AI 代理安全
Sentience Governor 0.3.1.1 Traces Claude Code History and Lists Actual Cross-Project Write Paths
The new `sentience scan --detail` directly analyzes local Claude Code history and lists cross-project write paths by session, without requiring runtime hooks to be installed in advance. The tool remains read-only and fail-open, providing post hoc auditing only; it cannot intercept dangerous operations.
Sentience Governor’s mainline documentation has announced version 0.3.1.1, adding a traceable evidence layer to the recently introduced `sentience scan`. Previously, the summary could only indicate that a Claude Code session had written files outside the current project and report how many times this occurred. With `--detail`, it now lists the actual paths for each session, allowing engineers to determine whether the activity involved a legitimate shared directory, a cache operation, or an agent crossing task boundaries. Detailed mode does not expand the scan’s time window, so the summary and detailed report should be based on the same set of historical data.
The mechanism reads existing local Claude Code records and does not require users to declare intent in advance or install capture hooks, making it suitable for auditing past agent behavior. The same scan results can also be returned to a Claude Code conversation through the optional MCP server. For runtime integration, tool calls can be captured through Claude Code hooks, an MCP client wrapper, a LangChain callback, or experimental LangGraph middleware, after which the events are compared against the agent’s declared intent and scope, as well as five default policies.
The security boundary still needs to be made clear: Sentience Governor is observe-only and fail-open by default. It records and reports violations but does not prevent file writes or modify tool parameters; an agent’s declared intent is itself treated as untrusted input. Its token attribution is precise only to the turn containing the relevant tool activity and must not be interpreted as the number of tokens actually consumed by a single tool. Another deployment risk is version visibility: the GitHub main branch already documents version 0.3.1.1, while the public PyPI index page still shows the older 0.3.0.2. Before deployment, users should verify the installed version, package hash, and MCP extra. Areas to watch next include cross-platform path normalization, compatibility with different Claude Code record formats, and progression from post hoc evidence to optional fail-closed execution controls.