kenryu42/cc-safety-net v2.0.11

on GitHub

This release removes two false blocks — literal heredoc bodies and Amp shell commands that run outside the workspace root — and hardens the doctor, GUI, and integration paths against malformed input.

Changed

• Changed the local GUI server to reject a request body larger than 1 MiB with HTTP 413 instead of buffering it in memory.

Fixed

• Fixed the analyzer blocking an unquoted heredoc whose body contains no $, backtick, or backslash. Such a body reaches the command byte-for-byte, so it is now analyzed as literal data, while a body with expansion or escape characters keeps the raw-text scan. (#87, #86)
• Fixed Amp shell calls failing closed when dir points outside the workspace root. The directory is now canonicalized, with symlinks resolved, and the command is analyzed there; a directory that cannot be canonicalized still fails closed. (#85)
• Fixed Git metadata protection covering only the execution directory's repository. It is now anchored to both the execution and configuration directories, so a workspace repository's .git stays protected when a command runs elsewhere. (#85)
• Fixed cc-safety-net doctor exiting 0 while reporting an error-level finding, such as an unsafe policy, config, or audit directory.
• Fixed the GUI policy editor failing to render a draft saved by an older build or damaged in storage. Drafts are now validated against the policy shape and discarded when they do not match.
• Fixed the GUI folder picker offering a dialog program that cannot start. A PATH entry now counts only when it is an executable file.
• Fixed GitHub Copilot CLI detection accepting a hook config with an unexpected shape. An invalid hooks.preToolUse is now reported as a configuration error.
• Fixed Antigravity CLI installation failing on a hand-edited hooks config that holds unexpected JSON shapes. Unrecognized entries are now left untouched.
• Fixed doctor and audit summaries trusting malformed audit log records. A record that does not match the expected shape is now counted as skipped.
• Fixed hook agent detection failing when a payload supplies a non-string transcript path. It now falls back to an unknown agent so analysis still runs.
• Fixed rulebook discovery from GitHub accepting unexpected API responses. It now stops with a clear inspection error.