StyloBot Extensions 8.15.0

Cross-platform self-contained binaries for the three deployment
shapes that aren't NuGet packages. Each has its own README,
its own archive, and its own SHA256SUMS.

Companion to the main allbot-v8.15.0
NuGet release.

stylobot-sidecar — detection-only sidecar

Detector pipeline + gRPC server + REST /detect + auth. No
dashboard, no Razor, no YARP. Co-locate next to your app.

• stylobot-sidecar-linux-x64.tar.gz
• stylobot-sidecar-linux-arm64.tar.gz
• stylobot-sidecar-osx-x64.tar.gz
• stylobot-sidecar-osx-arm64.tar.gz
• stylobot-sidecar-win-x64.zip
• stylobot-sidecar-win-arm64.zip
• stylobot-sidecar-SHA256SUMS.txt

Docker: scottgal/stylobot-sidecar:8.15.0

stylobot-ui — remote dashboard viewer

Hosted dashboard. Pure REST + SignalR client against a stylobot
gateway started with --enable-api. Reads nothing locally.

• stylobot-ui-linux-x64.tar.gz
• stylobot-ui-linux-arm64.tar.gz
• stylobot-ui-osx-x64.tar.gz
• stylobot-ui-osx-arm64.tar.gz
• stylobot-ui-win-x64.zip
• stylobot-ui-win-arm64.zip
• stylobot-ui-SHA256SUMS.txt

Docker: scottgal/stylobot-ui:8.15.0

stylobot-all — YARP gateway + detection + dashboard in one process

Single-binary deployment: reverse proxy in front of your app,
with the detection pipeline and the dashboard included.

• stylobot-all-linux-x64.tar.gz
• stylobot-all-linux-arm64.tar.gz
• stylobot-all-osx-x64.tar.gz
• stylobot-all-osx-arm64.tar.gz
• stylobot-all-win-x64.zip
• stylobot-all-win-arm64.zip
• stylobot-all-SHA256SUMS.txt

Docker: scottgal/stylobot-all:8.15.0

StyloBot v8.14.2 includes the 8.14.1 reliability fixes and corrects native AOT runtime/packaging faults found by testing the downloaded sidecar.

Native runtime and release fixes

• Fix native sidecar distribution: include SQLite/libsodium native libraries alongside the executable and explicitly initialize the SQLite bundle before host configuration. Archive startup verification caught the missing libraries after the 8.14.1 build-only gate passed.
• Restore detection in Native AOT: preserve public constructors when registering detector atoms so trimmed hosts can resolve them. Statically register all ten previously omitted YAML models, including fetch-source defaults, registry clients, webhooks, browser-mode seeds, and site thresholds, plus their collection formatters. A discovery-based regression test requires an explicit formatter registration for every YAML model.
• Test shipped sidecar archives on every release platform: unpack the actual archive, boot with fresh SQLite storage, check health, reject unauthenticated REST/gRPC calls, run authenticated summary reads and REST/gRPC detection, stop the process, and fail on default Error/Fatal logs. Native library omissions and trimmed formatters now block the extension release.
• Release/test reliability: wait for durable novelty independently of delta counts in the learning-cycle test, forcing separate sampler passes. Use the supported wingetcreate info command so tool-version logging does not abort installer publication.

Reliability fixes included from 8.14.1

• ASP.NET Core NuGet consumers now run in the package regression gate. Build and pack a fresh, uniquely versioned feed, then restore, publish, and start real core-only, API-only, and dashboard apps. Exercise HTTP detection, API authentication and queries, synthetic single/batch detection, configured classification thresholds, dashboard HTML/static assets, graceful shutdown, and actionable invalid-startup diagnostics. Explicit package builds prevent stale assemblies in projects with GeneratePackageOnBuild; unique test versions prevent global-cache reuse.

• Fix API-only hosts: register the durable read stores/caches needed by authenticated dashboard-data endpoints. Single and batch detection use fresh request scopes and the supplied request context, preserving the host's ambient context and preventing caller/batch signal contamination. API verdicts honor Classification.BotFloor.

• Fix shutdown session loss: wait for asynchronous memory-cache eviction callbacks before completing the session-persistence channel, and drain while callbacks finalize sessions. Respect the host's shutdown deadline instead of hiding late callbacks behind misleading channel-full warnings.

• Failure visibility: durable-read outages log a warning once per failure streak, without request keys, followed by a recovery message. Unexpected persistence-worker failures log an error and restart. Subscriber cancellations unrelated to coordinator shutdown count as visible faults.

