Release

This release makes cc-safety-net update faster and gives it clearer progress feedback.

Changed

• Improved cc-safety-net update speed: all detected integrations now update concurrently, and integration detection starts while the install banner plays. (#75)
• Improved update progress feedback: the command shows a spinner while it checks and updates integrations, then prints one result line per integration. (#75)
• Improved Codex updates: the update reuses the codex plugin list output from detection instead of querying the Codex marketplace a second time. (#75)
• Changed the stale npx cache cleanup during updates: the cache is cleared once before the targets run, and a cleanup failure now fails only the targets that depend on that cache while the other integrations still update. (#75)

Fixes a silent failure where custom rules never enforced in plugin installs that copy a repository checkout instead of running a package manager.

Fixed

• Fixed custom rules never loading in repository-checkout plugin installs, such as the Claude Code marketplace, Codex, Copilot CLI, and Kimi Code. These installs have no node_modules, so the schema loader's lazy require('zod') failed and every custom rule stayed inactive while built-in protections kept working. The CLI bundle now resolves its schema dependency from a vendored dist/vendor/zod.cjs copy that ships with the package. (#72, #74)
• Fixed rulebook and policy configuration errors being reported as Invalid JSON on files that are valid JSON. These loaders now report Invalid JSON only for a real parse failure, and show the underlying filesystem or dependency message otherwise. (#72)

Highlights

- Amp personal-scope install. install --amp now publishes the plugin to your Amp Personal Plugins repository, so the safety net follows your account to every machine — including remote Orb threads — instead of living in one local config. - Native Kimi Code plugin. The release now ships kimi.plugin.json, so you can install via /plugins install and let Kimi Code manage enable, disable, update, and removal. The installer offers a choice between the global hook and the native plugin when you select Kimi Code.

Features

- install --amp embeds a snapshot of your user policy in the published plugin. A remote Orb with an empty home directory now enforces your policy instead of only the built-in defaults. - Flagged installs (e.g. install --codex) show a loading spinner while the host CLI runs, so slow network installs no longer look hung.

Fixes

- Windows: npm-installed CLIs ship as .cmd shims, which Node's spawn cannot start directly. All native install probes and commands now route through COMSPEC, so install --codex and the interactive picker work on Windows (#69). - Amp: if an unmanaged file or symlink at ~/.config/amp/plugins/cc-safety-net.ts would mask the newly published personal plugin, the install now fails with an actionable error instead of reporting success while the hook may never run. - Amp: the machine-generated commit in the throwaway checkout now carries an explicit git identity, so the install works on machines with no global user.name/user.email configured. - A stalled host CLI is now killed after 120 seconds and reported as a failure, so an install can no longer hang forever. - The Amp install now stops immediately when its staged-status probe fails instead of attempting the commit anyway.

Internal

- The release pipeline validates kimi.plugin.json alongside the other manifests, preserves manifest formatting when bumping versions, and lints the prepared files before tagging — the failure class that blocked v2.0.2 can no longer reach a tag.

Fixes

• `update` migrates pre-rename plugins — updating from the old safety-net plugin name now works across hosts:
• Detects the pre-rename Copilot CLI plugin and removes it after migrating.
• Refreshes an already-registered marketplace before installing on Claude Code, Codex, and Copilot CLI, so updates no longer fail against a stale catalog.
• Legacy-plugin cleanup is best-effort: a failure warns instead of failing the target, since the host CLI may have already dropped the record.
• codex plugin list now runs with a 30 s timeout, so a cold run no longer silently drops Codex from detection.
• One failed target no longer stops the remaining update targets; the command still exits non-zero at the end.

Release pipeline

• The prepare-release workflow now takes a patch / minor / major bump choice and computes the next version automatically; an explicit version input remains as an override.
• The publisher looks up GitHub releases with a draft-aware query, fixing a failure on the first publish of a tag.

Upgrade

bash npx -y cc-safety-net@latest update

Full changelog: https://github.com/kenryu42/cc-safety-net/compare/v2.0.0...v2.0.1

V2 is a ground-up rebuild: one installer for twelve coding CLIs, secret protection, a policy GUI, and a rebuilt evaluation engine with decision tracing.

Upgrading from v1? One command upgrades every installed integration: npx -y cc-safety-net@latest update. If you defined custom rules under v1, see Upgrading from an older version.

