github kenryu42/cc-safety-net v2.4.4

3 hours ago

This release removes false positives on disposable work in temporary directories: the analyzer now tracks a literal cd, so recursive deletes and Git discards inside a temp-root repository unrelated to your workspace are recognized as safe.

Highlights

  • Git discards and forced worktree removals that target a temp-root repository unrelated to your workspace are now allowed without any toggle, while force pushes and anything that reaches your workspace stay blocked.

Added

  • Added a Temp-root relaxation step to explain output that names the Git working directory permitting a discard.

Changed

  • Changed the analyzer to stop tracking the working directory when a segment assigns or appends to CDPATH, and to leave a bare cd operand untracked while CDPATH could redirect it, so a relaxation is never granted for a directory the shell may not actually enter.
  • Changed the rule reported for a self-targeting delete after a tracked cd, such as cd /tmp; rm -rf ., to the more specific rm.recursive-force-cwd-self or rm.git-metadata instead of rm.recursive-force-outside-cwd. The command is still blocked; only the ruleId in explain --json changes.

Fixed

  • Fixed rm -rf with a relative target being blocked after a cd into a temporary directory. The analyzer now resolves a literal cd operand past -L, -P, and -- and treats the target as a temp delete. (#124)
  • Fixed Git discards such as git reset --hard and git clean -fdx being blocked in a temp-root repository reached through a tracked cd, including a cd whose operand expands from a literal assignment or from a literal for list of at most eight words. A force push, a discard aimed through GIT_DIR or another explicit Git context, and a repository that is or contains your workspace remain blocked. (#125)
  • Fixed git worktree remove --force being blocked when its operand is an existing absolute temp-root directory unrelated to your workspace. A relative, missing, symlinked, or dynamically built operand still keeps the rule. (#126)

Don't miss a new cc-safety-net release

NewReleases is sending notifications on new releases.