• Packaging: exclude Finder metadata from Razor static-asset manifests so packages built on macOS publish correctly. Update the MessagePack pin to patched 3.1.9, restoring CI's warnings-as-errors dependency gate.

• Fix (#130): restore waveform-history and pool-collision schema initialization. Both stores and their atom consumers survived the contributor-to-atom migration, but their hosted startup initializers did not. Restore the missing registrations and add discovery-based coverage for every registered IStoreInitializer.

• Fix (#127): watchdog shutdowns report failure to process supervisors. Silent cadences and subscriber fault storms set exit status 1 before requesting graceful shutdown. Console and sidecar entry points preserve that status. A CI lifecycle harness checks real child-process exits, normal shutdown, and fresh SQLite schemas.

• Scheduler reliability: disabled cadences are excluded from watchdog checks, and a shutdown already in progress is not converted into a failure. Subscriber callbacks are dispatched to worker threads after acquiring their single-flight guard, so synchronous blocking cannot stall the cadence loop or sibling heartbeats. Requested store-startup cancellation propagates instead of being logged as a storage failure. Regression tests cover bounded and unbounded dispatch, every disabled cadence, and each removed store initializer.

All six packaged sidecar platforms passed authenticated REST/gRPC detection and startup checks before publication. See the main release for upgrade and validation details.

StyloBot Extensions 8.14.2

Cross-platform self-contained binaries for the three deployment
shapes that aren't NuGet packages. Each has its own README,
its own archive, and its own SHA256SUMS.

Companion to the main allbot-v8.14.2
NuGet release.

stylobot-sidecar — detection-only sidecar

Detector pipeline + gRPC server + REST /detect + auth. No
dashboard, no Razor, no YARP. Co-locate next to your app.

• stylobot-sidecar-linux-x64.tar.gz
• stylobot-sidecar-linux-arm64.tar.gz
• stylobot-sidecar-osx-x64.tar.gz
• stylobot-sidecar-osx-arm64.tar.gz
• stylobot-sidecar-win-x64.zip
• stylobot-sidecar-win-arm64.zip
• stylobot-sidecar-SHA256SUMS.txt

Docker: scottgal/stylobot-sidecar:8.14.2

stylobot-ui — remote dashboard viewer

Hosted dashboard. Pure REST + SignalR client against a stylobot
gateway started with --enable-api. Reads nothing locally.

• stylobot-ui-linux-x64.tar.gz
• stylobot-ui-linux-arm64.tar.gz
• stylobot-ui-osx-x64.tar.gz
• stylobot-ui-osx-arm64.tar.gz
• stylobot-ui-win-x64.zip
• stylobot-ui-win-arm64.zip
• stylobot-ui-SHA256SUMS.txt

Docker: scottgal/stylobot-ui:8.14.2

stylobot-all — YARP gateway + detection + dashboard in one process

Single-binary deployment: reverse proxy in front of your app,
with the detection pipeline and the dashboard included.

• stylobot-all-linux-x64.tar.gz
• stylobot-all-linux-arm64.tar.gz
• stylobot-all-osx-x64.tar.gz
• stylobot-all-osx-arm64.tar.gz
• stylobot-all-win-x64.zip
• stylobot-all-win-arm64.zip
• stylobot-all-SHA256SUMS.txt

Docker: scottgal/stylobot-all:8.14.2

Stylobot v8.15.0

Single-binary YARP reverse proxy with the full Stylobot bot detection pipeline built in.
Native AOT-compiled: no runtime required, instant startup, minimal memory footprint.

Downloads

Quick start

# Linux/macOS
chmod +x stylobot
stylobot 5080 https://www.example.com                    # demo mode: verbose logging, no blocking
stylobot 5080 https://www.example.com --mode production  # production: blocking enabled
stylobot 5080 https://www.example.com --tunnel           # open a Cloudflare public URL

# Windows
stylobot.exe 5080 https://www.example.com --mode production

Flags

stylobot <port> <upstream>                     # demo mode (default)
stylobot <port> <upstream> --mode production   # production (blocking)
stylobot <port> <upstream> --tunnel            # Cloudflare public URL
stylobot <port> <upstream> --policy block      # block policy
stylobot <port> <upstream> --policy throttle   # stealth throttle
stylobot man                                   # full reference

Features

• Native AOT: zero dependencies, ~10MB binary, instant startup
• Cross-platform: Linux (x64, ARM64), Windows (x64, ARM64), macOS (x64, ARM64)
• Full Stylobot detection pipeline: 49 detectors, 4 waves, behavioral analysis, intent scoring
• YARP reverse proxy: forward to any upstream backend
• Client-side fingerprinting via JavaScript callback
• Gateway headers: X-StyloBot-IsBot, X-StyloBot-Probability, X-StyloBot-RiskBand, etc.
• Privacy-safe: HMAC-SHA256 signatures, zero PII stored

Windows code signing

Windows binaries are Authenticode-signed via Azure Trusted Signing.