Renamed: `safety-net` → `cc-safety-net`

The plugin, npm package, and CLI are now uniformly named cc-safety-net. Claude Code marketplace installs migrate automatically; no action is needed.

Highlights

• Universal installer — interactive install / uninstall / update across all twelve supported agent CLIs (Claude Code, Codex, Cursor, Gemini CLI, Copilot CLI, OpenCode, Amp, Pi, and more).
• Secret protection — built-in rules block access to SSH keys, .env files, cloud credentials, and coding-CLI credential stores, across shell commands and file tools.
• Rebuilt evaluation engine — canonical command IR, immutable policy snapshots, and an ordered guard pipeline with decision tracing via explain.
• Always-on catastrophic protections — recursive deletion of root or home, Git metadata mutation, and policy-file tampering are blocked in every mode.
• Safety presets — standard / strict / paranoid with per-rule overrides, trusted delete allow-paths, and env vars that can only raise protection.
• Policy GUI — cc-safety-net gui serves a local, token-authenticated policy editor with live preset preview.
• Audit trail — allowed and blocked decisions logged to local per-project JSONL with secret redaction; browse with cc-safety-net logs.
• Documented threat model — the SECURITY.md mode contract, explicit resource limits, and a residual-risk registry.

Get started

bash npx -y cc-safety-net@latest install

Full documentation: https://ccsafetynet.com/docs

Full changelog: https://github.com/kenryu42/cc-safety-net/compare/v1.0.6...v2.0.0

Changes

• fix: avoid duplicate home rule scope (#62) — When the user config path and the project config path resolve to the same file (e.g. running inside $HOME), the rules config was loaded twice, producing duplicate rule entries. The policy loader now detects this via resolve() and realpathSync() and skips the redundant read.

Tests

• test: isolate home scope regression — Added dedicated tests to verify that rules are not duplicated when the home and project scopes overlap.

Thanks to @sQVe for reporting the issue in #61 .

Changes

• kimi-code: resolve config from correct directory — Config path now resolves from KIMI_CODE_HOME / .kimi-code instead of the legacy KIMI_SHARE_DIR / .kimi.
• kimi-code: match PreToolUse hook to `Bash` tool — The hook matcher was targeting Shell but Kimi Code exposes the tool as Bash. Updated to match the correct tool name.

Docs

• readme: note optional cc-safety-net skill for Kimi Code — Added a note about the /cc-safety-net skill for configuring custom rules.

Bug Fixes

• opencode: write audit logs for blocked commands — When a command is blocked and a sessionID is present, the plugin now correctly writes an audit log entry. Previously, blocked commands in OpenCode sessions were not being logged.
• opencode: inject audit log home directory — The plugin now accepts and forwards a homeDir parameter to the audit logger, ensuring logs are written to the correct location.

Thanks to @johnatas-henrique for reporting the issue in #58 .

Security Fix

• Bumped `shell-quote` to v1.8.4 — addresses a parsing vulnerability in the upstream dependency (#56)

Thanks to @joerawr for reporting the shell-quote vulnerability in #55.

Bug fix: Preserve effective cwd when cd targets the current directory.

Previously, commands like cd . or cd /current/path would reset the effective cwd to unknown, potentially causing false-positive blocks on subsequent segments. The analyzer now resolves cd targets and recognizes when the directory hasn't actually changed, keeping the cwd intact.

Changes

• fix(analyze): Preserve effective cwd when cd targets the current directory
• fix(explain): Align cwd trace with resolved cd-to-same-directory behavior
• test(rm): Assert rm -rf stays allowed after cd to current cwd

Features

• Expanded Pi shell tool safety analysis — Added support for custom working directories and additional tool adapters, broadening the scope of shell command interception.

Refactors

• Renamed `tool_use` → `tool_call` — Aligned internal event handling naming with upstream API terminology.
• Pruned unused exports — Removed dead exports, marked test-only helpers with @internal, and updated AGENTS.md with new knip standards.

Docs

• Added plugin troubleshooting steps to README.

CC Safety Net v1.0.0

This project originally started as a Claude Code plugin and was previously known as "Claude Code Safety Net." With v1.0.0, it has been rebranded to CC Safety Net — where CC stands for Coding (agent) CLI — to reflect its expanded support for multiple coding agent platforms including Codex, Copilot CLI, Gemini CLI, Kimi CLI, Pi and more to come.

