Dicklesworthstone/destructive_command_guard v0.9.1

on GitHub

v0.9.1

Hardening patch: an adversarial review of the v0.9.0 changes (three independent reviewers probing the released binary A/B against v0.8.0) surfaced eight defects introduced by that release, all fixed here with regression coverage on both the all-dialect and real hook-path (Posix) evaluation routes.

Fixed

• mise exec is now a fully modeled execution frontend. The v0.9.0 wrapper support could strip the real command as prefix (mise exec rm -rf / -- ok evaluated only ok) or let an option value become an echo that masked the rest of the argv. The wrapped command now starts at the first bare word or after --, with modeled option arities (-C/--cd, -E/--env, -j/--jobs); destructive mise-wrapped commands deny on every dialect path.
• Batched toolCalls entries evaluate independently. Joining a batch with newlines let an entry ending in an unterminated quote or trailing backslash swallow the next entry's destructive command. Each entry (and the singular toolCall when both are present) is evaluated on its own; the first non-allow decision answers the request. The dcg hook batch subcommand gained the same semantics.
• Malformed toolCalls shapes no longer abort the payload parse (which silently skipped evaluating a well-formed tool_input command); batch entry gating now also accepts nameless-with-args, run_command, and CommandLine-keyed entries.
• The Posit Assistant protocol steer fires only for its own tools, no longer re-shaping Gemini-without-event or bare-Copilot payloads.
• Subshell bindings no longer prove outer variables in the #242 constant-propagation proof (x=$(for f in a b; …); mv $f d/ denies again), and +=, array-element, and glob-bearing assignments all refuse the proof.
• Glued -c payloads starting with punctuation (-c"/bin/sh …") are detected as inline-code flags again.
• Installer fixes: the bats test harness can actually fail again (it was structurally inert), which surfaced and fixed a BSD-sed incompatibility in "already configured" detection, an unquoted Copilot hook path breaking spaced install dirs, a prompt hang on operator-less ptys (prompts now time out to their default), an empty Posit settings-file failure, swallowed uninstaller warnings, and a PowerShell uninstaller dropping user-authored empty matcher groups.

Full details in the CHANGELOG. Same signing chain as v0.9.0: SHA256 + minisign (key 69B3955C8D2E62A8) + Sigstore cosign bundles + SLSA provenance on every artifact.