Verify in PowerShell:

Get-AuthenticodeSignature .\stylobot.exe | Select-Object Status, SignerCertificate

The certificate chain roots to Microsoft's Azure Trusted Signing CA. Status should be Valid.

SHA256 checksums

See SHA256SUMS.txt attached below.

StyloBot v8.14.2 includes the 8.14.1 reliability fixes and corrects native AOT runtime/packaging faults found by testing the downloaded sidecar.

Native runtime and release fixes

• Fix native sidecar distribution: include SQLite/libsodium native libraries alongside the executable and explicitly initialize the SQLite bundle before host configuration. Archive startup verification caught the missing libraries after the 8.14.1 build-only gate passed.
• Restore detection in Native AOT: preserve public constructors when registering detector atoms so trimmed hosts can resolve them. Statically register all ten previously omitted YAML models, including fetch-source defaults, registry clients, webhooks, browser-mode seeds, and site thresholds, plus their collection formatters. A discovery-based regression test requires an explicit formatter registration for every YAML model.
• Test shipped sidecar archives on every release platform: unpack the actual archive, boot with fresh SQLite storage, check health, reject unauthenticated REST/gRPC calls, run authenticated summary reads and REST/gRPC detection, stop the process, and fail on default Error/Fatal logs. Native library omissions and trimmed formatters now block the extension release.
• Release/test reliability: wait for durable novelty independently of delta counts in the learning-cycle test, forcing separate sampler passes. Use the supported wingetcreate info command so tool-version logging does not abort installer publication.

Reliability fixes included from 8.14.1

• ASP.NET Core NuGet consumers now run in the package regression gate. Build and pack a fresh, uniquely versioned feed, then restore, publish, and start real core-only, API-only, and dashboard apps. Exercise HTTP detection, API authentication and queries, synthetic single/batch detection, configured classification thresholds, dashboard HTML/static assets, graceful shutdown, and actionable invalid-startup diagnostics. Explicit package builds prevent stale assemblies in projects with GeneratePackageOnBuild; unique test versions prevent global-cache reuse.

• Fix API-only hosts: register the durable read stores/caches needed by authenticated dashboard-data endpoints. Single and batch detection use fresh request scopes and the supplied request context, preserving the host's ambient context and preventing caller/batch signal contamination. API verdicts honor Classification.BotFloor.

• Fix shutdown session loss: wait for asynchronous memory-cache eviction callbacks before completing the session-persistence channel, and drain while callbacks finalize sessions. Respect the host's shutdown deadline instead of hiding late callbacks behind misleading channel-full warnings.

• Failure visibility: durable-read outages log a warning once per failure streak, without request keys, followed by a recovery message. Unexpected persistence-worker failures log an error and restart. Subscriber cancellations unrelated to coordinator shutdown count as visible faults.

• Packaging: exclude Finder metadata from Razor static-asset manifests so packages built on macOS publish correctly. Update the MessagePack pin to patched 3.1.9, restoring CI's warnings-as-errors dependency gate.

• Fix (#130): restore waveform-history and pool-collision schema initialization. Both stores and their atom consumers survived the contributor-to-atom migration, but their hosted startup initializers did not. Restore the missing registrations and add discovery-based coverage for every registered IStoreInitializer.

• Fix (#127): watchdog shutdowns report failure to process supervisors. Silent cadences and subscriber fault storms set exit status 1 before requesting graceful shutdown. Console and sidecar entry points preserve that status. A CI lifecycle harness checks real child-process exits, normal shutdown, and fresh SQLite schemas.

• Scheduler reliability: disabled cadences are excluded from watchdog checks, and a shutdown already in progress is not converted into a failure. Subscriber callbacks are dispatched to worker threads after acquiring their single-flight guard, so synchronous blocking cannot stall the cadence loop or sibling heartbeats. Requested store-startup cancellation propagates instead of being logged as a storage failure. Regression tests cover bounded and unbounded dispatch, every disabled cadence, and each removed store initializer.