Highlights

• Rulebook-backed configuration — Custom rules now live under .cc-safety-net/rules/ with a declarative config, replacing the legacy verify-config workflow. New CLI subcommands (rule init, rule list, rule migrate, rule remove) manage the full lifecycle.
• Pi coding agent extension — Added Pi as a supported integration with hook support and doctor detection via runtime probe.
• Kimi CLI integration — Added as a supported coding agent with doctor detection, system info, and display.
• Centralized integration registry — Hook integrations are now driven by a shared metadata module with flag-based lookup, replacing per-integration boilerplate.
• Expanded destructive command detection — Better coverage for git long-option abbreviations, wrapper commands, find -exec nested analysis, awk escape decoding, ANSI-C quotes, time builtin prefixes, and shell variable targets in rm -rf.

Breaking Change: Custom Rules Migration

The custom rules system has moved from legacy inline config files to a rulebook-based layout. Legacy inline config files (.safety-net.json and ~/.cc-safety-net/config.json) are no longer loaded at runtime. If they contain rules, commands now fail closed (stay blocked) until you migrate. Please read more at here.

Security & Reliability

• Fail closed on invalid hook input, analysis errors, and config loading failures.
• Expanded secret redaction (provider tokens, command substitution env assignments).
• Block git SSH env overrides and shell/awk analyzer bypasses.
• Resolve rm targets and TMPDIR symlinks before safety checks (TOCTOU hardening).
• Rollback config and lock on --delete-source failure.

CLI & UX

• Renamed builtin OpenCode plugin export to cc-safety-net.
• Migrated env mode reading to CC_SAFETY_NET_* prefixed variables.
• Removed legacy verify-config command flags.
• Improved rule command help output and formatting.

Internal

• Major refactor: modular shell/, analyze/, rules/, and git/ directory layout.
• Declarative CLI command dispatch with const-asserted command registry.
• Shared hook adapter, child-analyzer, and deny-output helpers to eliminate duplication.
• Added jscpd duplicate detection to CI checks.
• Comprehensive test coverage for all new features and edge cases.

New Features

• Add Codex Plugin
• Add WorkTreeMode

Changed

• Add worktreeMode option to AnalyzeOptions and TraceStep
• Add linked worktree detection module
• Relax local git discards in linked worktrees
• Add SAFETY_NET_WORKTREE to CLI surfaces and explain
• Add AnalyzeNestedOverrides type and envAssignments to AnalyzeOptions
• Track cwd changes from env -C/--chdir in wrapper stripping
• Propagate env/cwd/worktree overrides through analyzeNested
• Propagate wrapper env/cwd to nested analysis in segment
• Handle remote parallel execution and wrapper info propagation
• Propagate wrapper env/cwd through xargs child analysis
• Track sudo/env chdir and split-string in wrapper stripping
• Track exported git context env vars across shell segments
• Propagate wrapper env/cwd through interpreters, BusyBox, parallel, and xargs
• Verify linked worktree config matches root before relaxing
• Tighten worktree relaxation for recursive submodules and double-force clean
• Support sudo --chdir and git context append env assignments
• Handle typeset, declare, and shell git context env assignments
• Track GIT_INDEX_FILE as git context override and verify gitdir backlink
• Fail-closed on dynamic git arguments and sudo chdir/login in worktree mode
• Track allexport mode and append assignments for shell git context
• Track keyword export and readonly in shell env context, improve builtin resolution
• Treat dynamic stdin and replacement tokens in parallel and xargs as non-worktree-safe
• Fail-closed on dynamic arguments, recursive submodules, and forced branch resets in worktree mode
• Physical path resolution and symlink hardening
• Track git config envs, keyword exports, readonly, and builtin
• Improve parallel placeholder detection and dynamic args handling
• Worktree hardening with PATH bypass and config env detection
• Seed exported names from process env and git config-affecting env vars
• Read local git config for recursive submodule check before invoking git binary
• Expand trusted git binaries and export for testing
• Add Windows Git binary paths to trusted binaries list
• Add Codex platform hook detection
• Color error messages red in hooks section

