Dicklesworthstone/destructive_command_guard v0.12.1

on GitHub

dcg v0.12.1 — security release

Upgrade recommended for every v0.11.0 – v0.12.0 install.

Security

• A heredoc piped into a shell or interpreter bypassed every rule. cat <<'EOF' | bash … EOF (also | sh, | bash -s, | python3, | sudo bash, | env bash) executed its body unguarded on v0.11.0 – v0.12.0. tree-sitter-bash attaches the pipeline of a heredoc-carrying statement to the heredoc_redirect node, so the executable-sink collector never saw the consumer while the data-sink masking treated the cat heredoc as inert prose. The producer is now synthesized from the enclosing statement and the body is evaluated as the consumer's source; non-cat heredoc producers into a shell fail closed as heredoc.posix:pipeline-consumer. Data consumers (| grep, | wc, | tee file, > file) are unchanged.
• Rebase recovery unlocks only the recovery rules, never the whole line (#331). git restore -- f; git reset --hard and a second git restore in another repository after a further cd were allowed outright during an in-progress rebase. A recovery signal now triggers a re-evaluation with exactly the four recovery rules granted; any other finding keeps its own verdict and the permit is spent only when the line actually runs.
• dcg hook batched envelopes resolve every entry before one speaks. Follow-up to the #330 fix: a warn/log-policy entry could end evaluation of a VS Code toolCalls[] batch with later destructive entries unevaluated. Entries now rank deny > indeterminate > ask > warn > log > allow.

Fixed

• dcg hook honours [policy] mode overrides, matching dcg test and bare dcg (#330); a new additive "mode" field reports the resolved mode.
• Rebase recovery probes the repository the command actually reaches — cd <worktree> && git restore --ours -- f from a sibling cwd is now allowed during a rebase, and a minted permit is consumed there (#331).
• Windows binaries now carry a VERSIONINFO resource (product, company, description, version) and an asInvoker manifest (#303) — dcg.exe previously shipped with no PE metadata at all, a classic input to Defender's !ml heuristics. Metadata only; no code path changes.
• The #329 prose-through-data-sink posture is pinned by tests (cat > notes.md <<'EOF' … EOF is data; inline interpreter literals deliberately stay conservative).

See CHANGELOG.md for the full entry.

Verification

Every archive has .sha256, .minisig (key ID 69B3955C8D2E62A8), .sigstore.json (local-release cosign key, DER SHA256 0e6947743daf39d6413cb25f6c96601427e38885f3a756e9f98f37d66e6df7a4) and SLSA .intoto.jsonl provenance sidecars. install.sh --require-minisign / install.ps1 -RequireMinisign -Verify enforce them.