Upgrade

Update your StyloBot packages or binaries to 8.14.2 and restart the application. Missing waveform-history and pool-collision schemas are created automatically at startup; no manual table creation is needed.

dotnet add package mostlylucid.botdetection --version 8.14.2
# For the dashboard integration:
dotnet add package Mostlylucid.BotDetection.UI --version 8.14.2

Validation

• Native macOS ARM64 sidecar archive passed fresh-database startup, authenticated REST/gRPC detection, API reads, authentication rejection, clean shutdown, and default Error/Fatal-log checks. The same harness rejected the broken 8.14.1 archive. Every release sidecar platform must pass this gate.
• Clean Linux CI: 5,237 main tests passed (6 skipped), 404 orchestration tests passed, and 88 gateway tests passed; lifecycle harness and full build passed. CodeQL passed.
• ASP.NET Core package consumers were repacked and tested again for this patch; nine package/AOT/context regression cases passed locally. The earlier reliability pass covered 117 focused tests.
• 105 lifecycle regression tests and six process-level scenarios.
• Published consumer checks cover authentication, API reads and single/batch detection, configured bot floors, dashboard HTML/static assets, useful invalid-startup errors, and clean shutdown.

Downloads

The native gateway archives and SHA256 checksums are attached to this release. Sidecar, dashboard-host, and all-in-one binaries are on the extensions v8.14.2 release.

Full comparison

StyloBot v8.14.1 fixes store startup, supervisor restart behavior, session shutdown, and ASP.NET Core/NuGet integration.

Changes

• ASP.NET Core NuGet consumers now run in the package regression gate. Build and pack a fresh, uniquely versioned feed, then restore, publish, and start real core-only, API-only, and dashboard apps. Exercise HTTP detection, API authentication and queries, synthetic single/batch detection, configured classification thresholds, dashboard HTML/static assets, graceful shutdown, and actionable invalid-startup diagnostics. Explicit package builds prevent stale assemblies in projects with GeneratePackageOnBuild; unique test versions prevent global-cache reuse.

• Fix API-only hosts: register the durable read stores/caches needed by authenticated dashboard-data endpoints. Single and batch detection use fresh request scopes and the supplied request context, preserving the host's ambient context and preventing caller/batch signal contamination. API verdicts honor Classification.BotFloor.

• Fix shutdown session loss: wait for asynchronous memory-cache eviction callbacks before completing the session-persistence channel, and drain while callbacks finalize sessions. Respect the host's shutdown deadline instead of hiding late callbacks behind misleading channel-full warnings.

• Failure visibility: durable-read outages log a warning once per failure streak, without request keys, followed by a recovery message. Unexpected persistence-worker failures log an error and restart. Subscriber cancellations unrelated to coordinator shutdown count as visible faults.

• Packaging: exclude Finder metadata from Razor static-asset manifests so packages built on macOS publish correctly. Update the MessagePack pin to patched 3.1.9, restoring CI's warnings-as-errors dependency gate.

• Fix (#130): restore waveform-history and pool-collision schema initialization. Both stores and their atom consumers survived the contributor-to-atom migration, but their hosted startup initializers did not. Restore the missing registrations and add discovery-based coverage for every registered IStoreInitializer.

• Fix (#127): watchdog shutdowns report failure to process supervisors. Silent cadences and subscriber fault storms set exit status 1 before requesting graceful shutdown. Console and sidecar entry points preserve that status. A CI lifecycle harness checks real child-process exits, normal shutdown, and fresh SQLite schemas.

• Scheduler reliability: disabled cadences are excluded from watchdog checks, and a shutdown already in progress is not converted into a failure. Subscriber callbacks are dispatched to worker threads after acquiring their single-flight guard, so synchronous blocking cannot stall the cadence loop or sibling heartbeats. Requested store-startup cancellation propagates instead of being logged as a storage failure. Regression tests cover bounded and unbounded dispatch, every disabled cadence, and each removed store initializer.

