kenryu42/cc-safety-net v2.4.6

on GitHub

Standard mode now tells reads and executions apart from mere mentions of a sensitive file name or a destructive command, so far fewer safe commands are blocked. Strict and paranoid modes keep every previous denial.

Highlights

• Reduced standard-mode false positives across secret protection, heredoc bodies, interpreter string literals, and xargs shell bodies. (#132)
• Fixed gh and git text flag values being read as file paths, so searches, titles, bodies, jq filters, and commit messages no longer trip secret protection. (#131, #133)

Added

• Added an approval prompt for commands standard mode cannot verify: the Claude Code hook now answers with permissionDecision: "ask" and the message CC Safety Net could not verify this command instead of denying. This applies only in the default, acceptEdits, and plan permission modes; every other mode, every other host, and strict and paranoid modes keep denying. (#132)

Changed

All changes below apply to standard mode only; strict and paranoid modes are unchanged.

• Changed metadata-only checks of built-in sensitive paths (ls, stat, test -e/-f, [ -e/-f ], git check-ignore, and find with no actions) to be allowed as one segment of a compound command, not only when standalone.
• Improved built-in sensitive-path matching so a secret file name that names an existing directory, a word containing whitespace that neither starts like a path nor exists on disk (such as for c in 'cat ~/.aws/credentials'), and an output redirection that creates a secret-named file where none exists are no longer treated as reads. Home-directory and coding-CLI credential rules are never relaxed.
• Changed unquoted heredocs whose body expands only variables, with no $(…) or backtick substitution, to be treated like quoted heredocs. A script written from such a heredoc is still analyzed when a later command runs it.
• Changed a destructive command written as an interpreter string literal to block only where an execution call can receive it, or where the code holds backticks, %x, or qx.
• Changed xargs input spliced into a sh -c body to count as a data word when it never starts a command and the body stays harmless with / in its place, so grep -rl TODO src | xargs -I{} sh -c 'echo "--- {}"; head -3 {}' is allowed while xargs -I{} sh -c 'rm -rf {}' and xargs -I{} sh -c '{} --verbose' stay blocked.
• Changed eval of a single literal local generator command to also accept the unquoted form, so eval $(opam env) is allowed alongside eval "$(ssh-agent -s)".
• Improved interpreter detection so uv run python - and an interpreter reading its program from - followed by script arguments are recognized as stdin programs.

Fixed

• Fixed gh and git text flag values being inspected as file paths. gh issue list --search credentials, -S, --title/-t, --body/-b, --jq/-q, the git commit, merge, notes, stash, and tag message flags including clusters such as -am and -nm, and git log --grep are now read as text. File-taking options such as --body-file, --input, and git commit -F, plain operands, and command substitutions inside a text value are still inspected. (#131, #133)
• Fixed find -files0-from FILE not being treated as a read of FILE, so find -files0-from .env is blocked and find with that option no longer counts as a metadata-only check.