / Balanced / Relaxed, one setting controls the ML classifier threshold across both the proxy and scan endpoints. Default is Balanced (99.8% detection, 0.09% FP on the open benchmark).
• Node-family tool coverage. node, nodejs, ts-node, tsx, npx, and more are now observed by default. npx moved from allowed to observed.

2026-05-19 v0.11.0 – v0.11.3, Policy Engine

FEATURE

• KDL capability policy engine. Configurable rules for filesystem, commands, network, and credentials. Supports Allow, Ask (pending review), Deny, and Kill verbs with per-tool and per-path granularity.
• Pending Review queue. Actions that match an Ask rule are held for dashboard approval before proceeding. SSE-driven real-time updates.
• Default security baseline. Ships with an opinionated default policy: read-only commands allowed, destructive commands blocked, system-admin commands require approval.
• Policy page in the dashboard. Browse, enable/disable, and test rules. Import/export policy bundles for fleet deployment.
• ML classifier calibration. Recalibrated the ML classifier to reduce false positives on benign developer chat (security discussions, code reviews), with no loss of attack detection on the benchmark corpus.

2026-05-18 v0.10.5 – v0.10.7, Reliability

FEEDBACK RELIABILITY

Driven by friction surfaced during real-world testing.

• Dashboard no longer blanks on restart. A reconnection indicator appears automatically and dismisses when the sidecar is back.
• Manual trust-level choices stick. Your explicit trust-level decision for an agent is no longer overridden by a single detection event.
• Fewer false escalations. A single borderline detection no longer causes an abrupt trust-level change for an agent.
• Events survive restart. The event stream replays missed events on reconnect so nothing is lost.
• One-click restart to apply updates. Dashboard button replaces manual terminal commands.
• Auto-update observability. Every update check now produces a log line. Updater task is supervised, panics respawn within 60 seconds.

2026-05-07 v0.10.2 – v0.10.4, Install & ML Activation

INSTALL

• ML detection activates on first boot. Fresh installs across macOS ARM64, Linux x86_64, and Linux ARM64 now reach full ML detection without manual steps. The model and runtime download in the background and activate automatically.
• Robust Linux installer. Handles sudo installs correctly (resolves the real user's home, not root's). Graceful fallback on systemd-less distributions (Alpine, distroless). Handles minimal Docker containers.
• Reproducible public benchmark. 99.80% attack detection (496/497), 0.09% false-positive rate (1/1,172), verified end-to-end through the full proxy pipeline. Reproduce it yourself.
• Install troubleshooting page. Docs → Install Troubleshooting covers every error path.

2026-05-06 v0.10.0 – v0.10.1, Protection Modes

FEATURE

• Protection modes. Maximum / Standard / Reduced / Paused. Standard is the default. Reduced flags most categories instead of blocking. Paused suppresses blocking while continuing to detect and record forensically, useful when Crawdad is in the way and you need to ship. Auto-unpause after a timer.
• Protection-mode pill in the dashboard header. Always visible. One click to change. Keyboard shortcut for the modal.
• ML detection on all supported platforms. macOS ARM64, Linux x86_64, Linux ARM64. Proxy attack recall measured at 99.5% (190/191 attacks blocked).
• macOS auto-quarantine notification. Native macOS notification fires when an agent is escalated to Quarantined. Tapping opens the Identities page.

2026-04-21 v0.9.2, Cross-Platform ML

FEATURE

• ML detection on three platforms. macOS ARM64, Linux x86_64, and Linux ARM64 all ship with auto-downloaded ML. Intel Mac remains pattern-only pending an upstream ONNX Runtime release.
• Smaller ML model. FP16 quantization reduced the model from 541 MB to 272 MB with identical accuracy.
• Deferred download. Install is binary-only (~30 MB, seconds). The ML model downloads silently in the background on first run.
• Open benchmark corpus. 497 attacks across 13 categories, 1,172 benign samples across 4 categories. CC-BY 4.0, reproducible by anyone.
• MCP server security database. 59 servers across 16 categories with trust-level classification.

2026-04-17 v0.9.1, Remote Control Plane & Agent Trust

FEATURE

• Monitor from your phone. Pair via QR code, then view live detections, change agent trust levels, and release quarantined agents from any network. All relay traffic is end-to-end encrypted, the relay sees only opaque ciphertext.
• Per-agent trust levels. Four levels (Autonomous, Monitored, Restricted, Quarantined) with automatic escalation on detection events and configurable auto-recovery.
• Agent attribution. Every request is attributed to the specific agent process that made it, so actions against one agent never affect another.
• Dashboard agent behavior map. Per-agent activity sparklines, top tools, anomaly indicators.
• Attack pattern intelligence. Ranked category bars with trend arrows, top and new-this-period patterns.

2026-04-15 v0.9.0, Launch

FEATURE

• Multi-layer detection pipeline. Pattern matching, ML classifier, indirect injection, session context, PII/credential detection, code scanning, optional LLM Judge.
• Transparent proxy. One env var per provider, works with Claude Code, Anthropic SDK, OpenAI SDK, and any base-URL-compatible client.
• Local dashboard. Session timeline, detection details, audit trail, cost tracking.
• Zero-knowledge architecture. Raw content stays on your machine by default. Metadata-only telemetry (counts, categories, verdicts) egresses by default, raw content never does. Telemetry depth is customer-governed.
• Signed binaries. macOS: signed + notarized by Apple. Linux: four-platform support.