Upgrade

Update your StyloBot packages or binaries to 8.14.1 and restart the application. Missing waveform-history and pool-collision schemas are created automatically at startup; no manual table creation is needed.

dotnet add package mostlylucid.botdetection --version 8.14.1
# For the dashboard integration:
dotnet add package Mostlylucid.BotDetection.UI --version 8.14.1

Validation

• Clean Linux CI: 5,236 main tests passed (6 skipped), 404 orchestration tests passed, and 88 gateway tests passed; lifecycle harness and full build passed. CodeQL passed.
• 117 focused Release tests, including freshly packed and published core, API, and dashboard consumer apps.
• 105 lifecycle regression tests and six process-level scenarios.
• Published consumer checks cover authentication, API reads and single/batch detection, configured bot floors, dashboard HTML/static assets, useful invalid-startup errors, and clean shutdown.

Downloads

The native gateway archives and SHA256 checksums are attached to this release. Sidecar, dashboard-host, and all-in-one binaries are on the extensions v8.14.1 release.

Full comparison

Superseded sidecar build: post-download verification found omitted native libraries and missing AOT YAML registrations. Use the NuGet packages or gateway from the main release while the corrected extension patch is prepared.

StyloBot v8.14.1 fixes store startup, supervisor restart behavior, session shutdown, and ASP.NET Core/NuGet integration.

Changes

• ASP.NET Core NuGet consumers now run in the package regression gate. Build and pack a fresh, uniquely versioned feed, then restore, publish, and start real core-only, API-only, and dashboard apps. Exercise HTTP detection, API authentication and queries, synthetic single/batch detection, configured classification thresholds, dashboard HTML/static assets, graceful shutdown, and actionable invalid-startup diagnostics. Explicit package builds prevent stale assemblies in projects with GeneratePackageOnBuild; unique test versions prevent global-cache reuse.

• Fix API-only hosts: register the durable read stores/caches needed by authenticated dashboard-data endpoints. Single and batch detection use fresh request scopes and the supplied request context, preserving the host's ambient context and preventing caller/batch signal contamination. API verdicts honor Classification.BotFloor.

• Fix shutdown session loss: wait for asynchronous memory-cache eviction callbacks before completing the session-persistence channel, and drain while callbacks finalize sessions. Respect the host's shutdown deadline instead of hiding late callbacks behind misleading channel-full warnings.

• Failure visibility: durable-read outages log a warning once per failure streak, without request keys, followed by a recovery message. Unexpected persistence-worker failures log an error and restart. Subscriber cancellations unrelated to coordinator shutdown count as visible faults.

• Packaging: exclude Finder metadata from Razor static-asset manifests so packages built on macOS publish correctly. Update the MessagePack pin to patched 3.1.9, restoring CI's warnings-as-errors dependency gate.

• Fix (#130): restore waveform-history and pool-collision schema initialization. Both stores and their atom consumers survived the contributor-to-atom migration, but their hosted startup initializers did not. Restore the missing registrations and add discovery-based coverage for every registered IStoreInitializer.

• Fix (#127): watchdog shutdowns report failure to process supervisors. Silent cadences and subscriber fault storms set exit status 1 before requesting graceful shutdown. Console and sidecar entry points preserve that status. A CI lifecycle harness checks real child-process exits, normal shutdown, and fresh SQLite schemas.

• Scheduler reliability: disabled cadences are excluded from watchdog checks, and a shutdown already in progress is not converted into a failure. Subscriber callbacks are dispatched to worker threads after acquiring their single-flight guard, so synchronous blocking cannot stall the cadence loop or sibling heartbeats. Requested store-startup cancellation propagates instead of being logged as a storage failure. Regression tests cover bounded and unbounded dispatch, every disabled cadence, and each removed store initializer.

See the main v8.14.1 release for validation and upgrade details.

StyloBot Extensions 8.14.1

Cross-platform self-contained binaries for the three deployment
shapes that aren't NuGet packages. Each has its own README,
its own archive, and its own SHA256SUMS.

Companion to the main allbot-v8.14.1
NuGet release.

stylobot-sidecar — detection-only sidecar

Detector pipeline + gRPC server + REST /detect + auth. No
dashboard, no Razor, no YARP. Co-locate next to your app.

• stylobot-sidecar-linux-x64.tar.gz
• stylobot-sidecar-linux-arm64.tar.gz
• stylobot-sidecar-osx-x64.tar.gz
• stylobot-sidecar-osx-arm64.tar.gz
• stylobot-sidecar-win-x64.zip
• stylobot-sidecar-win-arm64.zip
• stylobot-sidecar-SHA256SUMS.txt

Docker: scottgal/stylobot-sidecar:8.14.1

stylobot-ui — remote dashboard viewer

Hosted dashboard. Pure REST + SignalR client against a stylobot
gateway started with --enable-api. Reads nothing locally.