Breaking Changes

• Migrate slash commands to skills format

Fixed

• Keep ref-moving resets blocked, relax only local discards
• Use wrapper-resolved cwd in explain segment and disable fallback worktree relaxation
• Propagate env assignments and wrapper cwd into nested analysis
• Use platform-aware path separators for Windows compatibility
• Use wrapper cwd in xargs and parallel rm analysis
• Compare paths by inode identity with normalized realpath fallback
• Handle Windows native realpath prefixes in path comparison
• Handle double-quoted escapes in git config value parsing
• Treat missing trusted git binary as recursive submodule config enabled
• Parse commented JSON in Copilot CLI config files
• Handle Claude Code plugin list without blank separators
• Parse Codex config section headers with inline comments
• Use effective enabled state for Gemini CLI extension detection
• Exclude metadata email lines from Claude Code plugin block detection

Related Issues

• Issue #44: Relax destructive-change rules when running inside a git worktree
• Issue #47: [Feature]: Allow to bypass some rules
• Issue #46: [Feature]: Support for Codex (closed by PR #49)

Related PRs

• PR #48: Worktree mode (closes issue #123)
• PR #49: Codex hooks compatibility (closes issue #46)

Fixed

- Allow rm -rf for explicit temp-directory targets such as /tmp/..., /var/tmp/..., and $TMPDIR/... even when the current working directory is $HOME - Move home-directory rm classification into the shared rules-rm analyzer so blocking decisions and explain output follow the same target-aware path

Related Issues

• Issue #41: False positives block legitimate cleanup operations and string literals in gh commands

Related PRs

• PR #42: fix(rules-rm): allow temp targets when cwd is home directory

New Features

• Detect copilot-safety-net plugin installs in doctor via copilot plugin list

Fixed

• Populate configPath consistently when Copilot CLI is detected through the plugin flow
• Report copilot-plugin as the config path for plugin-based Copilot CLI detection

Related PRs

• PR #40: feat: add copilot cli plugin detection to doctor command

New Features

• Add doctor support for GitHub Copilot CLI, including detection of Safety Net hooks in repository hook files, user hook files, and inline Copilot settings with version-aware diagnostics.
• Block git switch --force, git switch --discard-changes, and git checkout --force / -f.

Changed

• Show the detected Copilot CLI version in doctor output and probe Copilot version commands more quickly and reliably.
• Expand Copilot CLI setup documentation to cover hook-file and inline config variants, config precedence, disableAllHooks, and COPILOT_HOME.

Fixed

• Close a TMPDIR path traversal bypass so non-temp overrides cannot escape /tmp, /var/tmp, or the system temp directory.
• Harden shell parsing so destructive commands are still detected inside redirects, nested command substitutions, arithmetic expansions, grouped subshells, process substitutions, and attached backticks.
• Fix git checkout argument parsing for ambiguous ref/pathspec cases and documented option variants without misclassifying value-taking flags such as git switch -cfeature.

Thanks to @jacoballen4534 for identifying and suggesting the fix for Windows support in #21.

Thanks to @lgandecki for identifying the npx performance overhead.

v0.3.2 (2026-01-03)

Fix

• add AskUserQuestion tool to improve UX

v0.3.1 (2026-01-02)

Fix

• Add cross-platform script execution compatibility

v0.3.0 (2026-01-01)

Feat

• add short option expansion to custom rule matching
• add commands for custom rules management
• detect find -exec rm -rf as destructive pattern
• add verify_config script for config validation
• integrate custom rules into hook analysis
• add custom rule matching logic
• add config loading module for user-configurable rules

Fix

• stop _short_opts parsing at non-alpha chars and -- marker
• Block rm -rf of cwd itself even when under /tmp/

Refactor

• improve verify_config output formatting
• return ValidationResult from validate_config_file

v0.2.0 (2025-12-29)

Feat

• add audit logging for denied commands
• add paranoid mode environment variable checks
• detect dangerous commands via xargs and parallel
• block git worktree remove --force
• block git checkout <ref> <pathspec> without --
• block find -delete destructive command

Fix

• Add cross-platform script execution compatibility
• recognize rm -R (uppercase) as recursive and respect -- delimiter
• preserve case sensitivity for git branch -D detection

Refactor

• rename strict to paranoid for rm rule parameter

v0.1.0 (2025-12-26)

Feat

• initial implementation