# Assay v2.4.0 Release Notes

**Release Date**: January 2026

This release introduces comprehensive sandbox security hardening (Phase 5), making Assay the most secure way to run untrusted MCP servers and AI agents.

---

## Highlights

### 🛡️ Environment Scrubbing (PR #44)

Credentials and sensitive variables are now **scrubbed by default** before spawning sandboxed processes.

```bash
# Secrets automatically removed
assay sandbox -- ./mcp-server
# ✓ AWS_SECRET_ACCESS_KEY removed
# ✓ GITHUB_TOKEN removed
# ✓ OPENAI_API_KEY removed
```

**New CLI flags:**
- `--env-allow VAR` — Allow specific variable through filter
- `--env-strict` — Only safe base vars (maximum security)
- `--env-passthrough` — Disable scrubbing (danger!)

### 🔒 Landlock Deny-Wins Correctness (PR #45)

Assay now **detects policy conflicts** where Landlock cannot enforce deny rules inside allowed paths.

```
WARN: Landlock cannot enforce deny inside allowed path:
      /home/user/.ssh (allowed by /home/user)
INFO: Degrading to Audit mode (containment disabled)
```

**New CLI flag:**
- `--fail-closed` — Exit if policy cannot be fully enforced

### ⚡ Fork-Safe pre_exec (PR #46)

Landlock enforcement now uses **async-signal-safe code only** in the child process, eliminating potential deadlocks and undefined behavior.

### 📁 Scoped /tmp Isolation (PR #47)

Each sandbox run gets a **unique temporary directory**:

```
/tmp/assay-<UID>-<PID>/
```

- Kernel UID (not spoofable `$USER`)
- Per-run isolation (PID-scoped)
- 0700 permissions (owner-only)
- `TMPDIR`, `TMP`, and `TEMP` all point here

### 🔍 Doctor Deep Dive v2 (PR #48)

`assay doctor` now reports all Phase 5 security features:

```
Sandbox Hardening:
  Env Scrubbing:        ✓ (67 patterns)
  Exec-Influence Scrub: ✓ (LD_PRELOAD, PYTHONPATH, ...)
  Scoped /tmp:          ✓ (UID+PID, 0700)
  Fork-safe pre_exec:   ✓
  Deny Conflict Det:    ✓
  Landlock:             ✓ ABI v4 (FS + Net)
```

---

## New Commands

### `assay sandbox`

Run commands in a hardened sandbox:

```bash
# Basic usage
assay sandbox -- ./mcp-server

# Maximum security
assay sandbox --env-strict --fail-closed -- ./untrusted-server

# Allow specific credentials
assay sandbox --env-allow OPENAI_API_KEY -- ./my-agent
```

See [assay sandbox reference](../reference/cli/sandbox.md) for full documentation.

---

## Breaking Changes

None. All changes are additive and backward-compatible.

---

## Upgrade Guide

```bash
# Update to v2.4
cargo install assay-cli --force

# Verify new features
assay doctor
```

---

## Security Advisory

If you're running untrusted MCP servers, we **strongly recommend**:

1. **Enable strict env mode** for untrusted code:
   ```bash
   assay sandbox --env-strict -- ./server
   ```

2. **Use fail-closed in CI/CD**:
   ```bash
   assay sandbox --fail-closed -- ./server
   ```

3. **Review your policies** for deny-inside-allow conflicts

---

## Documentation

- [Sandbox Concepts](../concepts/sandbox.md)
- [Sandbox Security Guide](../guides/sandbox-security.md)
- [CLI Reference: assay sandbox](../reference/cli/sandbox.md)
- [Environment Filtering Reference](../reference/sandbox-env.md)
- [Sandbox Policies Reference](../reference/sandbox-policies.md)

---

## Contributors

Thanks to everyone who contributed to this release!

---

## What's Next (v2.5)

- `--env-strict` default mode (opt-out instead of opt-in)
- Degradation telemetry and metrics
- BPF-LSM backend for full deny-wins semantics
- Network egress filtering (Landlock ABI v4+)