• stylobot-ui-linux-x64.tar.gz
• stylobot-ui-linux-arm64.tar.gz
• stylobot-ui-osx-x64.tar.gz
• stylobot-ui-osx-arm64.tar.gz
• stylobot-ui-win-x64.zip
• stylobot-ui-win-arm64.zip
• stylobot-ui-SHA256SUMS.txt

Docker: scottgal/stylobot-ui:8.14.1

stylobot-all — YARP gateway + detection + dashboard in one process

Single-binary deployment: reverse proxy in front of your app,
with the detection pipeline and the dashboard included.

• stylobot-all-linux-x64.tar.gz
• stylobot-all-linux-arm64.tar.gz
• stylobot-all-osx-x64.tar.gz
• stylobot-all-osx-arm64.tar.gz
• stylobot-all-win-x64.zip
• stylobot-all-win-arm64.zip
• stylobot-all-SHA256SUMS.txt

Docker: scottgal/stylobot-all:8.14.1

Stylobot v8.14.0

Single-binary YARP reverse proxy with the full Stylobot bot detection pipeline built in.
Native AOT-compiled: no runtime required, instant startup, minimal memory footprint.

Downloads

Quick start

# Linux/macOS
chmod +x stylobot
stylobot 5080 https://www.example.com                    # demo mode: verbose logging, no blocking
stylobot 5080 https://www.example.com --mode production  # production: blocking enabled
stylobot 5080 https://www.example.com --tunnel           # open a Cloudflare public URL

# Windows
stylobot.exe 5080 https://www.example.com --mode production

Flags

stylobot <port> <upstream>                     # demo mode (default)
stylobot <port> <upstream> --mode production   # production (blocking)
stylobot <port> <upstream> --tunnel            # Cloudflare public URL
stylobot <port> <upstream> --policy block      # block policy
stylobot <port> <upstream> --policy throttle   # stealth throttle
stylobot man                                   # full reference

Features

• Native AOT: zero dependencies, ~10MB binary, instant startup
• Cross-platform: Linux (x64, ARM64), Windows (x64, ARM64), macOS (x64, ARM64)
• Full Stylobot detection pipeline: 49 detectors, 4 waves, behavioral analysis, intent scoring
• YARP reverse proxy: forward to any upstream backend
• Client-side fingerprinting via JavaScript callback
• Gateway headers: X-StyloBot-IsBot, X-StyloBot-Probability, X-StyloBot-RiskBand, etc.
• Privacy-safe: HMAC-SHA256 signatures, zero PII stored

Windows code signing

Windows binaries are Authenticode-signed via Azure Trusted Signing.

Verify in PowerShell:

Get-AuthenticodeSignature .\stylobot.exe | Select-Object Status, SignerCertificate

The certificate chain roots to Microsoft's Azure Trusted Signing CA. Status should be Valid.

SHA256 checksums

See SHA256SUMS.txt attached below.

Stylobot v8.12.1

Single-binary YARP reverse proxy with the full Stylobot bot detection pipeline built in.
Native AOT-compiled: no runtime required, instant startup, minimal memory footprint.

Downloads

Quick start

# Linux/macOS
chmod +x stylobot
stylobot 5080 https://www.example.com                    # demo mode: verbose logging, no blocking
stylobot 5080 https://www.example.com --mode production  # production: blocking enabled
stylobot 5080 https://www.example.com --tunnel           # open a Cloudflare public URL

# Windows
stylobot.exe 5080 https://www.example.com --mode production

Flags

stylobot <port> <upstream>                     # demo mode (default)
stylobot <port> <upstream> --mode production   # production (blocking)
stylobot <port> <upstream> --tunnel            # Cloudflare public URL
stylobot <port> <upstream> --policy block      # block policy
stylobot <port> <upstream> --policy throttle   # stealth throttle
stylobot man                                   # full reference

Features

• Native AOT: zero dependencies, ~10MB binary, instant startup
• Cross-platform: Linux (x64, ARM64), Windows (x64, ARM64), macOS (x64, ARM64)
• Full Stylobot detection pipeline: 49 detectors, 4 waves, behavioral analysis, intent scoring
• YARP reverse proxy: forward to any upstream backend
• Client-side fingerprinting via JavaScript callback
• Gateway headers: X-StyloBot-IsBot, X-StyloBot-Probability, X-StyloBot-RiskBand, etc.
• Privacy-safe: HMAC-SHA256 signatures, zero PII stored

Windows code signing

Windows binaries are Authenticode-signed via Azure Trusted Signing.

