github kenryu42/cc-safety-net v2.2.0

3 hours ago

Adds Grok Build as a supported coding agent CLI, and fixes Windows protection for Git Bash style /c/... paths that previously slipped past checks their C:/... spelling would have blocked.

Added

  • Added Grok Build support: install the PreToolUse hook with cc-safety-net install --grok-build (remove it with uninstall --grok-build), or run the adapter directly with cc-safety-net hook --grok-build / -gb. The hook config is written to ~/.grok/hooks/cc-safety-net.json, honors GROK_HOME, and install and uninstall preserve any other hook entries in that file. Note that Grok Build hooks are fail-open by design, so only an explicit deny blocks a tool call; see SECURITY.md for the limits. (#92)
  • Added Grok Build to cc-safety-net doctor, which reports the hook as configured and warns when the managed entry has drifted, such as a coverage-narrowing matcher, a handler type other than command, or a changed timeout. (#92)
  • Added secret protection for Grok Build credentials and config files: ~/.grok/auth.json, ~/.grok/mcp_credentials.json, ~/.grok/config.toml, ~/.grok/managed_config.toml, ~/.grok/requirements.toml, <project>/.grok/config.toml, /etc/grok/managed_config.toml, and /etc/grok/requirements.toml. (#92)

Fixed

  • Fixed Windows handling of MSYS and Git Bash path spellings such as /c/Users/..., which were previously read as paths on the current drive. Recursive rm classification, protected policy path checks, secret-file protection, and HOME and CC_SAFETY_NET_HOME resolution now normalize these to the native C:/... form first, so a destructive command written in the /c/ form is treated the same as its C:/ form. (#91)

Don't miss a new cc-safety-net release

NewReleases is sending notifications on new releases.