Verify in PowerShell:

Get-AuthenticodeSignature .\stylobot.exe | Select-Object Status, SignerCertificate

The certificate chain roots to Microsoft's Azure Trusted Signing CA. Status should be Valid.

SHA256 checksums

See SHA256SUMS.txt attached below.

Stylobot v8.12.0

Single-binary YARP reverse proxy with the full Stylobot bot detection pipeline built in.
Native AOT-compiled: no runtime required, instant startup, minimal memory footprint.

Downloads

Quick start

# Linux/macOS
chmod +x stylobot
stylobot 5080 https://www.example.com                    # demo mode: verbose logging, no blocking
stylobot 5080 https://www.example.com --mode production  # production: blocking enabled
stylobot 5080 https://www.example.com --tunnel           # open a Cloudflare public URL

# Windows
stylobot.exe 5080 https://www.example.com --mode production

Flags

stylobot <port> <upstream>                     # demo mode (default)
stylobot <port> <upstream> --mode production   # production (blocking)
stylobot <port> <upstream> --tunnel            # Cloudflare public URL
stylobot <port> <upstream> --policy block      # block policy
stylobot <port> <upstream> --policy throttle   # stealth throttle
stylobot man                                   # full reference

Features

• Native AOT: zero dependencies, ~10MB binary, instant startup
• Cross-platform: Linux (x64, ARM64), Windows (x64, ARM64), macOS (x64, ARM64)
• Full Stylobot detection pipeline: 49 detectors, 4 waves, behavioral analysis, intent scoring
• YARP reverse proxy: forward to any upstream backend
• Client-side fingerprinting via JavaScript callback
• Gateway headers: X-StyloBot-IsBot, X-StyloBot-Probability, X-StyloBot-RiskBand, etc.
• Privacy-safe: HMAC-SHA256 signatures, zero PII stored

Windows code signing

Windows binaries are Authenticode-signed via Azure Trusted Signing.

Verify in PowerShell:

Get-AuthenticodeSignature .\stylobot.exe | Select-Object Status, SignerCertificate

The certificate chain roots to Microsoft's Azure Trusted Signing CA. Status should be Valid.

SHA256 checksums

See SHA256SUMS.txt attached below.

Stylobot v8.11.3

Single-binary YARP reverse proxy with the full Stylobot bot detection pipeline built in.
Native AOT-compiled: no runtime required, instant startup, minimal memory footprint.

Downloads

Quick start

# Linux/macOS
chmod +x stylobot
stylobot 5080 https://www.example.com                    # demo mode: verbose logging, no blocking
stylobot 5080 https://www.example.com --mode production  # production: blocking enabled
stylobot 5080 https://www.example.com --tunnel           # open a Cloudflare public URL

# Windows
stylobot.exe 5080 https://www.example.com --mode production

Flags

stylobot <port> <upstream>                     # demo mode (default)
stylobot <port> <upstream> --mode production   # production (blocking)
stylobot <port> <upstream> --tunnel            # Cloudflare public URL
stylobot <port> <upstream> --policy block      # block policy
stylobot <port> <upstream> --policy throttle   # stealth throttle
stylobot man                                   # full reference

Features

• Native AOT: zero dependencies, ~10MB binary, instant startup
• Cross-platform: Linux (x64, ARM64), Windows (x64, ARM64), macOS (x64, ARM64)
• Full Stylobot detection pipeline: 49 detectors, 4 waves, behavioral analysis, intent scoring
• YARP reverse proxy: forward to any upstream backend
• Client-side fingerprinting via JavaScript callback
• Gateway headers: X-StyloBot-IsBot, X-StyloBot-Probability, X-StyloBot-RiskBand, etc.
• Privacy-safe: HMAC-SHA256 signatures, zero PII stored

Windows code signing

Windows binaries are Authenticode-signed via Azure Trusted Signing.

Verify in PowerShell:

Get-AuthenticodeSignature .\stylobot.exe | Select-Object Status, SignerCertificate

The certificate chain roots to Microsoft's Azure Trusted Signing CA. Status should be Valid.

SHA256 checksums

See SHA256SUMS.txt attached below.